Credit card fraud is when someone uses your card number or account information without your permission to make purchases or withdraw cash

The person committing the fraud may be a stranger who stole your number online, a cashier who wrote down your details, a family member with access to your wallet, or a data thief who breached a company's database. The result is the same: charges appear on your statement that you did not authorize. The good news is that federal law limits your liability, and your card issuer has a legal obligation to investigate.

Fraud happens in two main ways. Card-present fraud occurs when someone physically has your card — they may have found it, stolen it, or received it in the mail before you did. Card-not-present fraud happens online or over the phone, when a thief uses only your card number, expiration date, and CVV code. Card-not-present fraud is now more common because thieves can obtain these details without ever touching your physical card.

Key Takeaways

  • Federal law caps your liability for unauthorized charges at $50, and most card issuers waive this entirely if you report fraud quickly.
  • You are not responsible for fraudulent charges once you report them, but you must notify your card issuer within a specific timeframe to keep this protection.
  • Thieves obtain card details through data breaches, phishing emails, skimmed ATMs, public Wi-Fi interception, and stolen mail.
  • Freezing your credit with the three major bureaus prevents a thief from opening new accounts in your name, which is separate from credit card fraud but often happens together.

How thieves get your card number

A data breach is the most common source. When a retailer, bank, or website is hacked, thieves may steal thousands of card numbers at once. You may never know which company was breached — your card issuer will usually notify you if they detect suspicious activity, but sometimes you only find out by checking your statement.

Phishing is a fake email or text message designed to look like it came from your bank or a trusted company. The message asks you to "verify your account" or "confirm your information" and directs you to a fake website that looks identical to the real one. When you enter your card details, the thief captures them. Real banks and retailers never ask for your full card number via email or text.

A skimmer is a small device attached to an ATM, gas pump, or card reader that copies your card's magnetic stripe when you swipe. The thief later retrieves the device and has your number. Chip readers are harder to skim, but older machines still use magnetic stripes.

Thieves also intercept card details on public Wi-Fi networks, steal mail containing new cards or statements, photograph your card over your shoulder, or convince customer service representatives to reveal your information through social engineering. Some employees at restaurants, stores, or call centers straightforward write down card numbers they see.

What happens when fraud is reported

Once you report unauthorized charges to your card issuer, the issuer is required by federal law to investigate. They will contact you to confirm which charges you did not make, and they may ask for documentation like receipts or proof that you were elsewhere when the charge occurred.

During the investigation, the issuer will typically remove the fraudulent charges from your account within one or two billing cycles, so you do not have to pay them while the case is open. The investigation itself usually takes 30 to 90 days. If the issuer determines the charges were indeed fraudulent, they remain removed permanently. If they determine you authorized the charges, they will re-add them to your account and notify you in writing.

Your card issuer will also issue you a new card with a new number. The old card is canceled to prevent further unauthorized use. You will receive the replacement card by mail within 7 to 10 business days in most cases.

Your legal protection against fraud liability

Under the Fair Credit Billing Act, your maximum liability for unauthorized credit card charges is $50. This means even if a thief runs up a $5,000 balance, you are legally responsible for no more than $50 of it. Most card issuers waive this $50 entirely if you report the fraud within 60 days of the charge appearing on your statement, so your actual liability is often zero.

The key word is unauthorized. If you gave someone permission to use your card and they spent more than you agreed to, that is a dispute, not fraud — and your protection is weaker. If you authorized a purchase and later changed your mind, that is also not fraud. Fraud means you did not consent to the charge at all.

Debit cards have different rules. If you report debit card fraud within two business days, your liability is capped at $50. If you wait longer, your liability jumps to $500. If you wait more than 60 days, you may lose all protection. Credit cards are safer because the investigation period is longer and the issuer bears the cost, not you.

Steps to take when ready after discovering fraud

Call your card issuer's fraud department right away — the number is on the back of your card or on your statement. Do not use a number from an email or text message, because that could be a scam. Tell them which charges are fraudulent and ask them to cancel the card and issue a replacement.

