Credit card fraud happens when someone uses your card number or account without your permission, and the fastest response is to call your card issuer the moment you notice it
Credit card fraud falls into two main categories: card-present fraud, where a physical card is stolen or counterfeited and used in person or online, and card-not-present fraud, where only your card number is used — typically from a data breach, phishing email, or skimming device. The card issuer, not you, bears the legal liability for fraudulent charges once you report them, which is why your first step is always a phone call to the number on the back of your card, not a number from an email or text.
Most card issuers have fraud detection systems that flag unusual activity, but they cannot catch everything. A charge that appears in your statement may have been pending for days before posting, so checking your account weekly — not just monthly — gives you a window to stop fraud before it spreads. The sooner you report, the sooner the issuer can reverse charges and issue a replacement card.
Key Takeaways
- Call your card issuer when ready using the number on the back of your card; do not use contact information from an email or text message.
- The card issuer is legally responsible for fraudulent charges once you report them, and you are typically liable for no more than $50 per card under federal law.
- Request a new card with a different number, and ask the issuer to flag your account so pending charges can be reviewed before they post.
- Check your credit report at annualcreditreport.com within 30 days to watch for accounts opened in your name, which signals identity theft beyond card fraud.
- Fraudsters often test stolen card numbers with small charges first; disputing even a $1 charge stops them from escalating to larger amounts.
How fraudsters get your card number
Data breaches at retailers, restaurants, and hotels expose millions of card numbers at once. When you swipe or insert your card at a checkout terminal, a breach in that merchant's payment system can copy your number, expiration date, and sometimes your CVV. Online, phishing emails that look like they come from your bank or a store trick you into entering your card details on a fake website. Text messages claiming your card is locked or your account needs verification use the same tactic.
Skimming devices — small readers hidden inside ATM slots or gas pump card readers — capture your card data when you insert your card. Dumpster diving and mail theft can yield physical statements or new cards in transit. Restaurant servers and retail workers with access to your card can photograph it or write down the number. None of these require your PIN or password; the card number alone is enough to make online purchases or create a duplicate card.
What happens when fraud is reported
When you call your card issuer and report fraudulent charges, the issuer when ready flags your account and begins an investigation. They will ask you to confirm which charges are yours and which are not. Any charge you dispute is typically reversed within one to three business days as a temporary credit while the investigation continues, though the final information can take up to 60 days. During this time, your account remains open but the fraudulent card is deactivated.
The issuer will mail a replacement card to your address on file, usually arriving within five to ten business days. Some issuers offer expedited replacement for an extra fee or at no charge. Until the new card arrives, you can still use your account online if you have the card number saved in your digital wallet, or you can request a temporary card number for online purchases. The issuer will also review the fraudulent charges to determine whether they were made online, in person, or through a third party, which helps them identify patterns and prevent future fraud on other accounts.
Your liability and what the law protects
Under the Fair Credit Billing Act, your liability for fraudulent credit card charges is capped at $50 per card, and only if the card issuer can prove you were negligent — for example, that you wrote your PIN on the card itself. In practice, most issuers waive the $50 entirely and hold you liable for $0 once you report the fraud. This protection applies only to credit cards, not debit cards, which have weaker protections under a different law.
The key word is report. Your liability protection only kicks in after you notify the issuer in writing or by phone. If you wait months to report fraud, the issuer may argue you should have noticed sooner and deny your claim. This is why checking your statement weekly matters: the sooner you spot it, the sooner you are protected. Keep records of your phone call — the date, time, and name of the representative you spoke with — in case you need to prove you reported it.
Steps to take when ready after discovering fraud
First, call the card issuer using the number on the back of your physical card or from your online account login. Do not call a number from an email or text, because fraudsters sometimes send fake notifications with their own phone numbers. Tell the representative which charges are fraudulent and ask them to reverse them. Request a new card with a different number and ask them to place a note on your account flagging it for fraud — this tells the issuer to manually review any pending charges before they post.
Second, place a fraud alert on your credit file by contacting one of the three credit bureaus — Equifax, Experian, or TransUnion. You only need to contact one; that bureau will notify the other two. A fraud alert tells creditors to verify your identity before opening new accounts in your name. The alert lasts one year and is free. If you believe your identity has been stolen (not just your card number), you can place a credit freeze, which blocks all new credit inquiries until you lift it.
Third, visit annualcreditreport.com and request your free credit report from all three bureaus. Look for accounts you did not open, inquiries from creditors you did not contact, or addresses that are not yours. These are signs that a fraudster has moved beyond your card number and is attempting identity theft. If you find unauthorized accounts, contact the creditor when ready and file a report with the Federal Trade Commission at reportidentitytheft.ftc.gov.
Protecting yourself from future fraud
Enable transaction alerts on your card account so you receive a text or email notification every time a charge posts. This catches fraud within hours rather than days. Use your card issuer's mobile app to monitor your balance in real time. Never save your full card number in your browser or email; use digital wallets like Apple Pay or Google Pay instead, which tokenize your card and do not expose the full number to merchants.
When shopping online, use a credit card rather than a debit card — credit cards have stronger fraud protections. Avoid entering your card number on public Wi-Fi networks; use your phone's cellular data or a private network instead. At ATMs and gas pumps, inspect the card reader before inserting your card; if it looks loose or different from others, use a different machine. Shred paper statements and receipts before throwing them away. Do not respond to emails or texts asking you to verify your card details, even if they appear to come from your bank — legitimate banks never ask for this information via email.
When fraud involves identity theft
Card fraud and identity theft are not the same thing. Card fraud is someone using your card number; identity theft is someone using your personal information — name, Social Security number, date of birth — to open new accounts or take out loans in your name. If your credit report shows accounts you did not open, or if you receive bills for services you never signed up for, you are dealing with identity theft, not just card fraud.
Identity theft requires more steps than card fraud. Beyond placing a fraud alert and freezing your credit, you should file a report with the Federal Trade Commission at reportidentitytheft.ftc.gov, which creates an official record and generates an identity theft report you can show to creditors and law enforcement. You may also need to file a police report in your jurisdiction, particularly if the thief has taken out loans or opened credit accounts. Contact each fraudulent creditor directly and ask them to close the account and remove it from your credit report. This process can take months or years, but each step creates a paper trail that protects you if the thief tries again.
Frequently Asked Questions
Will I have to pay for fraudulent charges while the investigation is happening?
No. Once you report the fraud, the card issuer reverses the charges as a temporary credit within one to three business days. You will not see those charges on your bill. The investigation continues for up to 60 days, but you are not responsible for paying them during that time.
What if the fraudster used my card at a store in person?
Call your card issuer the same way. The issuer will reverse the charges regardless of whether the fraud happened online or in a physical store. The investigation may take slightly longer because the issuer has to contact the merchant and review security footage, but your liability remains $0 once you report it.
Can I dispute a charge if I am not 100 percent sure it is fraud?
Yes. If you do not recognize a charge, dispute it. The card issuer will investigate and either confirm it is fraud or show you evidence that it is legitimate. You are not penalized for disputing a charge you later recognize as your own, though repeatedly disputing legitimate charges may eventually trigger account restrictions.
How long does it take to get a replacement card?
Standard replacement usually takes five to ten business days. Many issuers offer expedited replacement for an extra fee, which can arrive in two to three business days. Some issuers provide a temporary card number you can use online while you wait for the physical card to arrive.
Should I close my credit card account after fraud?
Not necessarily. Closing the account can actually hurt your credit score because it reduces your available credit and shortens your credit history. Keep the account open after the fraud is resolved. The new card you receive will have a different number, so the old fraudulent card is useless to the thief.