Report the fraud to your card issuer immediately
Call the phone number on the back of your credit card or on your statement. Tell them which charges you did not make. Most card issuers have a fraud department that operates 24 hours. You do not need to wait for business hours.
The card issuer will ask you to describe the fraudulent charges — the merchant name, the amount, and the date. Have your statement in front of you. They will also ask whether you recognize the merchant or whether anyone else has access to your card number. Answer honestly about what you know and do not know.
The issuer will cancel your current card and send you a replacement. They will also place a temporary hold on your account while they investigate. This means new charges may be declined until the investigation closes, usually within 10 business days.
Key Takeaways
- Call your card issuer's fraud line immediately — do not wait for a bill or statement to arrive.
- Federal law limits your liability to $50 per card if you report fraud before the card issuer discovers it themselves.
- The card issuer must investigate within 30 days and remove fraudulent charges from your bill while they do.
- File a report with the Federal Trade Commission at IdentityTheft.gov so you have a record if the fraud spreads to other accounts.
- Check your credit reports at AnnualCreditReport.com for accounts or inquiries you do not recognize.
Understand your liability under federal law
The Fair Credit Billing Act limits what you owe if someone uses your card without permission. If you report the fraud before the card issuer discovers it, your liability is $0. If the card issuer finds the fraud first, you are liable for up to $50 per card.
This protection applies only to credit cards and charge cards, not to debit cards. Debit card fraud has different rules and different liability limits depending on when you report it. If you used a debit card, contact your bank immediately — the window to report is shorter.
The card issuer must remove the fraudulent charges from your bill while they investigate. You do not have to pay those charges while the investigation is open. You do have to pay the rest of your bill on time.
File a report with the Federal Trade Commission
Go to IdentityTheft.gov and create an account. Answer the questions about what happened — when you discovered the fraud, which accounts were affected, and how the fraudster obtained your information if you know. The FTC will generate an Identity Theft Report.
This report is a record that you reported the fraud on a specific date. You can use it to dispute charges with other creditors, to place a fraud alert on your credit file, or to prove to a debt collector that a debt is not yours. Keep a copy for your records.
The FTC does not investigate individual cases, but they use reports to identify patterns of fraud and to take action against companies that fail to protect customer data. Filing a report takes about 15 minutes.
Check your credit reports for other fraudulent accounts
Go to AnnualCreditReport.com and order your credit reports from all three bureaus — Equifax, Experian, and TransUnion. You are may have access to to one free report from each bureau per year. Do this now, not later.
Look for accounts you did not open, inquiries from creditors you did not contact, and addresses or employers that are not yours. If someone has your personal information, they may have opened other accounts in your name. The sooner you find them, the sooner you can dispute them.
If you find fraudulent accounts or inquiries, contact the credit bureau in writing and dispute them. Include a copy of your Identity Theft Report from the FTC. The bureau must investigate within 30 days and remove information that is not yours.
Place a fraud alert or credit freeze on your file
A fraud alert tells creditors to verify your identity before opening new accounts in your name. It lasts one year and is free. Contact any one of the three credit bureaus — they will notify the other two automatically. You can place an alert by phone, online, or by mail.
A credit freeze blocks creditors from viewing your credit report entirely, which makes it much harder for a fraudster to open accounts. It also lasts until you remove it. You must place a freeze with each bureau separately. Freezes are free in most states.
A freeze is stronger protection than an alert, but it also means you will need to unfreeze your file temporarily if you apply for credit yourself. If you are not planning to open new accounts soon, a freeze is the better choice. If you might need credit in the next few months, an alert is faster to manage.
Dispute charges with merchants if the issuer does not remove them
If the card issuer's investigation concludes that a charge is legitimate and refuses to remove it, you can dispute it directly with the merchant. Send a written dispute to the merchant's customer service address — email is faster but a letter creates a paper trail.
Explain that you did not authorize the charge and that your card issuer investigated and sided with the merchant. Ask the merchant to provide proof that you authorized the transaction. Many merchants will reverse the charge rather than produce documentation they do not have.
Keep copies of all correspondence. If the merchant refuses and the charge remains on your bill, you can file a complaint with your state's attorney general or with the Consumer Financial Protection Bureau. These agencies do not resolve individual disputes, but they track patterns of merchant misconduct.
Monitor your accounts going forward
Set up account alerts with your card issuer so you receive a notification for every transaction. Most issuers offer this free through their app or online portal. You can set alerts for all charges or only for charges above a certain amount.
Check your statement every month, even if you think you know what is on it. Fraudsters sometimes make small charges to test whether an account is still active before making larger ones. Catching fraud early limits your liability and makes investigation faster.
If you discover fraud again, report it the same way: call the issuer, file an FTC report, and check your credit file. Repeat fraud on the same card is unusual, but if it happens, ask the issuer whether your account number was compromised in a data breach or whether someone has physical access to your card.
Frequently Asked Questions
How long does the card issuer have to investigate?
The issuer must complete their investigation within 30 days of your report. They must remove fraudulent charges from your bill during that time. If they need more time, they can extend the investigation to 90 days, but they must notify you in writing and must credit your account temporarily while they continue.
What if the fraudster used my card number but not my physical card?
The liability rules are the same — $0 if you report before the issuer finds it, up to $50 if they find it first. How the fraudster obtained your number does not change your protection. Report it to the issuer and to the FTC the same way.
Can I be held responsible for fraud that happened before I noticed?
Your liability depends on when you report, not when the fraud occurred. If you report within 60 days of the charge appearing on your statement, your liability is capped at $50. After 60 days, you may be liable for the full amount, so check your statements regularly.
Do I need to file a police report?
You do not need a police report to dispute the charges with your card issuer. However, if the fraud involved identity theft — meaning the fraudster opened accounts in your name or used your personal information — filing a police report creates an additional record. Include the police report number in your FTC Identity Theft Report.
What if my card issuer sides with the merchant?
If the issuer concludes the charge is legitimate, you can dispute it with the merchant directly and ask them to provide proof of authorization. You can also file a complaint with the Consumer Financial Protection Bureau or your state's attorney general, though these agencies do not overturn individual decisions.