Credit card theft is when someone uses your card number or account without your permission to make purchases or withdraw cash

Credit card theft happens in two main ways. Card-present theft means someone physically takes your card and uses it in a store or at an ATM. Card-not-present theft means someone has only your card number — from a data breach, a skimmed ATM, a phishing email, or a stolen receipt — and uses it online or over the phone. The thief does not need your physical card to drain your account.

You are not responsible for fraudulent charges once you report them to your card issuer, but the speed of your report matters. If you report within two business days of discovering the theft, your liability is capped at $50 under federal law. If you wait longer, you could be liable for up to $500 of the fraudulent charges. If you do not report it at all, you could lose everything in the account.

Key Takeaways

  • Card-not-present theft — using your number without the physical card — is far more common than someone stealing the card itself.
  • You have federal protection against fraudulent charges, but only if you report the theft within two business days of discovering it.
  • Thieves get your card number from data breaches at stores, phishing emails, skimmed ATMs, or by photographing your receipt.
  • Your card issuer will cancel the card and send a replacement, but you must check your statements regularly to catch theft early.
  • Freezing your credit report prevents a thief from opening new accounts in your name, which is different from credit card theft but often happens together.

How thieves get your card number

Data breaches at retailers are the largest source of stolen card numbers. When a store's payment system is hacked, thousands of card numbers are exposed at once. You may not know your number was stolen until months later when you see a fraudulent charge. Stores like Target, Home Depot, and Equifax have all experienced breaches that exposed millions of card numbers.

Phishing emails and texts are another common route. A thief sends you a message that looks like it came from your bank or a store you use, asking you to "verify your account" or "confirm your payment method." The link takes you to a fake website that looks identical to the real one. When you enter your card number, the thief captures it. These emails often create false urgency — "Your account will be closed" or "Unusual activity detected" — to make you act without thinking.

Skimming devices at ATMs and gas pumps read your card number and PIN when you insert your card. The thief installs a thin overlay on the card slot that captures your information while the legitimate machine still processes your transaction normally. You may have no idea your card was skimmed until fraudulent charges appear.

Stolen receipts and mail are slower but still effective. A receipt with your full card number printed on it can be photographed or kept by a store employee or someone who finds it in the trash. Old credit card statements in your mailbox can be intercepted. This is why you should shred receipts and statements before throwing them away.

What happens when your card is stolen

The thief typically makes small test charges first — $1 or $2 — to confirm the card number works. If those go through, they make larger purchases. Some thieves use the card for everyday items at stores. Others buy high-value electronics or gift cards that can be resold quickly. Card-not-present theft often happens online because there is no need to match a signature or show an ID.

You may not notice for days or weeks if you do not check your statements regularly. By then, hundreds or thousands of dollars may have been charged. This is why setting up account alerts through your card issuer is important — most banks will text or email you when a charge exceeds a certain amount or when a charge is made in an unusual location.

Once you report the theft, your card issuer will cancel the card and begin an investigation. They will contact merchants to dispute the fraudulent charges and typically remove them from your account within one to two billing cycles. You will receive a replacement card in the mail, usually within five to ten business days.

The difference between credit card theft and identity theft

Credit card theft and identity theft are related but separate problems. Credit card theft means someone used your card number to make purchases. Identity theft means someone used your personal information — your name, Social Security number, date of birth, or address — to open new accounts, take out loans, or commit other fraud in your name.

A thief who steals your card number is committing credit card fraud. A thief who uses that card number plus your Social Security number to open a new credit card account in your name is committing identity theft. Identity theft is harder to fix because it affects your credit report and can take months or years to resolve. Credit card theft is usually resolved in weeks once you report it.

If your card was stolen in a data breach, your Social Security number may have been exposed too. In that case, you should freeze your credit report to prevent a thief from opening new accounts. A credit freeze tells the three major credit bureaus — Equifax, Experian, and TransUnion — not to issue credit reports to anyone without your permission. This stops most new account fraud before it starts.

Steps to take if your card is stolen

Call your card issuer when ready. The phone number is on the back of your card or on your statement. Tell them your card was stolen or that you see fraudulent charges. Do not use a phone number from an email or text message — go to the official website or use the number you already have on file. The issuer will cancel your card right away and begin investigating the charges.

