Your first steps after a credit card data breach
If your credit card information has been leaked, contact your card issuer when ready — call the number on the back of your card or the customer service line listed on your statement. The bank can freeze or cancel the card within minutes, stopping anyone from using the number before fraudulent charges appear. Most issuers have a fraud department that operates 24/7.
While you are on the call, ask the issuer to send you a new card with a different number. Request that they flag your account for fraud monitoring, which means they will watch for suspicious activity over the next 30 to 90 days. Many banks do this automatically after a breach, but confirming it takes 30 seconds and costs nothing.
Do not wait for fraudulent charges to appear before acting. A leaked number can sit in a criminal's database for weeks or months before being used. Acting the day you learn of the breach closes the window before damage occurs.
Key Takeaways
- Call your card issuer the same day you learn of the breach to cancel the card and request a replacement with a new number.
- Place a fraud alert with the three credit bureaus (Equifax, Experian, TransUnion) by contacting any one of them, and they will notify the other two.
- Check your credit reports at annualcreditreport.com for accounts or inquiries you do not recognize, which may indicate identity theft beyond card fraud.
- Monitor your bank and credit card statements weekly for the next several months, since some fraudulent charges take time to post.
- You are not responsible for fraudulent charges on a credit card once you report them, but debit card fraud has different protections and requires faster reporting.
Placing a fraud alert with credit bureaus
A fraud alert tells lenders to verify your identity before opening new accounts in your name. Call any one of the three major credit bureaus — Equifax (1-800-525-6285), Experian (1-888-397-3742), or TransUnion (1-800-680-7289) — and request an initial fraud alert. That bureau will place the alert on your file and notify the other two automatically.
An initial fraud alert lasts one year and is free. It does not freeze your credit or prevent you from opening accounts yourself; it straightforward requires lenders to call you at a phone number you provide before approving new credit in your name. This catches someone trying to open a credit card, car loan, or phone account using your stolen information.
If you want stronger protection, you can place a credit freeze instead, which blocks lenders from viewing your credit report entirely. A freeze is free under federal law and lasts until you remove it. The downside is that you must unfreeze your credit temporarily whenever you explore for credit yourself — a process that takes a few hours to a few days depending on the bureau.
Checking your credit reports for unauthorized accounts
Visit annualcreditreport.com and request your free credit reports from all three bureaus. You are may have access to to one free report from each bureau per year under federal law. Check each report for accounts you do not recognize, hard inquiries from lenders you did not contact, or personal information that is incorrect.
Unauthorized accounts are a sign that someone has used your leaked information to commit identity theft, not just card fraud. If you find accounts you did not open, contact the bureau that reported them and file a dispute. The bureau must investigate within 30 days and remove the account if it cannot verify that you opened it.
Also contact the creditor directly — the bank, credit card company, or retailer that issued the fraudulent account — and report that the account was opened without your consent. Provide them with a copy of your police report if you filed one. Many creditors will close the account and remove it from your credit file once they confirm the fraud.
Understanding your liability for fraudulent charges
Federal law limits your liability for fraudulent credit card charges to $50, and most card issuers waive that $50 entirely if you report the fraud before charges post. Once you report the card stolen or compromised, you are not responsible for any charges made after that report, even if they appear on your statement weeks later.
Debit card fraud is different. If you report a debit card stolen within two business days of discovering the fraud, your liability is capped at $50. If you wait more than two business days, you could be liable for up to $500. If you wait more than 60 days after your statement arrives, you could lose all the money in the account. This is why reporting a debit card breach when ready is critical.
Credit card fraud is also easier to dispute because you can refuse to pay the charge while the issuer investigates. Debit card fraud pulls money directly from your account, so you must fight to get it back. If your leaked card was a debit card, prioritize calling your bank within 24 hours.
Monitoring for ongoing fraud after the breach
Check your bank and credit card statements weekly for the next three to six months. Look for charges you do not recognize, even small ones — criminals sometimes test stolen numbers with small purchases before attempting larger fraud. Report any suspicious charge to your card issuer when ready.
Set up account alerts with your bank and card issuers if they offer them. Many banks allow you to set alerts for purchases over a certain amount, purchases in certain categories, or any online transaction. These alerts notify you by text or email within minutes of a charge, so you can report fraud before it spreads.
If the breach involved other personal information beyond your card number — your name, address, Social Security number, or date of birth — consider paying for credit monitoring or identity theft protection for one to two years. These services scan the dark web and credit markets for your information and alert you if it appears. Some are free through your card issuer after a breach; others cost $10 to $30 per month.
When to file a police report
File a police report if fraudulent charges exceed $500 or if you discover unauthorized accounts opened in your name. You can file online through your local police department's website or in person at a precinct. You do not need to wait for charges to post; you can file as soon as you discover the breach and suspect fraud will follow.
A police report creates an official record that you can provide to creditors, credit bureaus, and your card issuer. It strengthens your dispute if a creditor questions whether you really opened an account, and it may be required by some creditors before they will remove a fraudulent account from your file.
Keep a copy of the police report number and the report itself. You will reference it when disputing charges and accounts, so having the document on hand saves time.
Frequently Asked Questions
How long does it take for fraudulent charges to show up after a breach?
Fraudulent charges can appear within days or weeks, but sometimes they take months. Criminals may test a stolen number with a small charge first, or they may sell the number to someone else who uses it later. This is why monitoring your statements for several months is important, even if nothing appears when ready.
Will a fraud alert hurt my credit score?
No. A fraud alert does not affect your credit score. It only requires lenders to verify your identity before opening new accounts. Your score may actually improve if the alert prevents someone from opening fraudulent accounts in your name.
What is the difference between a fraud alert and a credit freeze?
A fraud alert requires lenders to call you before approving credit, but they can still see your credit report. A freeze blocks lenders from viewing your report entirely, which prevents them from opening accounts even if they do not call you. A freeze is stronger but requires you to unfreeze temporarily when you explore for credit yourself.
Do I need to cancel my other credit cards if one was breached?
No, unless those cards were also breached. Canceling cards you do not need to cancel can hurt your credit score by reducing your available credit and shortening your credit history. Only cancel the card that was compromised, and only after your new card arrives.
Can I get my money back if fraudulent charges already posted?
Yes. Once you report the fraud to your card issuer, they will investigate and remove the charges from your account. This process usually takes 30 to 60 days, but the charges are reversed once the investigation is complete. You are not responsible for paying them while the investigation is ongoing.