Credit card theft is a form of identity fraud, and the steps to recover depend on when you notice it and what your card issuer will cover
If someone has used your credit card without your permission, your first move is to call your card issuer when ready — not email, not their website chat. A phone call creates a record and stops the card faster. Most issuers have a fraud line that answers 24 hours. You will find the number on your statement or the back of your card.
Your card issuer will cancel the card, investigate the unauthorized charges, and issue you a new one. Under federal law, your liability for fraudulent charges is capped at $50 per card, and most major issuers waive even that if you report the theft before the charges post to your account. The investigation typically takes 30 to 60 days, during which the issuer will contact the merchant and review transaction records.
While the investigation is underway, the fraudulent charges will usually be removed from your account temporarily — you will not owe them while the issuer decides. If the issuer rules in your favor, those charges stay removed. If they rule against you (which is rare when you report promptly), you would owe them, but you can dispute that decision.
Key Takeaways
- Call your card issuer's fraud line when ready when you notice unauthorized charges — do not wait for a statement or email confirmation.
- Federal law caps your liability at $50 per card for fraudulent charges, and most issuers waive this entirely if you report before the charges post.
- Your issuer will cancel the card, investigate the charges, and send you a replacement card within 7 to 10 business days.
- Fraudulent charges are removed from your account while the investigation happens, and you do not owe them unless the issuer rules against you.
- You should also place a fraud alert with the credit bureaus and check your credit report for accounts you did not open.
How to report the theft to your card issuer
Call the number on the back of your card or on your most recent statement. Tell the representative that you have unauthorized charges and want to report fraud. They will ask you to verify your identity — usually your Social Security number, date of birth, and the last four digits of the card. Have your statement in front of you so you can point out exactly which charges are not yours.
The representative will cancel the card when ready and begin a dispute for each fraudulent charge. They will ask you questions like where you last used the card, whether anyone else has access to it, and whether you recognize any of the merchants. Answer honestly — the issuer uses this information to determine whether the charges were truly unauthorized or whether you might have authorized them and later forgotten.
Ask the representative for a confirmation number and the name of the investigator assigned to your case. Request that they send you a written summary of the fraud report by mail or email. This creates a paper trail if you need to dispute the issuer's decision later.
What happens during the investigation
Once you report the fraud, your issuer will contact the merchants where the charges occurred and ask them to provide proof that you authorized the transaction — usually a signed receipt or a digital authorization record. If the merchant cannot provide proof, the charge is removed. If they can, the issuer will review the evidence and decide whether it looks legitimate.
The investigation takes 30 to 60 days. During this time, the fraudulent charges remain on your account but are marked as "disputed" or "under investigation." You do not have to pay them while the issuer decides. Your credit report will not show these charges as delinquent because they are flagged as disputed.
The issuer will contact you by phone or mail with the outcome. If they rule in your favor, the charges are permanently removed and you owe nothing. If they rule against you, they will explain why and tell you that you now owe the amount. You can dispute their decision by responding in writing within 60 days of their letter.
Protecting yourself from further theft
While your issuer investigates, place a fraud alert with the three major credit bureaus: Equifax, Experian, and TransUnion. A fraud alert tells creditors to verify your identity before opening new accounts in your name. You only need to call one bureau — they will notify the other two. The initial alert lasts one year and is free.
You can place a fraud alert by calling Equifax at 1-800-525-6285, Experian at 1-888-397-3742, or TransUnion at 1-800-680-7289. Have your Social Security number and a phone number where they can reach you. They will give you a confirmation number.
After you place the alert, order your free credit report from each bureau at annualcreditreport.com. Check for accounts you did not open — credit cards, loans, phone lines, or utilities opened in your name. If you find unauthorized accounts, contact the creditor and the credit bureau when ready. These are signs that someone has your personal information, not just your card number.
When your new card arrives
Your issuer will mail a replacement card to the address on file, usually within 7 to 10 business days. If you need a card sooner, call and ask whether they can expedite it or issue a temporary card number you can use online. Some issuers offer this at no charge.
When the new card arrives, set up it by calling the number on the back or using the issuer's app. Destroy the old card by cutting it in half and throwing it away separately from the pieces. Do not just toss it whole — a determined person can tape it back together.
Update any automatic payments you had set up on the old card. Check your subscriptions, insurance payments, utilities, and loan payments. If you miss a payment because you forgot to update the card, you could damage your credit score, so go through your records carefully.
If the issuer denies your dispute
If your issuer rules that the charges were authorized and you owe them, you have the right to dispute that decision. The issuer must send you a written explanation of why they ruled against you. Read it carefully — they may have found evidence you did not know about, or they may have made an error.
You can respond in writing within 60 days of the letter. Explain why you believe the charges were unauthorized and provide any evidence you have — for example, a police report if you filed one, a statement from your bank about when the card was lost, or proof that you were in a different location when the charge occurred. Send your response by certified mail so you have proof it was received.
If the issuer still disagrees, you can file a complaint with the Consumer Financial Protection Bureau (CFPB) at consumerfinance.gov. The CFPB will investigate and may require the issuer to reconsider. This process takes several weeks but does not cost you anything.
Whether to file a police report
Filing a police report is optional but useful if the theft was significant or if you suspect someone you know committed it. A police report creates an official record that can help if you need to dispute the issuer's decision or if the same person steals from you again.
To file a report, go to your local police station or file online through your city or county police department's website. Bring your card statement showing the fraudulent charges and any other evidence — for example, if you know who took the card or how they used it. The police will give you a report number.
Keep the report number and a copy of the report. If your issuer denies your dispute, you can include the police report in your written response. If the same person steals from you again, the earlier report shows a pattern.
How this affects your credit score
Fraudulent charges that are marked as disputed do not damage your credit score while the investigation is underway. Your credit report will show the account as "in dispute," which creditors understand means you are not responsible for those charges.
If the issuer rules in your favor, the charges are removed entirely and your score is unaffected. If the issuer rules against you and you owe the charges, those charges will be added to your account balance. If you do not pay them, they will be reported as delinquent and will damage your score. This is why it is important to dispute the issuer's decision if you believe it is wrong.
The fraud alert you place will not damage your score. It straightforward tells creditors to verify your identity, which may slow down new account openings but protects you from identity theft.
Frequently Asked Questions
Do I have to pay the fraudulent charges while the investigation is happening?
No. Fraudulent charges are removed from your account while the issuer investigates. You do not owe them unless the issuer rules that the charges were authorized. Even then, you can dispute that decision in writing.
What if I find out someone I know stole my card?
Report it to your issuer the same way you would report any other theft. Whether you also file a police report is your choice, but doing so creates an official record. If you live with the person or see them regularly, a police report protects you if they steal from you again.
How long does it take to get my money back?
The investigation takes 30 to 60 days. Once the issuer rules in your favor, the charges are removed from your account when ready. You will not see a refund check — the charges straightforward disappear from your balance.
Will this show up on my credit report?
Disputed charges show on your credit report as "in dispute" while the investigation happens, but this does not damage your score. Once the issuer rules in your favor, the charges are removed and your report returns to normal. If the issuer rules against you, the charges stay on your account and may damage your score if you do not pay them.
What should I do if I notice the theft months later?
Report it to your issuer as soon as you notice it. You are still protected under federal law, though the investigation may take longer because the merchant will have to search older records. The sooner you report, the better — waiting makes it harder for the issuer to contact the merchant and verify what happened.