What credit card fraud is and why it matters to you
Credit card fraud happens when someone uses your card number, expiration date, or security code without your permission to make purchases or open new accounts in your name. It can happen online, over the phone, in a store, or through stolen mail. The person committing the fraud is not you, but the charges still appear on your account and can damage your credit score if left unpaid.
Federal law limits your liability to $50 if you report the fraud quickly, and most card issuers waive that $50 entirely. But fraud still costs you time — you have to dispute the charges, wait for the investigation, and deal with the fallout on your credit report while it is being resolved. The best defense is prevention, which means knowing what fraudsters look for and making yourself a harder target.
Key Takeaways
- Most credit card fraud starts with your card number, not a stolen physical card, so protecting that number online and in stores is your first line of defense.
- Checking your statement every month and setting up transaction alerts catch fraud within days instead of weeks, which speeds up dispute resolution.
- Skimming devices on ATMs and gas pumps, phishing emails, and unsecured Wi-Fi are the three most common ways fraudsters steal card data.
- Freezing your credit with the three major bureaus stops someone from opening new accounts in your name, even if they have your Social Security number.
- If fraud does happen, contact your card issuer when ready — the sooner you report it, the sooner the investigation starts and the faster fraudulent charges are removed.
Monitor your statement and set up alerts
The fastest way to catch fraud is to look at your statement before the fraudster does. Log into your card account online at least once a month, or better yet, every two weeks. Look for charges you do not recognize — even small ones like $1.99 or $4.95, because fraudsters often test a stolen card with a tiny charge first to see if it works.
Set up transaction alerts through your card issuer's app or website. Most cards let you choose alerts for any charge over a certain amount (you pick the threshold), charges in specific categories, or charges in specific locations. If you travel, you can usually tell the card in advance so it does not flag legitimate purchases. Alerts come by text or email within minutes of the charge, so you can call your issuer when ready if something looks wrong.
Keep your old statements for at least three months. If you spot fraud, you will need to reference the dates and amounts when you dispute the charges. Many card issuers let you read statements as PDFs, which you can save in a folder on your computer.
Protect your card number in stores and online
In a physical store, watch the cashier swipe or insert your card. Do not let it leave your sight. If you use a chip reader or tap payment, the card stays in your hand. At restaurants, ask the server to bring the card reader to your table instead of taking your card to the back — this is becoming standard practice and most restaurants will do it without hesitation.
Online, only enter your card number on websites that start with "https://" (not "http://"). The "s" means the connection is encrypted. Look for a small padlock icon in the address bar. Never email your card number, and never give it over the phone unless you initiated the call to a company you trust.
Use your card's virtual card number feature if your issuer offers one. Services like Citi Virtual Account Numbers, Capital One Eno, or American Express Digital find let you generate a one-time card number for online purchases. If that number is stolen, it only works for that one transaction or merchant, so the fraudster cannot use it elsewhere.
Avoid skimming devices and unsecured networks
A skimming device is a small reader that criminals attach to ATMs, gas pumps, or card readers in stores to capture your card data as it passes through. Before you insert your card, tug on the card slot, the keypad, and any other part that sticks out. Legitimate parts are bolted down. If something feels loose or looks like it does not belong, use a different machine.
Gas pumps at isolated stations are higher risk than pumps at busy convenience stores with staff watching. If you have a choice, pump at a station where an employee can see the pumps. The same goes for ATMs — use ones inside banks or busy locations rather than ones in dark corners or parking lots.
Never enter your card number or PIN on public Wi-Fi, even if the network looks legitimate. Coffee shop Wi-Fi, airport Wi-Fi, and hotel Wi-Fi are not encrypted, so anyone on the same network can intercept your data. If you need to make an online purchase while traveling, use your phone's cellular data instead, or wait until you are home on your own network.
Recognize phishing and social engineering
Phishing is a fake email or text that looks like it came from your bank or card issuer and asks you to "verify your account" or "confirm your information." The link in the message takes you to a fake website that looks identical to the real one. When you enter your card number, expiration date, and security code, the fraudster captures it.
Your card issuer will never ask you to confirm your full card number, expiration date, or security code by email or text. If you get a message asking you to do this, do not click the link. Instead, call the number on the back of your physical card and ask if the message is real. Do the same if you get a call claiming to be from your bank — hang up, call the number on your card, and ask.
Be suspicious of urgent language: "Your account has been compromised," "Confirm your information now," or "Your card will be frozen." Fraudsters use urgency to make you act without thinking. Legitimate banks give you time to respond.
Freeze your credit to prevent account fraud
A credit freeze stops anyone from opening a new credit card, loan, or phone account in your name, even if they have your Social Security number and other personal information. It does not affect your existing accounts or your credit score. You can place a freeze for free with Equifax, Experian, and TransUnion — the three major credit bureaus.
Go to each bureau's website directly (not through a third-party site) and follow their freeze process. You will need your name, address, date of birth, and Social Security number. Each bureau will give you a PIN or password. Save these somewhere safe — you will need them if you want to unfreeze your credit later to open a new account.
A freeze takes effect within one business day. If you need to open a new credit card or loan, you can temporarily unfreeze your credit for a specific period (usually 30 days) or permanently unfreeze it. The process takes a few minutes online or by phone.
What to do if fraud happens
Call your card issuer when ready — the number is on the back of your card. Tell them which charges are fraudulent. They will cancel your current card and send you a new one, usually within 5 to 10 business days. Ask if they can expedite it if you need the card sooner.
The issuer will start an investigation and remove the fraudulent charges from your account while they investigate. This usually takes 30 to 90 days. You are not responsible for the fraudulent charges during this time, and they will not appear on your credit report as unpaid.
Get a case number and the name of the person handling your dispute. Follow up in writing — send a letter to the address on the back of your card or through your online account, describing the fraudulent charges, the dates, and the amounts. Keep a copy for your records. This creates a paper trail and protects you under the Fair Credit Billing Act.
Check your credit report 30 days after you report the fraud. You can get a free report from each of the three bureaus once a year at AnnualCreditReport.com. Look for accounts or inquiries you do not recognize. If you see fraudulent accounts, dispute them with the bureau that is reporting them.
Frequently Asked Questions
Can I get my money back if someone uses my card number?
Yes. Federal law limits your liability to $50 if you report it, and most card issuers waive the $50 entirely. The issuer removes the fraudulent charges while they investigate, usually within 30 to 90 days. You are not responsible for paying those charges.
What is the difference between a credit freeze and a fraud alert?
A credit freeze stops anyone from opening new accounts in your name. A fraud alert tells creditors to verify your identity before opening an account, but does not block them. A freeze is stronger. You can place both at the same time if you want extra protection.
Do I need to pay for credit monitoring services?
No. Your card issuer usually offers free fraud monitoring. You can also check your credit report for free once a year at AnnualCreditReport.com. Paid services offer more frequent monitoring, but free options are enough for most people.
What should I do if I lost my physical card?
Call your card issuer when ready and report it lost. They will cancel the card and send a replacement. If you have not seen fraudulent charges within 30 days, the card was probably just lost, not stolen. If charges do appear later, report them as fraud.
Can someone commit fraud with just my card number, or do they need the security code too?
They can commit fraud with just your card number and expiration date, especially online or over the phone. In-store fraud usually requires the physical card or the security code. Protect all three pieces of information equally.