Unauthorized credit card use in England is covered by the Consumer Credit Act 1974 and the Payment Services Regulations 2017

If someone uses your credit card without permission, you are not liable for the full amount under UK law. The Payment Services Regulations cap your liability at £50 if you report the fraud before the card is used, and at £0 if you report it after — provided you did not act with gross negligence or deliberately disclose your PIN or card details. The Consumer Credit Act adds further protection: your card issuer must refund unauthorized transactions within a set timeframe, usually 10 working days.

The key is reporting the fraud quickly. Most card issuers have a 24-hour fraud line, and reporting by phone creates an when ready record. Written confirmation follows, but the phone call starts the clock on your refund.

Your liability depends on whether you contributed to the fraud through carelessness. If you left your card lying around, shared your PIN, or ignored suspicious activity on your statement, the bank may argue you were negligent. Gross negligence — the legal standard — is a high bar, but it exists. If you straightforward lost your card and someone found it, that is not negligence on your part.

Key Takeaways

  • You are liable for only the first £50 of unauthorized use if you report it before the card is used, and £0 if you report it after, under the Payment Services Regulations 2017.
  • Report fraud to your card issuer by phone as soon as you notice it; most banks have a dedicated 24-hour fraud line.
  • Your card issuer must refund unauthorized transactions within 10 working days if you reported the fraud promptly and did not act with gross negligence.
  • Gross negligence — such as writing your PIN on your card or ignoring repeated fraudulent charges — can reduce your protection, but straightforward losing your card does not count.
  • Keep records of all communications with your bank, including the date and time you reported the fraud and the name of the person who took your call.

How to report unauthorized use to your card issuer

Call your card issuer's fraud line when ready. The number is on the back of your card or in your online banking app. Have your card details and a recent statement ready. Tell them which transactions are not yours and when you first noticed them.

The bank will ask whether you lost the card, whether anyone else had access to it, and whether you recognize the merchant names. Answer honestly. If you do not recognize a transaction, say so. If you suspect a specific person, mention it, but do not accuse without evidence.

Ask the bank to freeze your card and issue a replacement. Most banks do this when ready over the phone. Request a reference number for the fraud report and write it down. Ask how long the investigation will take and when you can expect a refund.

Follow up with a written letter to the bank within 30 days. Include your account number, the reference number from your phone call, the dates of the unauthorized transactions, and the amounts. Send it by recorded delivery. This creates a paper trail if you need to escalate the complaint later.

What happens during the bank's investigation

Once you report fraud, your card issuer has 10 working days to refund you or tell you why they are not refunding you. In practice, many banks refund within 2 to 5 working days if the fraud is obvious — for example, a transaction in another country made while you were in England.

The bank will contact the merchant where the unauthorized transaction occurred and ask for evidence: the IP address used, the delivery address, the payment method details. If the merchant cannot prove you authorized the transaction, the bank refunds you and pursues the merchant or the fraudster.

If the bank suspects you authorized the transaction or acted negligently, they may refuse the refund. They must tell you in writing why they refused and give you the merchant's evidence. At that point, you can dispute their decision through the Financial Ombudsman Service.

During the investigation, the unauthorized amount usually stays on your account. Some banks credit it temporarily so your balance is not affected. Ask your bank what they do.

Disputing the bank's decision if they refuse to refund

If your bank refuses to refund the unauthorized transaction, you have the right to complain. Write to the bank's complaints department and explain why you believe the transaction was unauthorized. Reference the Payment Services Regulations 2017 and the Consumer Credit Act 1974.

The bank has eight weeks to respond to your complaint. If they refuse again or do not respond within eight weeks, you can refer the matter to the Financial Ombudsman Service. The Ombudsman is free and independent. They will review the bank's evidence and your account of events.

The Ombudsman can order the bank to refund you and pay compensation for distress or inconvenience. Their decisions are binding on the bank. You do not need a lawyer, though you can bring one if you choose.

Protecting yourself from future unauthorized use

Never share your PIN, card number, or the three-digit security code with anyone — not your bank, not a shop, not a friend. Your bank will never ask for these details by phone or email.

Check your statement every month. Most unauthorized fraud is caught within the first 30 days. If you spot something odd — a small transaction you do not recognize, a charge from a merchant you have never heard of — report it when ready. Fraudsters often test a stolen card with a small amount first.

Use your online banking app to set up transaction alerts. Many banks let you choose a threshold: you get a notification every time a transaction over £50 (or whatever amount you choose) is made. This catches large fraudulent charges within minutes.

If you lose your card, call your bank straight away. Do not wait to see if it turns up. A card reported lost before it is used gives you the strongest legal position.

Use a strong, unique password for your online banking. Do not use the same password across multiple websites. If one site is hacked, a fraudster can try that password on your bank account.

Unauthorized online transactions and contactless payments

Online fraud often happens when your card details are stolen from a website or app, not from the card itself. If you see an online transaction you did not make, report it the same way: call your bank's fraud line when ready.

Contactless payments — tapping your card on a reader — are limited to £100 per transaction in the UK, and many banks require a PIN after a few contactless payments in a row. If someone uses your card contactlessly without permission, the £50 liability cap still applies. Report it to your bank as soon as you notice it.

If your card details were stolen from a website, tell that website as well. They may have a data breach they need to investigate. You can also report it to the Information Commissioner's Office if you believe your personal data was mishandled.

Card-not-present fraud and your rights

Card-not-present fraud happens when someone uses your card details online or over the phone without having the physical card. This is the most common type of credit card fraud in England.

Your protection is the same: report it to your bank, and they must refund you within 10 working days if you reported it promptly and did not act negligently. The bank will investigate the merchant and the payment processor to trace where your details were stolen.

Some merchants ask for your card details over the phone. Only give them if you initiated the call and you recognize the business. Never give your details to someone who called you, even if they claim to be from your bank or a well-known company. Your bank will never ask for your full card number by phone.

Frequently Asked Questions

Can I get my money back if I authorized the transaction but later regretted it?

No. Unauthorized means someone else used your card without your permission. If you authorized the transaction yourself — even if you later changed your mind or the product was not as described — that is a different dispute. You would need to contact the merchant directly or pursue a chargeback through your bank, which is a separate process.

What if the fraudster used my card details but not the physical card?

You still have the same protection. Report the unauthorized transaction to your bank, and they will refund you within 10 working days if you reported it promptly. The bank will investigate how your card details were obtained and may contact the merchant or payment processor.

Do I have to pay interest on the unauthorized amount while the bank investigates?

No. Once you report the fraud, the bank should not charge interest on the unauthorized amount. If they do, complain to their complaints department. Interest on fraudulent charges is not permitted under the Payment Services Regulations.

How long does it take to get a replacement card after I report fraud?

Most banks issue a replacement card within 5 to 7 working days. Some offer a temporary card number you can use online when ready while you wait for the physical card. Ask your bank what they offer when you report the fraud.

What if I share my card with a family member and they make an unauthorized transaction?

If you gave them permission to use the card, it is authorized, and you cannot dispute it. If you did not give permission — for example, they used it without asking — report it to your bank as unauthorized use. Your bank may ask questions about whether you live with this person and whether you could have prevented the use. Be honest about what happened.