The most common ways your card number is compromised
Your credit card number is usually stolen in one of three ways: a data breach at a store or website you use, a skimming device on a physical card reader, or phishing — someone tricking you into giving it away. Most of the time you will never know which one happened, because the thief uses your number online or sells it to someone else rather than using it in front of you.
Data breaches are the largest source. When a retailer, restaurant, airline, or bank gets hacked, criminals read thousands of card numbers at once. You may have used your card there months ago and forgotten about it. The breach might not be discovered for weeks or months after it happens, so you could see fraudulent charges long after your last visit.
Skimming happens at gas pumps, ATMs, and card readers in stores. A criminal installs a hidden device that reads your card as you swipe or insert it, then either uses the number themselves or sells it. You will not see the device — it looks like part of the machine. Chip readers are harder to skim than magnetic stripe readers, but not impossible.
Phishing is when someone sends you a fake text, email, or call pretending to be your bank or a company you trust, asking you to "verify" your card details. If you respond with your number, expiration date, or CVV, you have handed it over directly.
Key Takeaways
- Data breaches at stores and websites you use are the most common source of stolen card numbers, and you may not notice for months.
- Skimming devices on gas pumps and ATMs read your card without your knowledge, so inspect the card slot before you use it.
- Phishing texts and emails that ask you to verify your card details are always scams — your bank will never ask for this information by text or email.
- Call your card issuer when ready if you see a charge you did not make, and they will cancel the card and send a replacement.
- You are not responsible for fraudulent charges on a credit card once you report them, but you must report them within 60 days.
What to do the moment you notice a fraudulent charge
Call the phone number on the back of your card or your card issuer's website — not a number from an email or text. Tell them you see a charge you did not make. They will ask you to confirm a few recent legitimate charges to verify you are the cardholder, then they will cancel the card when ready and start an investigation.
The card issuer will send you a replacement card, usually within 5 to 10 business days. In the meantime, you can still use your account online or by phone if you need to. Ask the issuer to reverse the fraudulent charge — they almost always do this while the investigation is open.
Do not wait to see if more charges appear. Call as soon as you spot one. The sooner you report it, the faster the card gets cancelled and the less damage the thief can do.
How to check your statements regularly
Log into your card account online or through the issuer's app at least once a week. Most card issuers let you set up alerts for any charge over a certain amount — often $1 or $25 — and they will text or email you when ready. This catches fraud faster than waiting for your monthly statement.
When you review charges, look for small amounts you do not recognize. Thieves sometimes test a stolen card with a $1 or $2 charge first to see if it works before they make a big purchase. If you see something odd, report it even if the amount is tiny.
You can also set up a fraud alert or credit freeze with the three credit bureaus (Equifax, Experian, and TransUnion) if you want extra protection. A fraud alert tells lenders to verify your identity before opening new accounts in your name. A credit freeze blocks anyone from viewing your credit report without your permission, which stops most identity theft cold.
Why you are not liable for fraudulent charges
Federal law protects you. Once you report a fraudulent charge on a credit card, you are not responsible for it. The card issuer absorbs the loss. This is different from debit cards, where your liability depends on how quickly you report the fraud.
The catch is timing: you must report the fraud within 60 days of the statement date on which the charge appears. If you wait longer, the issuer can hold you responsible for some or all of it. This is why checking your statements weekly matters — you catch fraud early and stay well within the window.
Keep records of your report. Write down the date you called, the name of the person you spoke with, and what they told you. Ask them to send you a written confirmation of the fraud report. This protects you if there is a dispute later.
Steps to take after your card is replaced
Update any recurring charges. If you have subscriptions, gym memberships, or automatic bill payments linked to the old card, you will need to enter the new card number. Check your email for confirmation that the update went through.
Destroy the old card. Cut it up or shred it — do not just throw it in the trash. If the thief somehow gets the physical card back, they cannot use it.
Consider whether you need to change passwords. If the breach also exposed your email address or password, change your password for that account and any other accounts that use the same password. A password manager like Bitwarden or 1Password makes this easier.
How to reduce the risk of theft going forward
Use chip readers instead of swiping when you can. Chip technology is harder to clone than the magnetic stripe. If a reader offers both options, choose the chip.
Inspect card readers before you use them. At gas pumps and ATMs, wiggle the card slot and look for anything loose or out of place. If something feels wrong, use a different pump or machine.
Never give your card number, expiration date, or CVV to anyone who contacts you — not by phone, text, or email. Your bank and legitimate companies will never ask for this. If someone claims to be from your bank, hang up and call the number on your statement.
Use a virtual card number when shopping online. Many card issuers let you generate a one-time card number for online purchases. If that number gets stolen, it cannot be used again because it is linked to only that transaction.
What happens during the fraud investigation
The card issuer will contact the merchant where the fraudulent charge occurred and ask for details about the transaction — the location, time, and what was purchased. They will compare this to your account history and typical spending patterns.
If the charge is clearly fraudulent (for example, it happened in another country while you were home, or it is for something you would never buy), the issuer will reverse it quickly, often within a few days. If it is less clear, the investigation can take up to 30 days.
You do not have to do anything during the investigation except wait. The issuer handles it. You will get a letter or email when it is complete, telling you whether the charge was reversed and what they found.
Frequently Asked Questions
Can someone use my card number without the physical card?
Yes. Online purchases, phone orders, and mail orders only need the card number, expiration date, and CVV. A thief with this information can shop without ever holding the card. This is why data breaches are so dangerous — they expose all the information needed for online fraud.
What if I see a charge from a place I have never heard of?
Report it. The merchant name on your statement might be different from the store's real name, or it might be a company that processes payments for multiple businesses. But if you genuinely do not recognize it and did not make the purchase, report it as fraudulent. The issuer will investigate.
Do I have to pay interest on fraudulent charges while they are being investigated?
No. Once you report a fraudulent charge, the card issuer must remove it from your balance while they investigate. You will not owe interest on it, and it will not count against your credit limit.
Should I close my account after fraud?
You do not have to. Closing the account does not help — the fraud already happened. Keeping the account open actually helps your credit score because it keeps your average account age higher. Just use the new card they send you.
What if the same card number gets stolen twice?
Call your issuer again and report the second fraud. They will cancel the card again and send another replacement. If this happens repeatedly, ask if they can issue you a card with a different number or discuss other security options.