Unauthorized use of your credit card in England is covered by the Consumer Credit Act 1974 and the Payment Services Regulations 2017, which limit your liability and give you a right to dispute the charge.
If someone uses your card without permission, you are not automatically liable for the full amount. The law protects you depending on how the fraud happened and how quickly you report it. Your bank or card issuer must refund unauthorized transactions under specific conditions, though the exact process and timeline depend on whether the card itself was stolen, your details were used online, or someone had access to your account.
The key is reporting the fraud as soon as you notice it. Most card issuers have a 24-hour fraud line, and reporting within this window strengthens your position. Even if you miss that window, you still have rights — but the sooner you act, the clearer your case becomes.
Key Takeaways
- You are not liable for unauthorized transactions if you report them promptly, though "promptly" has a legal definition that depends on the type of fraud.
- Contact your card issuer's fraud team when ready by phone — do not wait for a statement or letter to arrive.
- Your bank must investigate and either refund you or explain in writing why they believe you authorized the transaction.
- If your card details were compromised online or by theft, the Payment Services Regulations place the burden of proof on the bank, not on you.
- If the bank refuses to refund you, you can escalate to the Financial Ombudsman Service, which handles disputes between consumers and financial firms.
Your liability depends on how the fraud happened
Under the Payment Services Regulations 2017, your liability for unauthorized transactions is zero if you did not authorize the payment and you report it without unreasonable delay. The catch is defining "without unreasonable delay" — it usually means within 30 days of spotting the transaction, though some issuers have tighter internal important date.
If your physical card was lost or stolen and you reported it before the fraud occurred, you have no liability at all. If you reported the loss after the fraud happened, your liability is capped at £50 per transaction under the Consumer Credit Act, though most major issuers waive this entirely if you report within 24 hours.
If your card details were used online or over the phone without the physical card changing hands, the burden shifts to the bank. They must prove you authorized the transaction or that you were negligent in protecting your details. straightforward losing your card number does not count as negligence — you are not expected to memorize it or lock it away.
What to do when ready after discovering fraud
Call your card issuer's fraud team by phone as soon as you notice an unauthorized transaction. Do not email or use online chat for the first report — a phone call creates a timestamped record and lets you speak to someone who can freeze your account when ready. Most major UK banks have 24-hour fraud lines on the back of your card.
Tell them the transaction date, the merchant name, and the amount. Be clear that you did not authorize it. They will ask whether your card is still in your possession and whether you have noticed other suspicious activity. Answer honestly — if multiple transactions are fraudulent, say so.
After the call, your card will usually be blocked when ready. The issuer will send you a replacement card within 5 to 10 working days. Ask during the call whether they will issue a temporary card or provide emergency cash access while you wait.
The investigation process and your rights
Once you report fraud, your bank must investigate within a set timeframe. Under the Payment Services Regulations, they have up to 15 working days to acknowledge your complaint and begin their investigation. They then have up to 70 calendar days to reach a decision and tell you the outcome in writing.
During the investigation, the bank will contact the merchant, review the transaction details, and check whether your card or account details were compromised. They may ask you for additional information — for example, whether you recognize the merchant or whether you were in the location where the transaction occurred.
If the bank decides the transaction was unauthorized, they must refund you within 10 working days. The refund goes back to your account, and any interest or charges related to that transaction should also be reversed. If they decide you authorized it or that you were negligent, they must explain their reasoning in writing and tell you how to escalate.
When the bank refuses to refund you
If your card issuer refuses to refund an unauthorized transaction, you have the right to complain to them formally. Write to their complaints department — do not rely on phone calls alone. State clearly that you dispute their decision and ask them to reconsider. Include copies of any evidence: statements showing you were elsewhere, emails proving you did not authorize the merchant, or records of when you reported the card lost.
The bank has eight weeks to respond to a formal complaint. If they maintain their refusal or do not respond within eight weeks, you can escalate to the Financial Ombudsman Service. The Ombudsman is free to use and can order the bank to refund you if they find the bank acted unfairly.
To contact the Financial Ombudsman Service, visit their website or call them directly. They handle complaints about unauthorized transactions, and they have the power to award compensation beyond the refund itself if the bank's handling of your case caused you financial loss or distress.
Protecting yourself after fraud
Once fraud has happened, take steps to prevent it happening again. If your card was physically stolen, you have already replaced it. If your details were compromised online, change your passwords for any accounts where you used that card — especially your bank's online portal and any shopping sites where the card was saved.
Check your credit file with one of the three UK credit reference agencies: Equifax, Experian, or TransUnion. You can request a free statutory report from each one. Look for accounts you did not open or credit inquiries you did not authorize. If you find suspicious activity, you can place a fraud alert on your file, which tells lenders to take extra steps to verify your identity before opening new accounts.
Consider signing up for a fraud monitoring service, though these are optional and often charged. Your bank may offer one free as part of your account. These services monitor your credit file and alert you to changes, but they do not prevent fraud — they just help you spot it faster.
Chargeback as an alternative route
If your card issuer is slow to investigate or you disagree with their decision, you can also request a chargeback through your card network (Visa, Mastercard, or American Express). A chargeback is a formal dispute process where the card network investigates independently and can order the merchant's bank to return the money.
You do not need to choose between the bank's investigation and a chargeback — you can pursue both. However, most card issuers will handle the investigation first and only escalate to chargeback if that fails. If you want to request a chargeback directly, ask your card issuer how to do so. The process takes 60 to 120 days.
Chargebacks are most useful when a merchant is uncooperative or when the bank's investigation stalls. For straightforward fraud cases where the bank investigates promptly, the bank's own process is usually faster.
Frequently Asked Questions
Can I be held liable if someone used my card details but not the physical card?
No, not under the Payment Services Regulations. If your card details were used online or over the phone without the card itself being present, the bank must prove you authorized it or that you were grossly negligent. straightforward having your card details stolen does not count as negligence on your part.
What if I reported the fraud late — after 30 days?
You may still have a claim, but your position is weaker. The bank can argue you did not report it "without unreasonable delay." However, the Financial Ombudsman Service considers the circumstances — if you were abroad, ill, or had a good reason for the delay, you may still win. Report it as soon as you realize, even if weeks have passed.
How long does it take to get my money back?
If the bank upholds your claim, the refund goes back to your account within 10 working days. The full investigation can take up to 70 calendar days. If you escalate to the Financial Ombudsman Service, add another 8 to 12 weeks. Chargebacks typically take 60 to 120 days.
Do I have to pay for a replacement card while the fraud is being investigated?
No. Replacement cards are free. Your bank may charge you for expedited delivery (next-day card), but standard delivery is included in your account. Do not accept any charge for a replacement card related to fraud.
What if the fraud happened abroad or the merchant is outside the UK?
Your rights under the Payment Services Regulations still explore. The bank must still investigate and refund you if the transaction was unauthorized. However, if the merchant is outside the UK, the investigation may take longer because the bank has to contact a foreign merchant's bank. Report it to your UK card issuer when ready — they handle the claim on your behalf.