The card has one advantage over everything else you might say: it does not have to be answered, and it can be read twice, in private, at three in the morning. Cards get kept. This is worth taking seriously for four lines.
The printed verse inside has already done the generic part. Your job is not to add more of it, so resist the pull toward that register — words cannot express, in this difficult time, my deepest condolences. That is the language of an institution, and it makes a handwritten note sound like a form letter.
A structure that works nearly every time, in four lines:
One. Say the name and say you are sorry. “I’m so sorry about Ellen.”
Two. One specific true thing. A memory if you have one — “I keep thinking about her at the lake, refusing to admit the water was cold” — or, if you didn’t know them, your own honest reaction: “I never met your father, but I have been thinking about your family all week.”
Three. One sentence that does not ask for anything. “You don’t need to write back.” Or: “I’m not going anywhere.”
Four. Your name — and if there is any chance they won’t place you instantly, how they know you. Grieving people cannot hold a hundred half-remembered names, and a card they cannot place is a small stress rather than a comfort.
If you want the card to do something no other card will: write down a memory they may not have. The stories a person collects from outside the family are the ones they have never heard, and they become permanent. “He probably never told you this, but in 1998 he drove four hours to pick me up from a bus station at midnight and never once mentioned it again.” That card gets kept for thirty years.
Send it late if you missed the moment. A card that arrives six weeks after the funeral, when the house has gone quiet, is not a failure of timing. It is often the best-timed thing anyone sends.