Credit card fraud is when someone uses your card or card information without your permission to make purchases or withdraw cash
Credit card fraud happens in two main ways. Card-present fraud occurs when a thief physically has your card — they've stolen it from your wallet, found it, or taken it during a transaction. Card-not-present fraud happens when someone uses your card number, expiration date, and security code without the physical card, usually online or over the phone. Both types result in charges you didn't authorize.
The person committing fraud might be a stranger who stole your information, a data breach victim who bought stolen card details, or occasionally someone you know. The method doesn't change the outcome: unauthorized charges appear on your statement, and you're responsible for reporting them to your card issuer.
Most credit card fraud is caught quickly because card companies monitor for unusual spending patterns. If you're charged $500 at a gas station in another state two hours after a purchase near your home, the issuer's fraud detection system flags it. That's why you might get a call or text asking to confirm a purchase — the system spotted something that doesn't match your normal behavior.
Key Takeaways
- Card-present fraud uses a physical card stolen from you; card-not-present fraud uses only your card number and happens online or by phone.
- You are not responsible for unauthorized charges if you report them to your card issuer within the timeframe stated in your cardholder agreement, usually 60 days.
- Card companies use automated systems to catch fraud by comparing purchases against your spending patterns and location history.
- Freezing your credit with the three major bureaus (Equifax, Experian, TransUnion) stops a thief from opening new accounts in your name.
- Monitoring your statements monthly and setting up transaction alerts are the fastest ways to catch fraud before it spreads.
How thieves get your card information
Stolen card numbers come from several sources. A data breach at a retailer, restaurant, or hotel exposes millions of card numbers at once — the thief doesn't target you specifically, they buy a batch of stolen numbers from the dark web. A skimmer attached to an ATM or gas pump reads your card when you insert it. A phishing email tricks you into entering your card details on a fake website that looks real. Someone takes a photo of your card during a transaction or digs through your trash for discarded receipts.
Once a thief has your number, they test it with a small purchase — $1 or $5 — to confirm it works. If the charge goes through without a fraud alert, they make larger purchases. This is why monitoring your statement for small unfamiliar charges matters: catching the test charge often stops bigger fraud before it happens.
What happens when you report fraud
Call your card issuer's fraud line as soon as you notice an unauthorized charge. The number is on the back of your card or your statement. Tell them which charges are fraudulent. The issuer will cancel your current card and issue a replacement, usually within 5 to 10 business days. They'll also reverse the fraudulent charges — you won't pay for them.
The issuer will ask you to confirm your recent legitimate purchases to rule out a misunderstanding. They may ask where you were when the fraudulent charge occurred, what your typical spending looks like, and whether anyone else has access to your card. Answer honestly; this information helps them confirm the fraud and prevent it from happening again.
After you report, the issuer opens a dispute. They investigate by contacting the merchant where the fraud occurred and reviewing the transaction details. Most disputes are resolved within 30 to 60 days, though some take longer if the merchant contests the claim. During this time, the fraudulent amount is usually credited back to your account temporarily while the investigation continues.
Your legal protection against fraud
Federal law limits your liability for unauthorized credit card charges. If you report the fraud before the card issuer discovers it, you owe nothing — zero dollars. If you report it after the issuer finds it but before you receive a statement showing the charge, you still owe nothing. If you report it after the charge appears on your statement, you owe up to $50 per card, though most issuers waive this fee as a courtesy.
The catch: you must report within the timeframe your cardholder agreement specifies, usually 60 days from when the statement is mailed or made available online. If you wait longer, the issuer can hold you responsible for the full amount. This is why checking your statement monthly — or setting up email alerts for every transaction — matters.
Debit cards have different protections. If you report debit card fraud within two business days, you owe nothing. If you report within 60 days, you owe up to $50. After 60 days, you may owe the full amount. Because debit card fraud hits your actual bank account rather than a line of credit, the stakes are higher and the window to report is tighter.
Steps to take if your card is compromised
First, call your card issuer when ready. Have your card in front of you and be ready to confirm your identity. Tell them which charges are fraudulent and ask them to cancel the card and send a replacement. Ask whether they'll waive the $50 liability (most do). Request a new card number, not a reissued version of the same number.
