Credit card fraud is when someone uses your card or card information without your permission to make purchases or withdraw cash
Credit card fraud happens in two main ways. Card-present fraud occurs when a thief physically has your card — they've stolen it from your wallet, found it, or taken it during a transaction. Card-not-present fraud happens when someone uses your card number, expiration date, and security code online or over the phone without ever holding the physical card. They might get this information from a data breach, a skimmed ATM, a phishing email, or by buying it from a criminal marketplace.
The moment someone makes an unauthorized charge, you have fraud on your hands. It doesn't matter if the charge is $5 or $500 — it's still fraud, and you have legal protections. The Fair Credit Billing Act limits your liability to $50 per card if you report it, and most major card issuers waive that $50 entirely if you report promptly.
Key Takeaways
- Credit card fraud means someone used your card or card number without permission, whether they had the physical card or just the numbers.
- You are not responsible for unauthorized charges if you report them to your card issuer, and most issuers cover the full amount.
- Fraud can come from a stolen card, a data breach, a skimmed ATM, phishing emails, or someone who saw your card during a normal transaction.
- Checking your statement weekly — not just monthly — is the fastest way to catch fraud before the thief makes multiple charges.
- Reporting fraud to your card issuer is different from reporting it to police; you need to do both if you want a police report for identity theft cases.
How thieves get your card information
A thief doesn't need to steal your physical card to commit fraud. They can get your card number in several ways. Skimming happens when a device reads your card at an ATM, gas pump, or restaurant terminal — you swipe normally, but a hidden reader captures your information. Data breachesPhishing
Someone might also see your card number during a legitimate transaction — a server at a restaurant, a cashier, or someone standing behind you at checkout. They write it down or photograph it. Or they might buy your card number from a criminal who stole it in a breach and is selling it online.
The riskiest situations are ones where your card leaves your sight: handing it to a server, using it at an unfamiliar ATM, or entering it on a website you're not sure about. Chip readers and contactless payments reduce skimming risk because the card data changes with each transaction, but older magnetic-stripe cards and online shopping still carry risk.
Signs that fraud has happened to you
The clearest sign is a charge on your statement that you didn't make. This might be a small charge you don't recognize, a charge from a merchant you've never heard of, or a charge from a place you've never been. Fraudsters sometimes test a stolen card with a small charge first — $1 or $2 — to see if it works before making larger purchases.
Other warning signs include a bill that arrives late or doesn't arrive at all (the thief may have changed your mailing address), calls from debt collectors about accounts you didn't open, or a notice from your bank about suspicious activity. You might also see a hard inquiry on your credit report from a company you never contacted, which means someone may have tried to open a credit card or loan in your name.
The best defense is to check your statement weekly online rather than waiting for the paper bill. Most card issuers let you set up alerts for charges over a certain amount or charges in certain categories. These alerts arrive by text or email within hours of the charge, so you can report fraud before the thief makes a second purchase.
What to do when ready if you spot fraud
Call your card issuer's fraud line right away — the number is on the back of your card or on your statement. Do not email or use the card issuer's website chat; a phone call creates a record with a timestamp and a person who can document what you report. Tell them which charges are fraudulent and ask them to cancel the card and issue a replacement.
Your card issuer will reverse the fraudulent charges — you don't pay for them. They will also send you a new card, usually within 5 to 10 business days. Ask whether they can expedite it if you need to use a card before then. While you wait, you can still use your account online to pay bills or set up a temporary digital wallet payment if your phone supports it.
After you hang up, write down the date, time, the name of the person you spoke with, and what they told you. This record matters if the fraud is part of a larger identity theft case or if you need to dispute something later.
Reporting fraud to police and credit bureaus
Reporting to your card issuer stops the charges and replaces your card, but it doesn't create an official police record. If you believe someone has stolen your identity — not just your card number, but your Social Security number or personal information — you should file a report with your local police department or the Federal Trade Commission's Identity Theft Report at IdentityTheft.gov. This report is free and creates a record you can use if you need to dispute accounts opened in your name.
