Report fraud to your card issuer first, then to the Federal Trade Commission
The moment you notice unauthorized charges on your credit card, call the phone number on the back of your card or log into your online account to report it. Your card issuer — the bank or credit union that issued the card — is legally required to investigate and typically removes fraudulent charges within two billing cycles. Do not wait for a statement to arrive. The sooner you report, the sooner the card issuer can freeze the account and issue a replacement card.
After you contact your card issuer, file a report with the Federal Trade Commission at IdentityTheft.gov. This creates an official record and generates an Identity Theft Report, which you may need if the fraud is part of a larger identity theft. The FTC does not investigate individual cases, but the report documents what happened and can help you dispute fraudulent accounts opened in your name.
If the fraud involved your personal information being stolen — not just your card number — you should also place a fraud alert or credit freeze with the three credit bureaus: Equifax, Experian, and TransUnion. A fraud alert tells lenders to verify your identity before opening new accounts. A credit freeze blocks access to your credit report entirely, which is stronger protection if you believe your identity has been compromised.
Key Takeaways
- Call your card issuer when ready using the number on the back of your card; federal law limits your liability to $50 if you report before the card is used.
- File a report with the Federal Trade Commission at IdentityTheft.gov to create an official record and receive an Identity Theft Report.
- Place a fraud alert or credit freeze with Equifax, Experian, and TransUnion if you believe your personal information was stolen, not just your card number.
- Keep copies of all correspondence with your card issuer and the FTC, including confirmation numbers and dates of calls.
- Monitor your credit reports for new accounts or inquiries you did not authorize, which may signal ongoing identity theft.
What your card issuer will do when you report fraud
Your card issuer will cancel the compromised card and send a replacement, usually within 5 to 10 business days. They will also reverse the fraudulent charges and issue a provisional credit to your account while they investigate. This provisional credit is temporary — if their investigation concludes the charge was legitimate, they can remove it, though this is rare if you reported promptly.
The card issuer will ask you to describe which charges are fraudulent and when you first noticed them. They may also ask how you think the fraud occurred — whether your card was lost, stolen, or if your card number was used online. Be as specific as you can. If you do not recognize a charge at all, say so. If you recognize some charges but not others, tell them which ones are yours.
Under the Fair Credit Billing Act, your liability for unauthorized charges is capped at $50 per card, and many issuers waive this entirely if you report before the card is used fraudulently. If you report after fraudulent use has occurred, your liability may be higher, but only up to $50. You are not responsible for charges you did not authorize.
Filing a report with the Federal Trade Commission
Go to IdentityTheft.gov and select "Report identity theft." The FTC will ask you to describe what happened: whether someone used your existing card, opened new accounts in your name, or both. Answer as much as you can, but you do not need to know every detail. The FTC will generate a report you can read and print.
This Identity Theft Report serves two purposes. First, it documents the theft for your records. Second, you can send it to creditors, credit bureaus, and other companies to prove you reported the fraud. Some creditors will not remove fraudulent accounts from your credit report without this report, so keep a copy.
The FTC report is free and takes about 10 to 15 minutes to complete. You will receive a confirmation number. Write it down and save the report itself. The FTC does not investigate individual cases or contact your card issuer on your behalf, but the report creates an official record that protects you legally if the fraud is part of a larger identity theft scheme.
Placing a fraud alert or credit freeze
A fraud alert tells lenders to call you before opening new accounts in your name. You place it by contacting one of the three credit bureaus — Equifax, Experian, or TransUnion — and that bureau will notify the other two. An initial fraud alert lasts one year and is free. If you have already been a victim of identity theft, you can request an extended fraud alert that lasts seven years.
A credit freeze is stronger. It blocks lenders from accessing your credit report at all, which prevents them from opening accounts in your name. You must place a freeze with each of the three bureaus separately. Freezes are free and last until you remove them. If you need to open a new account yourself, you will need to temporarily unfreeze your credit, which takes a few minutes online or by phone.