Second, place a fraud alert with the three credit bureaus: Equifax, Experian, and TransUnion. You only need to call one bureau — they're required to notify the other two. A fraud alert tells creditors to verify your identity before opening new accounts in your name. It lasts one year and is free. You can renew it annually if fraud happens again.
Third, consider a credit freeze if the fraud involved your personal information, not just your card number. A freeze locks your credit file so no one can open accounts without unfreezing it first. It's free and lasts until you remove it. A freeze is stronger protection than an alert but requires you to unfreeze temporarily whenever you explore for credit yourself.
Fourth, monitor your credit reports for accounts you didn't open. You can view your reports free once per year at annualcreditreport.com. Look for new credit cards, loans, or inquiries you didn't authorize. If you find fraudulent accounts, contact the creditor and the credit bureau to dispute them.
How to reduce your fraud risk
Monitor your statements monthly or set up transaction alerts through your card issuer's app. Most issuers let you choose alerts for purchases over a certain amount, purchases in specific categories, or all transactions. Real-time alerts mean you'll know about fraud within hours, not weeks.
Use a credit card instead of a debit card for online purchases and travel. Credit cards offer stronger fraud protection and don't drain your bank account if fraud occurs. Keep your debit card for ATM withdrawals and in-person purchases where you control the card.
Never share your card number, expiration date, or security code via email, text, or phone unless you initiated the contact and called the official number on your card or statement. Legitimate companies never ask for this information unsolicited. Don't store photos of your card on your phone or computer.
Use strong, unique passwords for online shopping accounts and enable two-factor authentication when available. If a retailer's database is breached, a strong password prevents a thief from accessing your account and changing your saved payment method.
Shred receipts, statements, and credit offers before throwing them away. Dumpster diving for card numbers and personal information is still common. Use a cross-cut shredder if you shred regularly.
What to do if you're a victim of identity theft
Identity theft goes beyond fraudulent charges on your card — it means someone is using your name, Social Security number, or other personal information to open accounts, take out loans, or commit crimes in your name. If you discover this, the steps are more involved than reporting card fraud.
File a report with the Federal Trade Commission at identitytheft.gov. The FTC creates an Identity Theft Report, which you can use to dispute fraudulent accounts with creditors and credit bureaus. You'll also need to file a police report in your jurisdiction and keep a copy for your records.
Contact each creditor where fraudulent accounts were opened and provide them with your FTC report and police report. Ask them to close the accounts and remove the fraudulent charges. Send these documents by certified mail so you have proof of delivery.
Place a credit freeze with all three bureaus, not just an alert. A freeze is the strongest protection against identity theft because it prevents new accounts from being opened without your explicit permission.
Frequently Asked Questions
Can I get my money back if I don't report fraud right away?
It depends on how long you wait. If you report within 60 days of your statement being mailed or made available, you owe nothing. If you wait longer, you may owe the full fraudulent amount. Most card issuers are lenient if you have a good history, but legally they don't have to be. Check your cardholder agreement for the exact important date.
Will fraud on my credit card hurt my credit score?
No. Fraudulent charges don't affect your credit score because you're not responsible for them — they're removed from your account. However, if a thief opens new accounts in your name and doesn't pay them, those accounts will damage your score. That's why monitoring your credit reports matters.
What's the difference between a fraud alert and a credit freeze?
A fraud alert tells creditors to verify your identity before opening accounts but doesn't stop them from doing so. A credit freeze locks your credit file entirely — creditors can't see it without your permission. A freeze is stronger but requires you to unfreeze temporarily when you explore for credit yourself. Both are free.
Can I use my card while fraud is being investigated?
Yes. Your card issuer will send you a replacement card within 5 to 10 business days, and you can use that when ready. The fraudulent charges are usually credited back to your account temporarily during the investigation, so your available credit isn't affected.
What if the merchant disputes my fraud claim?
The card issuer will investigate further by reviewing transaction details, merchant records, and your account history. If the merchant provides evidence you authorized the charge, the issuer may side with them. This is rare if you report quickly and the charge is clearly outside your normal spending pattern. If you lose the dispute, ask the issuer to explain their decision in writing.