Write down the fraudulent charges and the dates you discovered them. Your card issuer will ask for this information. Keep a record of every conversation — the date, time, the name of the person you spoke with, and what they told you. This creates a paper trail if you need to dispute charges later.

Check your credit report at all three bureaus — Equifax, Experian, and TransUnion. You can view your report free once per year at annualcreditreport.com. Look for accounts you did not open or inquiries from lenders you did not contact. If you see signs of identity theft, file a report with the Federal Trade Commission at identitytheft.gov. The FTC will create a recovery plan and send you a letter you can use to dispute fraudulent accounts.

Consider placing a fraud alert on your credit report. This tells lenders to contact you before opening new accounts in your name. You can place a fraud alert free by calling any of the three bureaus. It lasts one year and can be renewed. If you believe your identity has been stolen, you can place an extended fraud alert that lasts seven years.

How to reduce your risk of card theft

Check your statements every month, either online or on paper. Most card issuers let you set up alerts for charges over a certain amount or charges in certain categories. Use these alerts — they catch fraud faster than waiting for your monthly statement. Many people discover theft within days of alerts being set up.

Never give your card number to someone who calls you, even if they say they are from your bank. Legitimate companies will never ask for your full card number over the phone. If you are unsure, hang up and call the official number on your statement.

Do not use public WiFi to make purchases or check your account. Public networks are straightforward for thieves to monitor. If you must use public WiFi, use a virtual private network (VPN) — a tool that encrypts your connection so others cannot see what you are doing.

Shred receipts, statements, and pre-approved credit offers before throwing them away. Do not leave mail in an unlocked mailbox. Consider a locked mailbox or a post office box if you live in an area with mail theft.

Use chip readers instead of swiping when possible. Chip technology is harder to clone than the magnetic stripe on the back of your card. Contactless payment — tapping your card or phone instead of inserting it — is even safer because your full card number is not transmitted to the merchant.

What your card issuer will and will not do

Your card issuer will cancel the stolen card and send a replacement at no cost to you. They will investigate the fraudulent charges and remove them from your account. They will not charge you interest on fraudulent charges while the investigation is pending. They will provide you with a written explanation of their findings once the investigation is complete.

Your card issuer will not contact the police or pursue criminal charges on your behalf. They may report the theft to law enforcement, but they do not investigate crimes — they only investigate whether the charges were fraudulent. If you want to file a police report, you must do that yourself. Some police departments will take reports online; others require you to come in person.

Your card issuer will not monitor your credit report or place a fraud alert for you. You must do that yourself by contacting the credit bureaus. Your card issuer will not reimburse you for money you withdrew from your account to replace stolen cash — they only cover fraudulent charges made by the thief.

Frequently Asked Questions

Can I be charged interest on fraudulent charges while the bank investigates?

No. Federal law prohibits card issuers from charging interest or fees on fraudulent charges while they investigate. Once the charges are removed from your account, you owe nothing. If your issuer charged you interest on fraudulent charges, contact them in writing and ask them to remove it.

What if I do not notice the theft for three months?

You are still protected under federal law, but your liability may be higher. If you report within two business days, your liability is capped at $50. If you report after two business days but within 60 days of your statement, your liability is capped at $500. After 60 days, you may be liable for the full amount. Report as soon as you notice.

Will my credit score drop if my card is stolen?

Not directly from the theft itself. However, if the thief opened new accounts in your name, those accounts will appear on your credit report and may lower your score. If you catch the theft early and freeze your credit, you can prevent new accounts from being opened. Fraudulent charges on your existing card do not affect your score once they are removed.

Do I need to file a police report?

You are not required to file a police report to dispute fraudulent charges with your card issuer. However, filing a report creates an official record and may help if the thief is caught. Some police departments will not take reports for credit card fraud unless the amount is very large. Contact your local police department to ask what they require.

What if the thief used my card at a store I can see on my statement?

Report it to your card issuer as usual. The issuer will investigate and remove the charge. You do not need to contact the store yourself. However, if you want to report the theft to the store's loss prevention team, you can — they may review security footage or identify the thief. But this is separate from disputing the charge with your card issuer.