If the fraud involved only your card number — not your personal information — a fraud alert may be enough. If someone has your name, address, Social Security number, or date of birth, a credit freeze is the stronger choice. You can place both a fraud alert and a freeze at the same time; they work together.
Monitoring your credit reports and accounts
After you report fraud, check your credit reports regularly for new accounts or inquiries you did not authorize. You can view your credit reports free once per year at AnnualCreditReport.com. If you have placed a fraud alert, you are may have access to to two additional free reports during the alert period. Some card issuers also offer free credit monitoring as part of their fraud protection.
Look for new credit cards, loans, or lines of credit opened in your name. Also look for hard inquiries — requests from lenders to pull your credit — that you did not authorize. If you find unauthorized accounts or inquiries, contact the creditor when ready and provide your FTC Identity Theft Report. Ask them to close the account and remove it from your credit report.
Keep monitoring for at least one year after the fraud is reported. Identity theft sometimes unfolds in waves, with fraudsters using stolen information months after the initial theft. The longer you watch, the sooner you will catch any new fraud.
What to do if your card was lost or stolen
If you lost your physical card or it was stolen, the process is simpler than if your card number was compromised online. Call your card issuer when ready to report the card missing. They will cancel it right away, and you will not be liable for any charges made after you report it lost or stolen.
If you find the card later, do not use it. Destroy it or return it to your card issuer. Your replacement card will arrive within a week or two. In the meantime, if you need to make purchases, ask your issuer if they can issue a temporary card number or enable contactless payments on your phone.
You do not need to file an FTC report for a lost or stolen card unless fraudulent charges were made before you reported it missing. If no one used the card, there is no fraud to report — only a lost card to replace.
Disputing fraudulent charges on your statement
If fraudulent charges appear on your statement after you have already called your card issuer, you can file a formal dispute. Most card issuers allow you to dispute charges online through your account or by mail. The issuer will investigate and typically resolve the dispute within 30 to 60 days.
When you dispute a charge, provide as much detail as possible: the date, the merchant name, the amount, and why you believe it is fraudulent. If you have already reported the fraud by phone, mention that and provide the confirmation number. Attach copies of any correspondence with the issuer or the FTC.
During the dispute process, the issuer will issue a provisional credit so you are not out the money while they investigate. If they find in your favor — which they usually do for unauthorized charges — the credit becomes permanent and the charge is removed from your account.
Frequently Asked Questions
How long do I have to report credit card fraud?
Report it as soon as you notice it. Your liability is capped at $50 under federal law, but only if you report before the card is used fraudulently. If you report after fraudulent charges have been made, your liability can be higher, though still capped at $50. The sooner you call, the sooner your card issuer can freeze the account and investigate.
Will I have to pay the fraudulent charges while the investigation happens?
No. Your card issuer will issue a provisional credit to your account when ready or within one or two billing cycles. This credit is temporary during the investigation, but if the charges are confirmed as fraudulent, the credit becomes permanent. You will not be out the money while they investigate.
Do I need to report the fraud to the police?
You can, but it is not required for credit card fraud. Police reports are more useful if your identity has been stolen or if you believe someone you know committed the fraud. If you file a police report, keep a copy — some creditors ask for it when you dispute fraudulent accounts opened in your name.
What if the fraud happened on a debit card instead of a credit card?
Debit card fraud is handled differently. Call your bank when ready to report it. Your liability depends on how quickly you report: if you report within two business days, your liability is capped at $50; if you report after two business days but within 60 days, your liability can be up to $500. After 60 days, you may not be protected at all. Report debit card fraud faster than credit card fraud.
Can I get my money back if I do not report the fraud right away?
It depends on how long you waited and whether it was a credit or debit card. For credit cards, you are protected up to $50 even if you report late, and most issuers waive this. For debit cards, waiting longer increases your liability. Report any fraud as soon as you notice it to protect yourself fully.