Report the fraud to your card issuer first, then to the Federal Trade Commission
When you notice unauthorized charges on your credit card, call the phone number on the back of your card when ready — not a number from an email or text. Your card issuer has a fraud department that can freeze your account, reverse charges, and send you a replacement card. This call should happen before anything else, because the sooner you report, the sooner the issuer stops the bleeding and starts the investigation.
After you've spoken to your card issuer, file a report with the Federal Trade Commission at IdentityTheft.gov. This creates an official record that you reported the fraud, which matters if the issuer disputes your claim later or if the fraud is part of a larger identity theft. The FTC report also gives you a recovery plan and a copy you can show to creditors if the thief opened accounts in your name.
You do not need to choose between these two steps — you do both. The card issuer handles your specific card; the FTC handles the broader picture of whether your identity has been compromised.
Key Takeaways
- Call your card issuer's fraud line when ready using the number on the back of your card, not a number from an unsolicited message.
- The card issuer will reverse unauthorized charges and send a replacement card, usually within 5 to 10 business days.
- File a report at IdentityTheft.gov to create an official record with the Federal Trade Commission, which protects you if the issuer disputes your claim.
- Check your credit report at AnnualCreditReport.com for accounts you did not open, which signals identity theft beyond the single card.
- Keep records of every call, confirmation number, and document you send, because you may need to prove you reported the fraud within the required timeframe.
What your card issuer will do when you call
The fraud department will ask you to confirm your identity, then walk through the disputed charges with you. They will ask which transactions are yours and which are not. Be specific about dates and amounts — "I was in Chicago on the 14th, so that $400 charge in Miami is not mine" is more useful than "I don't recognize most of these."
Once you've identified the fraudulent charges, the issuer will freeze your card when ready and issue a chargeback — a reversal of the unauthorized transaction. This is not a favor; it's your legal right under the Fair Credit Billing Act. The issuer then investigates whether the merchant or the payment processor was compromised, but that investigation happens behind the scenes. You get a new card with a new number, usually within 5 to 10 business days.
The issuer will also ask whether you lost the card, if someone had access to your account information, or if you noticed anything unusual before the charges appeared. This helps them understand whether the fraud was card-present (someone stole the physical card) or card-not-present (someone used your number online or over the phone). The answer shapes what they look for in their investigation.
Filing a report with the Federal Trade Commission
Go to IdentityTheft.gov and select "Report identity theft." The site will ask whether you know how the thief got your information — for example, a data breach, a phishing email, or a lost wallet. You don't need to know for certain; "I'm not sure" is a valid answer. The FTC uses these reports to track which types of fraud are most common and to alert companies when their data has been breached.
The FTC report generates a Recovery Plan specific to your situation. If the fraud is limited to one card, the plan is straightforward: monitor your account and credit report. If the thief opened new accounts in your name, the plan includes steps to contact those creditors and dispute the accounts. You can print or read the Recovery Plan and use it as a reference as you work through the next steps.
The FTC does not investigate individual cases — they are a clearinghouse for fraud reports. But the report itself is proof that you reported the fraud within a specific timeframe, which matters if a creditor later tries to hold you responsible for an account you did not open.
Checking your credit report for accounts you did not open
Request your free credit report from AnnualCreditReport.com, the only site authorized by federal law to distribute free reports. You can pull all three reports (Equifax, Experian, and TransUnion) at once or spread them out over the year. Read through each one carefully and look for accounts you do not recognize — credit cards, loans, or lines of credit opened in your name.
If you find accounts you did not open, this is identity theft, not just card fraud. Write to each credit bureau and dispute the account in writing. Include a copy of your FTC report and a statement that you did not open the account. The bureau has 30 days to investigate and remove the account if it cannot verify that you opened it. Send your letter by certified mail so you have proof of delivery.
If the fraudulent account appears on your credit report, it will damage your credit score. Removing it takes time — usually 30 to 90 days — but once it's gone, your score will begin to recover. In the meantime, the fraudulent account may prevent you from being approved for credit at your normal rate. This is temporary, but it's another reason to act quickly.
Protecting yourself while the investigation is underway
Monitor your bank and credit card accounts weekly for the next few months. Set up account alerts through your bank's app or website so you get notified of any charge over a certain amount — usually $1 or $25, depending on what you choose. This catches fraud faster than waiting for your monthly statement.
Consider placing a fraud alert on your credit file. This tells lenders to take extra steps to verify your identity before opening a new account in your name. You can place a fraud alert for free by calling one of the three credit bureaus; they will notify the other two automatically. A fraud alert lasts one year and can be renewed.
If you believe your identity has been stolen — not just your card number — you may want to place a credit freeze instead. A freeze locks your credit file so no one can open a new account without your permission. It's free, takes a few minutes to set up, and you can temporarily lift it when you need to explore for credit yourself. A freeze is stronger protection than a fraud alert, but it requires you to manage it actively.
What happens if the issuer denies your dispute
Card issuers reverse most fraudulent charges without argument, but occasionally one will claim the charge was authorized. This usually happens when the thief had access to your account for a while before you noticed, or when the merchant claims you made the purchase. If the issuer denies your dispute, you have the right to appeal.
Send a written appeal to the issuer's dispute department, including your FTC report, any evidence that you were not in the location where the charge occurred, and a timeline of when you discovered the fraud. Reference the Fair Credit Billing Act and state that you are disputing the charge under that law. Send it by certified mail and keep a copy for your records.
If the issuer still refuses to reverse the charge after your appeal, you can file a complaint with the Consumer Financial Protection Bureau at ConsumerFinance.gov. The CFPB investigates complaints against banks and credit card companies and can pressure them to reverse charges or refund fees. This is a last resort, but it's available if the issuer is acting in bad faith.
Frequently Asked Questions
How long do I have to report credit card fraud?
Federal law gives you 60 days from the date the fraudulent charge appears on your statement to report it to your card issuer. After 60 days, the issuer can refuse to reverse the charge. Report fraud as soon as you notice it, not at the 60-day mark, because the sooner you report, the sooner the investigation begins.
Will I have to pay for the fraudulent charges?
No. Under the Fair Credit Billing Act, you are not responsible for unauthorized charges if you report them within 60 days. Your card issuer must reverse them. You may be responsible for charges up to $50 if your physical card was stolen and you did not report it, but most issuers waive this fee as a courtesy.
What if the fraud happened on a debit card instead of a credit card?
Debit card fraud is covered under the Electronic Funds Transfer Act, which gives you different protections depending on how quickly you report. Report debit card fraud within two business days to limit your liability to $50; after two days, you could be liable for up to $500. Report it when ready and follow the same steps as credit card fraud.
Can I get a new card number without closing the account?
Yes. When you report fraud, the issuer will cancel the compromised card and send you a replacement with a new number. Your account stays open, your credit history on that account remains intact, and your credit score is not affected by the card replacement itself.
Should I file a police report?
You can, but it is not required for the card issuer to reverse the charges. A police report is useful if the fraud is part of identity theft or if you need documentation for insurance purposes. Call your local police non-emergency line or file a report online through your city's website.