Report fraud to your card issuer first, then to the Federal Trade Commission

When you spot unauthorized charges on your credit card statement, contact your card issuer when ready — not the merchant, not the police, not the FTC. Your issuer has a legal obligation to investigate and, in most cases, remove fraudulent charges from your account while the investigation runs. The card company's fraud department can freeze your account, issue a replacement card, and document the dispute in writing.

After you report to your issuer, file a report with the Federal Trade Commission at IdentityTheft.gov. This creates an official record that helps law enforcement and gives you a recovery plan if the fraud is part of a larger identity theft. The FTC does not investigate individual cases, but the report is free and takes about 10 minutes.

Key Takeaways

  • Call your card issuer's fraud line when ready when you spot unauthorized charges — the number is on the back of your card or your statement.
  • Your issuer must investigate and typically removes disputed charges within two billing cycles while they verify the claim.
  • File a report with the Federal Trade Commission at IdentityTheft.gov to create an official record and receive a recovery plan.
  • Request a new card number and ask whether the fraud affected other accounts or if your personal information was compromised.
  • Check your credit reports at AnnualCreditReport.com for accounts you did not open, and place a fraud alert if identity theft is involved.

What to do when you call your card issuer

Have your card and statement in front of you. Tell the fraud department the date you noticed the unauthorized charge, the merchant name, and the dollar amount. The issuer will ask whether you recognize the transaction and whether anyone else has access to your card number. Answer honestly — if you authorized the charge but later disputed it, the issuer can deny your claim.

Ask the issuer to freeze your account when ready and issue a replacement card with a new number. Request written confirmation of the dispute, including a case or reference number. This document protects you if the issuer later claims you never reported the fraud. Before you hang up, ask whether the fraud appears on other accounts in your name — sometimes a compromised card number signals broader identity theft.

Understanding the investigation timeline

Federal law requires your issuer to investigate within 30 days of your report and resolve the dispute within two billing cycles — typically 60 days total. During this time, the issuer removes the charge from your account so you do not have to pay it. You can use your account normally while the investigation runs.

The issuer contacts the merchant to determine whether the charge was legitimate. If the merchant cannot prove you authorized it, the charge stays removed. If the merchant provides evidence you did authorize it, the issuer can put the charge back on your account and notify you in writing. You then have the right to dispute that decision, though the burden shifts to you to prove the charge was not yours.

Filing a report with the Federal Trade Commission

Go to IdentityTheft.gov and select "Report identity theft." You will answer questions about what happened, when you discovered it, and what accounts were affected. The FTC asks for your card number, the fraudulent charges, and the merchant names if you know them. You do not need to have all this information — the report works with whatever details you have.

At the end, the FTC generates a personalized recovery plan that lists the steps you should take next. The plan includes templates for letters to send to your issuer and credit bureaus, a checklist of accounts to monitor, and information about fraud alerts. Save this plan — it serves as proof of the fraud report if you need to dispute charges later or if a debt collector contacts you about accounts opened in your name.

Protecting yourself after the fraud is reported

Request your free credit reports from all three bureaus at AnnualCreditReport.com. Look for accounts you did not open, inquiries you did not authorize, or addresses that are not yours. If you find fraudulent accounts, contact the bureau in writing and ask them to remove the false information. Keep copies of all correspondence.

Consider placing a fraud alert on your credit file. This tells lenders to verify your identity before opening new accounts in your name. You can place a fraud alert yourself by calling any of the three bureaus — Equifax, Experian, or TransUnion — and it lasts one year. If you believe you are a victim of identity theft, you can request an extended fraud alert that lasts seven years.

When to report to police or the FBI

Police reports are rarely necessary for a single fraudulent charge on a credit card, because your issuer handles the investigation and you are not liable for the charge. However, if the fraud is part of a larger identity theft — multiple accounts opened in your name, fraudulent loans, or tax fraud — file a report with your local police department. The report creates an official record that helps you dispute fraudulent accounts and can prevent debt collectors from pursuing you for debts you did not incur.

The FBI investigates large-scale fraud schemes, not individual cases. If you believe you were targeted by a scam involving wire transfers, romance fraud, or a scheme that defrauded many people, you can report it to the FBI's Internet Crime Complaint Center at IC3.gov. This does not lead to an investigation of your case, but it helps the FBI identify patterns and warn the public.

What happens if your card issuer denies your dispute

If your issuer puts the charge back on your account and you disagree, you have the right to dispute that decision. Send a written letter to the address listed on your statement, not an email. Include your case number, the charge amount, the merchant name, and a clear explanation of why you believe the charge is fraudulent. Keep a copy for your records.

Your issuer must respond in writing within 30 days. If they deny your second dispute, you can file a complaint with the Consumer Financial Protection Bureau at ConsumerFinance.gov. The CFPB forwards complaints to your issuer and tracks patterns of unfair practices. A complaint does not overturn a denied dispute, but it creates a record that can pressure the issuer to reconsider or change their practices.

Frequently Asked Questions

Am I responsible for paying fraudulent charges while the investigation happens?

No. Federal law limits your liability to $50 if someone uses your physical card without permission, and $0 if the fraud involves only your card number. Your issuer must remove the charge from your account while they investigate, so you do not have to pay it during that time.

How long does it take to get my money back?

Your issuer removes the charge when ready in most cases, so you see the credit within one or two billing cycles. If the issuer puts the charge back after investigating, you have the right to dispute again. The entire process typically takes 60 to 90 days from your first report.

Do I need to file a police report to dispute the charge?

No. Your card issuer investigates without a police report. However, if the fraud is part of identity theft or involves multiple accounts, a police report helps you dispute those accounts and protects you from debt collectors. You can file a report online in most jurisdictions.

What if the fraud happened on a debit card instead of a credit card?

Debit card fraud has different protections. If you report it within two business days, your liability is capped at $50. If you wait longer, you may be liable for up to $500. Report debit card fraud to your bank when ready and follow the same steps: contact the bank's fraud line, file an FTC report, and monitor your accounts.

Should I close the account after fraud, or keep it open?

Closing the account does not help your credit score and may hurt it by reducing your available credit. Keep the account open after the fraud is resolved. Your issuer will issue a new card with a new number, so the old number is already useless to a fraudster.