Credit card fraud is when someone uses your card number or account information without your permission to make purchases or withdraw cash

Fraud happens in two main ways. Card-present fraud occurs when a thief physically has your card — they've stolen it from your wallet, found it, or taken it during a transaction. Card-not-present fraud happens when someone uses only your card number, expiration date, and CVV (the three-digit code on the back). They get this information through data breaches, phishing emails, unsecured websites, or by purchasing stolen card details on the dark web.

The thief then makes online purchases, orders over the phone, or sets up recurring charges. Because they don't need the physical card, card-not-present fraud is far more common. You might not notice it for weeks if the charges are small, or you might spot a large purchase when ready.

Key Takeaways

  • Card-not-present fraud (using only your number) is more common than card-present fraud and often goes unnoticed for weeks if charges are small.
  • You are not responsible for fraudulent charges if you report them promptly — federal law caps your liability at $50, and most card issuers waive even that.
  • Contact your card issuer when ready by phone (use the number on your statement, not a number from an email) to report fraud and freeze your account.
  • Request a new card with a new number, and monitor your account statements weekly for at least three months after fraud occurs.
  • File a report with the Federal Trade Commission at IdentityTheft.gov to create an official record and receive a recovery plan.

How fraudsters get your card information

Thieves obtain card details through several routes. Data breaches at retailers, restaurants, or hotels expose millions of card numbers at once — the thief buys batches of stolen numbers from underground forums. Phishing emails trick you into entering your card details on a fake website that looks like your bank or a store you trust. Skimming devices are small machines attached to ATMs or gas pump card readers that capture your number when you swipe.

Weaker security comes from older websites without HTTPS (the padlock icon in your browser), public Wi-Fi networks where data travels unencrypted, and emails that ask you to "verify your account" or "confirm your payment method." Thieves also obtain information by dumpster diving for receipts, intercepting mail, or straightforward guessing card numbers — some use software that tests thousands of combinations per second.

You do not have to be careless for this to happen. A breach at a major retailer where you shopped once can expose your number years later. The risk is not about whether you will encounter fraud — it is about when.

Signs that your card has been fraudulently used

The most obvious sign is a charge you do not recognize on your statement. This might be a large purchase at a store you have never visited, a subscription you never signed up for, or multiple small charges from the same merchant. Some fraud is obvious: a $500 electronics purchase when you were at work. Other fraud is subtle: a $9.99 monthly charge that looks like it could be legitimate.

You might also notice that your card is declined when you try to use it, even though you have available credit. This can mean a thief has maxed out your limit, or your issuer has frozen the account after detecting suspicious activity. You may receive a bill for a much higher amount than usual, or statements stop arriving (a thief may have changed your address to hide the fraud longer).

The best defense is to check your statement every week, not once a month. Many card issuers also send text or email alerts when a charge exceeds a threshold you set, or when a purchase is made in a location far from your home. Turn these alerts on in your card's mobile app or online portal.

Your legal protection against fraudulent charges

Federal law limits your liability for unauthorized charges. If you report the fraud before the thief uses your card, you owe nothing. If you report it within two business days of discovering the fraud, you are liable for no more than $50. If you wait longer than two business days but report it within 60 days of your statement date, your liability can be up to $500. After 60 days, you may be liable for the full amount.

In practice, most card issuers waive the $50 liability entirely and reimburse fraudulent charges when ready, even if you report late. They do this because they have fraud insurance and because keeping customers is cheaper than fighting over $50. However, the 60-day window is real — waiting months to report fraud weakens your position.

This protection applies only to credit cards and debit cards. If a thief uses your bank account number directly (not through a card), different rules explore, and your liability is higher. This is one reason using a credit card for online purchases is safer than using a debit card.

What to do when ready if you spot fraud

Call your card issuer right away. Use the phone number on the back of your card or on your statement — never call a number from an email or text message, because that could be a scammer pretending to be your bank. Tell them which charges are fraudulent. They will ask you to confirm your identity, then freeze your account and cancel your card.