You should also place a fraud alert on your credit report. This tells lenders to verify your identity before opening new accounts in your name. You can place a fraud alert by contacting one of the three major credit bureaus — Equifax, Experian, or TransUnion — and they are required to notify the other two. The alert lasts one year and is free. If you believe you are a victim of identity theft, you can place an extended fraud alert that lasts seven years.
Check your credit report at AnnualCreditReport.com, which is the official free source. Look for accounts you didn't open, inquiries from companies you didn't contact, or addresses that aren't yours. If you find fraudulent accounts, dispute them with the credit bureau in writing and with the company that opened the account.
How to reduce your fraud risk going forward
Use a credit card rather than a debit card for everyday purchases when you can. Credit cards have stronger fraud protections than debit cards, and fraudulent charges don't come directly out of your bank account. If fraud happens, you dispute the charge with your card issuer; with a debit card, the money is already gone and you have to fight to get it back.
Enable transaction alerts on your card issuer's app or website. Most issuers let you choose the alert threshold — for example, any charge over $50, or any charge from a specific category like gas or groceries. These alerts arrive within hours and let you catch fraud before the thief makes multiple charges.
Check your statement weekly online instead of waiting for the paper bill. The sooner you spot fraud, the sooner you can report it and stop further charges. Use strong, unique passwords for your online banking and shopping accounts — a password manager like Bitwarden or 1Password makes this easier. Never reuse passwords across sites, because if one site is breached, a thief can try that password on your bank account.
Be cautious with your card in person: watch the server or cashier when they process it, use ATMs in well-lit public places, and cover the keypad when you enter your PIN. Online, only enter your card number on websites that start with "https://" (the "s" means the connection is encrypted) and avoid entering your card on public WiFi networks. If you're shopping on a site you're not sure about, use a virtual card number — many issuers offer this as a feature that generates a one-time card number for each purchase.
What happens after you report fraud
Your card issuer will investigate the charges you reported. This usually takes 10 business days, though they may provisionally credit your account before the investigation is complete. Once they confirm the charges were fraudulent, the credit is permanent and you owe nothing.
Your new card will arrive with a new number, expiration date, and security code. You'll need to update any recurring charges — subscriptions, gym memberships, automatic bill payments — with the new number. Your old card stops working when ready, so any thief who has the old number can't use it.
If the fraud was part of a larger identity theft, the process takes longer. You may need to dispute accounts opened in your name, work with creditors to remove fraudulent accounts from your credit report, and monitor your credit for months or years. The Identity Theft Report you filed at IdentityTheft.gov gives you a template letter to send to creditors and credit bureaus, which speeds up the dispute process.
Frequently Asked Questions
Am I responsible for paying fraudulent charges?
No. The Fair Credit Billing Act limits your liability to $50 per card, and most major card issuers waive that $50 if you report the fraud. Your card issuer reverses the charges and you owe nothing. Report fraud as soon as you spot it to make sure you're covered.
How long does it take to get my money back?
Your card issuer will usually provisionally credit your account within a few days while they investigate. Once they confirm the charges were fraudulent — typically within 10 business days — the credit becomes permanent. If fraud involved a debit card, the process may take longer because the money came directly from your bank account.
Can I use my card while fraud is being investigated?
Your old card stops working when ready when you report fraud, but you can still use your account online to pay bills. Your new card usually arrives within 5 to 10 business days. Ask your issuer if they can expedite it or set up a temporary digital wallet payment in the meantime.
What's the difference between credit card fraud and identity theft?
Credit card fraud is unauthorized use of your card or card number. Identity theft is broader — someone uses your personal information (Social Security number, name, address) to open accounts, take out loans, or commit other crimes in your name. Card fraud may be part of identity theft, but not always.
Should I file a police report?
If it's only card fraud, you don't need a police report — your card issuer handles it. If you believe someone has stolen your identity, file a report with your local police or the Federal Trade Commission at IdentityTheft.gov. This creates an official record you can use to dispute fraudulent accounts opened in your name.