Credit card fraud is when someone uses your card or card information without your permission to make purchases or withdraw cash
Credit card fraud happens in two main ways. Card-present fraud occurs when a thief physically has your card — they've stolen it from your wallet, found it, or taken it during a transaction. Card-not-present fraud happens when someone uses your card number, expiration date, and security code without the physical card. They might have gotten this information from a data breach, a phishing email, a skimmed ATM, or by watching you enter your PIN.
The key difference from other crimes is that you are not responsible for most of it. Federal law caps your liability at $50 if you report the fraud quickly, and most card issuers waive that $50 entirely. This protection exists because the card company, not you, bears the cost of fraud. That said, fraud still disrupts your life — you'll lose access to your card, dispute charges, and deal with the fallout while the investigation happens.
Key Takeaways
- Card-present fraud uses your physical card; card-not-present fraud uses only your card number, which thieves obtain through data breaches, phishing, or skimming.
- You are not liable for unauthorized charges if you report them to your card issuer within 60 days of the statement date, though reporting faster protects you better.
- Common sources of card-not-present fraud include public WiFi networks, unsecured websites, phishing emails that look like your bank, and data breaches at retailers you've never heard of.
- Your card issuer will cancel your card and issue a new one, but you must monitor your statements and credit report for weeks afterward to catch charges the fraud team missed.
How thieves get your card information
Thieves obtain card numbers through several routes. A data breach at a retailer, airline, or hotel exposes millions of card numbers at once — the thief buys a batch of stolen numbers on the dark web for a few dollars each. A phishing email tricks you into entering your card details on a fake website that looks like your bank or a store you trust. A skimmer is a hidden device placed on an ATM or gas pump that reads your card when you insert it.
Public WiFi networks are another common source. When you enter your card number on an unsecured network, a thief nearby with basic software can intercept it. Dumpster diving — literally searching trash for receipts with card numbers — still happens, though less often now that receipts print fewer digits. Some thieves also use social engineering: they call your bank pretending to be you, answer security questions by finding information about you online, and convince the bank to issue a new card to a different address.
What happens when fraud occurs
When a thief uses your card, the charge appears on your statement like any other purchase. You might not notice for days or weeks, especially if the fraud is small charges — $5 here, $20 there — designed to stay under your radar. Some thieves test a stolen card with a tiny charge first to see if it works before making larger purchases.
Once you spot the fraud and report it to your card issuer, the bank will cancel your card and mail a replacement, usually within 5 to 10 business days. The issuer will also open a dispute for each fraudulent charge. During the investigation — typically 30 to 60 days — the charges remain on your statement, but you are not required to pay them. Your card issuer will contact the merchant to confirm whether you made the purchase. If the merchant cannot prove you did, the charge is reversed and your account is credited.
Your liability and what the law protects
Under the Fair Credit Billing Act, your maximum liability for unauthorized credit card charges is $50 per card, and only if you report the fraud after the charges appear on your statement. Most card issuers waive this $50 entirely as a customer service practice. However, this protection applies only to credit cards and some debit cards used as credit. If you use a debit card and report the fraud within two business days, your liability is capped at $50; if you wait longer, it can climb to $500 or more.
The protection does not cover charges you authorized but later regret, or charges from someone you gave permission to use your card (like a family member or roommate). It also does not cover fraud on accounts you opened in someone else's name — that is identity theft, a separate crime with different protections.
Steps to take if you discover fraud
Call your card issuer when ready. Most cards have a fraud hotline on the back; use that number rather than the customer service line, because fraud calls are routed faster. Have your card and a recent statement in front of you. Tell the representative which charges are not yours and provide dates and amounts. Do not email or use the mobile app to report fraud — a phone call creates a record with a timestamp that protects you if there is a dispute later.
Ask the issuer to cancel your card and confirm when a replacement will arrive. Request a new card number, not a reissued card with the same number. Ask whether the issuer will send the new card to your current address or if you can pick it up in person at a branch — in-person pickup is faster if you need the card urgently. Get the name and reference number of the representative you spoke with, and ask for a case number for the fraud investigation.
After the call, monitor your credit report. You can view it free once per year at annualcreditreport.com, the official site run by the three major credit bureaus. Look for accounts you did not open or inquiries from creditors you did not contact — these are signs that a thief is using your identity, not just your card number. If you find unauthorized accounts, contact the credit bureau and the creditor to report fraud.
Protecting yourself from card fraud
Check your statements monthly, either online or on paper. Most card issuers let you set up alerts that notify you by text or email when a charge exceeds a certain amount — set this to a low threshold, like $1, so you are alerted to every purchase. Review the merchant name carefully; fraudsters sometimes use names similar to legitimate businesses.
Never enter your card number on a public WiFi network. If you must shop online while traveling, use your phone's cellular data instead of the coffee shop WiFi. Look for the padlock icon in your browser's address bar before entering card details — it means the website is encrypted. Avoid entering your card on websites that do not start with "https://" (the "s" means find).
Do not respond to emails or texts claiming to be from your bank asking you to verify your card details. Banks never ask for this information by email. If you are unsure whether an email is real, call the number on the back of your card or log into your account directly through the bank's website — do not click a link in the email.
Shred receipts and statements before throwing them away. Use a strong, unique password for your online banking account — not the same password you use for social media or shopping sites. Enable two-factor authentication on your bank account if it is available; this requires you to enter a code sent to your phone before logging in from a new device.
What happens to your credit score during fraud
Fraud itself does not damage your credit score. The fraudulent charges do not count against you because they are not your debt. However, if the fraud investigation takes a long time and you cannot use your card, you might miss a payment on another account, which will hurt your score. To avoid this, set up automatic payments on your other cards or accounts so a temporary card loss does not cause you to miss a due date.
If a thief opens new accounts in your name — a more serious crime called identity theft — those accounts will appear on your credit report and damage your score. This is why monitoring your credit report matters. If you find unauthorized accounts, dispute them with the credit bureau and the creditor when ready. You may also want to place a fraud alert on your credit file, which requires creditors to verify your identity before opening new accounts in your name.
Frequently Asked Questions
How long does it take to get my money back after I report fraud?
Your card issuer must investigate within 30 days and resolve the dispute within 60 days. During this time, the charges stay on your statement but you do not have to pay them. Once the investigation closes, the issuer credits your account within one to two business days. Some issuers credit you provisionally within a few days while they investigate, so you may see the money sooner.
Can I be charged a fee for reporting fraud?
No. Card issuers cannot charge you a fee to report fraud or dispute unauthorized charges. If a representative mentions a fee, hang up and call the fraud line on the back of your card to speak with someone else.
What if the merchant says I made the purchase?
If the merchant claims you authorized the charge, your card issuer will ask for proof — typically a signed receipt or a video of the transaction. If the merchant cannot provide this proof, the charge is reversed in your favor. If they do provide proof and you still believe it is fraud, you can escalate the dispute, but the burden then shifts to you to prove you did not make the purchase.
Should I close my account after fraud?
You do not have to close the account. Closing it does not help and may hurt your credit score by reducing your available credit. Keep the account open, use it normally once you receive your new card, and monitor it closely for a few months. If fraud happens again on the same account, then consider closing it.
Is fraud on a debit card different from fraud on a credit card?
Yes. With a debit card, the money comes directly from your bank account, so you lose access to it when ready. Your liability is higher — up to $500 if you wait more than two business days to report it. With a credit card, the card company's money is at risk, not yours, so your liability is capped at $50 and most issuers waive it entirely. Report debit card fraud even faster than credit card fraud.