What credit card fraud protection actually covers
Credit card fraud protection is a set of rules and policies that limit what you owe if someone uses your card without permission. The key word is limit — you are not automatically refunded for every fraudulent charge. The protection depends on when you report it, what type of fraud happened, and which card you used.
Federal law (the Fair Credit Billing Act) caps your liability at $50 per card if someone uses your physical card or card number without permission. Most major card issuers go further and offer $0 liability, meaning you pay nothing if fraud is confirmed. But that $0 protection only works if you report the fraud quickly — usually within 60 days of the charge appearing on your statement.
The protection does not cover authorized charges you later regret, charges from someone you gave permission to use your card, or money sent through payment apps like Venmo or PayPal. Those fall under different rules or no protection at all.
Key Takeaways
- Federal law limits your liability to $50 per fraudulent charge, but most card issuers waive that fee entirely if you report fraud within 60 days.
- You must report fraud to your card issuer in writing or by phone within 60 days of the charge appearing on your statement to get the strongest protection.
- Debit cards and prepaid cards have weaker fraud protection than credit cards, with higher liability limits and shorter reporting windows in some cases.
- Fraud protection does not cover charges you authorized, even if you later changed your mind or were pressured into the purchase.
- Monitoring your statements regularly and setting up transaction alerts are your first line of defense, because the sooner you report fraud, the faster the dispute process moves.
The 60-day reporting window and why it matters
The moment a fraudulent charge appears on your statement, a clock starts. You have 60 days from that date to report it to your card issuer. After 60 days, you lose federal protection under the Fair Credit Billing Act, and the card issuer has no legal obligation to refund you.
Most card issuers set their own internal important date earlier than 60 days — often 30 or 45 days — so waiting until day 59 is a bad strategy. Call or write to your card issuer as soon as you spot the charge. Have your statement in front of you and be ready to describe the transaction: the date, the merchant name, and the amount.
Once you report it, the issuer must acknowledge your dispute in writing within 30 days. They then have up to 90 days total to investigate and decide whether the charge was fraudulent. During that time, the charge is typically removed from your balance, so you do not have to pay it while they investigate.
Credit cards versus debit cards: why the difference matters
Credit card fraud and debit card fraud are treated very differently by law, and the difference affects how much you can lose and how fast you get your money back.
With a credit card, you are disputing a charge on borrowed money. The card issuer has a financial incentive to resolve it quickly because they are the ones out the money until it is resolved. Your liability is capped at $50 by federal law, and most issuers waive that. You report fraud, they investigate, and if fraud is confirmed, the charge disappears.
With a debit card, you are disputing a charge on your own money that has already left your account. Your liability depends on how fast you report it. If you report it within two business days, your liability is capped at $50. If you report it after two business days but within 60 days, your liability jumps to $500. If you wait longer than 60 days, you could lose the entire amount with no protection at all.
Prepaid cards (like reloadable gift cards) often have even weaker protections or none at all, depending on the card issuer and the card type. Check your card's terms before you load money onto it.
How to report fraud to your card issuer
Speed matters, so start by calling your card issuer's fraud line. The number is on the back of your card or on your statement. Have your card and a recent statement ready. Tell them which charge is fraudulent, when it appeared, and whether you recognize the merchant.
The phone call starts the clock on your dispute, but follow it up in writing within a few days. Send a letter or email to the address the issuer provides (usually a fraud department address on your statement). Include your account number, the date of the fraudulent charge, the amount, the merchant name, and a brief explanation of why you believe it is fraudulent.
Keep copies of everything you send and every response you receive. If the issuer denies your dispute, you will need that paper trail to escalate the case or file a complaint with your state's attorney general or the Consumer Financial Protection Bureau (CFPB).
Do not close the card while a dispute is pending. Closing it can slow the investigation or cause the issuer to lose track of your case.
What happens during the investigation
Once you report fraud, the card issuer's fraud department takes over. They contact the merchant to ask whether the charge was legitimate. The merchant either confirms they processed the charge (and provides proof, like a signature or IP address) or confirms they did not.
If the merchant cannot prove the charge was authorized, the issuer typically rules in your favor and removes the charge. If the merchant provides evidence that looks legitimate — like a matching signature or billing address — the issuer may deny your dispute. At that point, you can escalate by requesting a second review or filing a complaint with the CFPB.
The entire process usually takes 30 to 90 days. During that time, the charge is removed from your balance, so you are not paying interest on it. Once the dispute is resolved, the issuer sends you a written decision.
Preventing fraud before it happens
Fraud protection exists, but prevention is always better than disputing charges later. Check your statement every month — most card issuers let you view charges online within a day or two of the transaction. Set up transaction alerts through your card issuer's app or website so you get a notification every time your card is used. Many issuers let you customize alerts by amount (for example, alert me on any charge over $50).
Use your credit card instead of your debit card for online purchases and at unfamiliar merchants. Credit cards have stronger fraud protection, and you are disputing the card issuer's money, not your own. Never give your card number, expiration date, or CVV to someone who calls you or emails you unsolicited. Legitimate companies do not ask for this information that way.
If you lose your card or suspect it has been compromised, call your issuer when ready to have it frozen or replaced. A new card number stops fraudsters from using the old number, even if they have it written down.
What fraud protection does not cover
Fraud protection has clear limits. It does not cover charges you authorized, even if you were pressured, misled, or changed your mind later. If you gave someone permission to charge your card — a subscription service, a contractor, a friend — that is not fraud in the legal sense, even if you regret it.
Charges made through payment apps like Venmo, PayPal, or Cash App are not covered by credit card fraud protection in the same way. If you send money through one of these apps and the recipient does not deliver what they promised, you are dealing with a different dispute process (if one exists at all). Some apps offer buyer protection, but it is not may provide and the rules vary.
Charges from compromised account credentials (like your Netflix password being stolen) are technically fraudulent, but the dispute process can be slower because the merchant may have legitimate records showing the account was accessed. You still have the right to dispute, but be prepared to prove you did not authorize the charge.
Frequently Asked Questions
Do I have to pay the fraudulent charge while the dispute is being investigated?
No. Once you report fraud to your card issuer, the charge is typically removed from your balance when ready, and you do not have to pay it while they investigate. If the dispute is resolved in your favor, the charge stays removed. If the issuer rules against you, they will re-add it to your balance.
What if my card issuer says the charge was not fraudulent but I know I did not make it?
You can request a second review or escalate the dispute. Ask the issuer what evidence the merchant provided and why they believe the charge was authorized. If you disagree, file a complaint with the Consumer Financial Protection Bureau (CFPB) at consumerfinance.gov. The CFPB can investigate and pressure the issuer to reconsider.
Can I dispute a charge that happened six months ago?
Not under federal fraud protection. You have 60 days from the date the charge appeared on your statement to report it. After that, the card issuer has no legal obligation to refund you. Some issuers may make exceptions for unusual circumstances, but do not count on it.
Does fraud protection cover online shopping if the item never arrived?
That depends on the reason. If the merchant charged you but never shipped the item, that is a merchant dispute, not fraud. You still have the right to dispute it, but the process and timeline may be different. Report it to your card issuer as a "non-receipt of merchandise" dispute rather than fraud. You typically have 120 days to report this type of dispute.
What should I do if I think my card number was stolen but no fraudulent charges have appeared yet?
Call your card issuer and ask them to cancel the card and issue a replacement. They can do this when ready, even without fraudulent charges. A new card number stops fraudsters from using the old one. Monitor your statements closely for the next few months in case charges appear that take time to post.