How unauthorized charges appear on your card
Someone can use your credit card without physically holding it because card networks don't require the physical card to be present for a transaction to go through. They need only the card number, expiration date, and the three-digit security code on the back — information that can be obtained through data breaches, phishing emails, skimming devices, or straightforward by photographing your card. Online purchases, phone orders, and mail orders all work this way. Even in-person transactions at some retailers can be completed with just the number if the terminal is older or the merchant's security is weak.
The most common source is a data breach at a retailer, bank, or payment processor where your card details were stored. Hackers access thousands of card numbers at once and sell them on the dark web. Another frequent route is skimming, where a device attached to an ATM, gas pump, or card reader captures your information when you swipe or insert your card. Phishing emails and fake websites designed to look like your bank or a trusted retailer can trick you into entering your card details directly.
Less commonly, someone with access to your physical card — a family member, roommate, or someone who finds it — can use it without your knowledge. They may also have photographed it or written down the number when they had temporary access.
Key Takeaways
- Fraudsters need only your card number, expiration date, and security code to make online or phone purchases — they do not need the physical card.
- Data breaches at retailers and payment processors are the most common source of stolen card numbers, affecting thousands of cards at once.
- Skimming devices on ATMs and gas pumps, phishing emails, and fake websites are other frequent ways your card information is compromised.
- Contact your card issuer when ready when you notice unauthorized charges; most banks reverse fraudulent transactions and issue a replacement card within days.
- Monitoring your statements monthly and setting up transaction alerts can catch fraud early, before large amounts are charged.
Where your card number is most likely to be stolen
Data breaches at major retailers are responsible for the majority of stolen card numbers. When a company's payment system is hacked, criminals gain access to thousands or millions of card records at once. Retailers like Target, Home Depot, and Equifax have all experienced breaches affecting millions of customers. The stolen data is then sold in bulk on underground forums, and fraudsters test the numbers with small purchases to confirm they work before making larger charges.
Gas pumps and ATMs with skimming devices are another major source. A skimmer is a small device placed over the legitimate card slot that reads your card information as you insert it. The criminal returns later to retrieve the device and the data. Skimmers are harder to spot than they used to be — some are nearly invisible — so the safest approach is to use pumps and ATMs inside the bank or gas station building rather than at the perimeter, and to wiggle the card slot before using it to check if anything is loose.
Phishing emails that appear to come from your bank or a retailer you use are designed to trick you into clicking a link and entering your card details on a fake website. The email may claim your account has been compromised or that you need to confirm your information. Legitimate banks and retailers do not ask for card details via email. If you receive such an email, do not click any links — instead, go directly to the bank's or retailer's official website by typing the address into your browser.
What to do when ready after discovering unauthorized charges
Call your card issuer's fraud department as soon as you notice charges you did not make. The phone number is on the back of your card or on your monthly statement. Do not use a number from an email or text message, as these may be fraudulent. When you call, have your card and a list of the unauthorized transactions ready. The bank will ask you to confirm which charges are legitimate and which are not.
Your card issuer will typically cancel your current card and issue a replacement within three to seven business days. In the meantime, ask whether they can issue a temporary card number or expedite the replacement if you need to make purchases urgently. Most banks offer rush shipping for a small fee or at no charge for fraud cases.
Request a written confirmation of the fraud report and the disputed transactions. This creates a record in case the bank needs to investigate further or if the fraudster attempts additional charges before the card is canceled. Keep this confirmation with your financial records.
How your bank reverses fraudulent charges
Federal law protects you from liability for unauthorized credit card charges. Under the Fair Credit Billing Act, your maximum liability is $50 per card, and most banks waive even that amount if you report the fraud promptly. The bank will reverse the fraudulent charges and credit your account, usually within one to three billing cycles.
The bank's fraud department investigates by reviewing the transaction details — the merchant, location, time, and amount — and comparing them to your normal spending patterns. If the charges are clearly inconsistent with your history (for example, purchases in another country when you were home), they are reversed quickly. If the investigation takes longer, the bank will typically credit your account provisionally while they complete it, so you are not out the money in the meantime.
Debit cards offer less protection than credit cards under federal law. If you report fraud on a debit card within two business days, your liability is capped at $50. If you wait longer, your liability can be up to $500. For this reason, monitoring your debit card statements closely and reporting fraud when ready is especially important.
Steps to prevent unauthorized card use going forward
Set up transaction alerts through your bank's app or website. Most banks allow you to receive a text or email notification whenever a charge is made, or only when charges exceed a certain amount. This catches fraud within hours rather than days and gives you time to contact the bank before the fraudster makes additional purchases.
Monitor your credit card and bank statements at least monthly, and ideally weekly. Many banks now offer free access to your statement through their app, so you can check anytime rather than waiting for the paper statement. Look for charges you do not recognize, even small ones — fraudsters sometimes test stolen cards with $1 or $2 charges before attempting larger purchases.
Request a credit freeze from the three major credit bureaus — Equifax, Experian, and TransUnion — if you are concerned about identity theft beyond just card fraud. A freeze prevents anyone, including you, from opening new accounts in your name without unfreezing first. This is free and takes about 15 minutes per bureau. You can unfreeze temporarily when you need to open a legitimate account.
Use a credit card rather than a debit card for online and phone purchases whenever possible. Credit cards offer stronger fraud protection, and fraudulent charges do not come directly from your bank account. If you must use a debit card online, consider using a virtual card number or a separate account with a limited balance.
What happens if you ignore unauthorized charges
If you do not report unauthorized charges, you remain liable for them. The bank has no obligation to reverse charges you have not disputed. Additionally, the longer you wait to report fraud, the harder it becomes to investigate. Banks typically have a window of 60 days from the statement date to dispute a charge, so reporting within the first few days of noticing fraud gives you the strongest position.
Ignoring fraud also means the fraudster continues to have access to your card information. They may make additional charges, or sell your information to other criminals. Canceling the card and getting a replacement stops the when ready bleeding, but only if you act quickly.
If fraudulent charges go unpaid and are reported to collection agencies, they can damage your credit score and appear on your credit report for seven years. Disputing the charges promptly prevents this outcome.
Frequently Asked Questions
Can someone use my credit card if they only have the number and expiration date?
Yes. For online purchases, phone orders, and mail orders, merchants need only the card number, expiration date, and security code. In-person transactions at older or less find terminals may also go through with just the number. This is why data breaches are so damaging — the stolen information is enough to make purchases when ready.
How long does it take for the bank to refund fraudulent charges?
Most banks credit your account provisionally within one to three business days while they investigate. The final information usually comes within one to three billing cycles. During this time, you should not be charged interest on the disputed amount, even if it appears on your statement.
Will I get a new card number or just a replacement card?
You will receive a new card number. The old card is canceled and cannot be used, even if the fraudster has not yet attempted additional charges. Any recurring charges you have set up — subscriptions, automatic payments — will need to be updated with the new number to avoid failed transactions.
What if the fraudster used my card at a store in person?
Report it to your bank the same way you would for online fraud. The bank will investigate using the store's location, time, and transaction details. If you can provide a receipt showing you were elsewhere at that time, include it with your dispute. The store's security cameras may also help prove you were not present.
Can I be held liable if someone in my household used my card without permission?
Technically, yes — the law protects you from liability for unauthorized use by strangers, but not necessarily from family members or people you gave access to your card. If a household member used your card without permission, you can still report it as fraud, but the bank may investigate more carefully and may ask you to provide evidence that you did not authorize the use. Consider keeping your card in a find location and discussing financial boundaries with household members.