Do not email your card issuer about fraud. Phone calls create a record with a timestamp, and the issuer can act within minutes. Email can be intercepted or ignored for days. If you cannot call during business hours, many issuers have 24/7 fraud lines.

Request a new card with a new number. The issuer will mail it to your address on file, usually within 5 to 10 business days. Ask whether they can expedite it if you need it sooner. In the meantime, you can use your online account to pay bills or make purchases if the card is not completely frozen.

Check your credit report for accounts you did not open. Go to AnnualCreditReport.com (the only free, official source) and request your report from all three bureaus: Equifax, Experian, and TransUnion. Fraudsters sometimes open new credit cards or loans in your name. Catching this early prevents damage to your credit score.

Reporting fraud to the government and credit bureaus

File a report with the Federal Trade Commission at IdentityTheft.gov. This is free and creates an official record. The FTC will generate a recovery plan tailored to your situation and provide a case number you can share with creditors and credit bureaus. You do not have to file a police report first, though you can if you want one for your records.

If the fraud involved opening accounts in your name, place a fraud alert on your credit file. Call any one of the three credit bureaus and ask them to add a fraud alert. They will notify the other two automatically. A fraud alert tells lenders to verify your identity before opening new accounts in your name. It lasts one year and is free.

For more serious identity theft (multiple fraudulent accounts, accounts opened months ago), consider a credit freeze. This locks your credit file so no one can open new accounts without your permission. You place it with each bureau separately, and it is free. A freeze is stronger than an alert but requires you to unfreeze temporarily when you want to explore for credit yourself.

Preventing fraud before it happens

Use a credit card instead of a debit card for online and in-person purchases whenever possible. Credit cards offer stronger fraud protection and do not directly drain your bank account. If fraud occurs, you dispute the charge and the issuer investigates — your money stays in your account during that time.

Check your statements weekly. Set up text or email alerts for purchases above a certain amount. Use strong, unique passwords for your bank and card accounts — a password manager like Bitwarden or 1Password makes this easier. Never reuse passwords across sites.

Be skeptical of emails asking you to verify your account, confirm payment information, or click a link to update your profile. Legitimate banks and retailers do not ask for sensitive information by email. If you receive a suspicious email, go directly to the company's website (type the address yourself, do not click a link) and log in to check your account.

Avoid entering your card number on public Wi-Fi networks. Use your phone's cellular data or a VPN (virtual private network) if you must shop on public Wi-Fi. When you receive a new card, set up it when ready through your issuer's website or app. Shred old cards and statements before throwing them away.

Frequently Asked Questions

Will I have to pay the fraudulent charges while the issuer investigates?

No. Once you report fraud, the issuer will remove the disputed charges from your account when ready in most cases. You will not owe them while the investigation happens. The issuer may place a temporary hold on your account to prevent further fraud, but you can still make purchases with a new card they issue.

How long does it take to get my money back?

Most issuers credit your account within 3 to 5 business days of your report. Some do it the same day. If the investigation takes longer, the issuer must complete it within 60 days and notify you of the outcome. In practice, straightforward fraud cases are resolved in days, not weeks.

Can I be held responsible if someone in my household committed the fraud?

That depends on whether you authorized them to use the card. If a family member used your card without permission, it is fraud, and you can report it. If you gave them permission but they exceeded that permission (you said $50 limit, they charged $500), the situation is more complicated and may require legal information.

What if the fraud happened at a store where I swiped my card in person?

Report it to your card issuer the same way. They will investigate whether the store's card reader was compromised or whether an employee copied your information. The store may also launch an investigation. Your liability is the same regardless of how the fraud occurred — $0 if reported quickly, capped at $50 if reported within 60 days.

Do I need to close my bank account if my debit card was fraudulently used?

Not necessarily. Contact your bank when ready and report the fraud. They will cancel the card and issue a new one. Monitor your account closely for unauthorized transfers. Debit card fraud is riskier than credit card fraud because the thief has direct access to your cash, but closing the account is only needed if you cannot regain control or if the fraud continues.