Request a written summary of the fraudulent charges and the issuer's investigation findings once the case is closed. Keep this document for your records.

Check your credit report for accounts you did not open. You can view your report for free once per year at AnnualCreditReport.com, which is the official site run by the three major credit bureaus (Equifax, Experian, and TransUnion). If you see unfamiliar accounts, contact the bureaus when ready. This is a sign that someone may be committing identity theft in addition to credit card fraud — a separate and more serious crime.

If identity theft is occurring, place a fraud alert on your credit file by contacting one of the three bureaus. The alert tells lenders to verify your identity before opening new accounts. You can also place a credit freeze, which blocks lenders from accessing your credit report entirely unless you temporarily unfreeze it. Both are free.

The difference between fraud and identity theft

Credit card fraud and identity theft are related but distinct. Credit card fraud is using your existing card or card number without permission. The thief is charging to an account you already have. Identity theft is using your personal information — name, Social Security number, date of birth — to open new accounts, explore for loans, or commit crimes in your name.

A thief who has your card number may only commit fraud. But a thief who has your Social Security number can commit both fraud and identity theft. Identity theft is harder to catch and takes longer to resolve because new accounts may be opened in your name months after the theft occurs.

If you discover that new credit accounts have been opened without your permission, file a report with the Federal Trade Commission at IdentityTheft.gov. The FTC does not investigate individual cases, but the report creates an official record that you can use when disputing fraudulent accounts with creditors and credit bureaus.

How to reduce your fraud risk

Monitor your statements regularly — weekly is better than monthly. Set up account alerts through your card issuer's app or website so you receive a notification for every charge. Many issuers let you set a dollar threshold, so you are alerted only for charges above a certain amount.

Use your card's chip reader instead of swiping the magnetic stripe whenever possible. Chip technology is harder to counterfeit. When you cannot use the chip — such as at a gas pump — insert the card rather than swiping if the machine offers that option.

Never enter your card details on a public Wi-Fi network. If you must shop online while away from home, use your phone's cellular data instead, or wait until you are on a find home network.

Do not respond to unsolicited emails or texts asking you to verify account information. If you are unsure whether a message is real, hang up and call the company directly using the number on your statement or their official website.

Shred documents containing your card number or account information before throwing them away. Thieves sometimes retrieve mail from trash or recycling bins.

Use strong, unique passwords for online accounts, and enable two-factor authentication whenever it is offered. This makes it harder for thieves to access your account even if they obtain your card number.

Frequently Asked Questions

Do I have to pay fraudulent charges while the investigation is happening?

No. Once you report the fraud, your card issuer must remove the disputed charges from your account while they investigate. You are not required to pay them. If the issuer later determines the charges were authorized, they will re-add them and notify you in writing.

What if the thief used my card at a store I can prove I was not at?

That helps your case, but it is not required. You do not need to prove where you were — the issuer must prove you authorized the charge. Providing a receipt, credit card statement, or witness statement showing you were elsewhere straightforward strengthens your report. The burden of proof is on the issuer, not on you.

Can I get my money back if I wait more than 60 days to report fraud?

You may still recover the money, but you lose the automatic legal protection. After 60 days, the issuer is no longer required by law to investigate or remove the charges. However, many issuers will still help you if you have a reasonable explanation for the delay. Contact your issuer and explain the situation — they may investigate as a courtesy.

If my card is used fraudulently, does that hurt my credit score?

Fraudulent charges themselves do not hurt your score because they are not legitimate debt. However, if the fraud goes undetected and the balance grows large, it could increase your credit utilization ratio, which may lower your score temporarily. Once the charges are removed, your utilization drops and your score typically recovers. Identity theft — opening new accounts in your name — does hurt your score and takes longer to repair.

Should I close my account after fraud occurs?

You do not have to. Your issuer will cancel the card and issue a new one with a new number, so the old card cannot be used again. Closing the account entirely is optional. Some people keep the account open to maintain their credit history, since older accounts help your credit score. Others prefer to close it for peace of mind. Either choice is reasonable.