Credit card fraud is when someone uses your card number or account information without your permission to make purchases or withdraw money

Credit card fraud happens in two main ways. Card-present fraud occurs when a physical card is stolen or lost and used in person or online. Card-not-present fraud happens when someone obtains your card number, expiration date, and security code — usually through a data breach, phishing email, or a compromised website — and uses it to buy things or transfer money without ever holding the card itself.

The person committing the fraud might be a stranger who found your card, a data thief who breached a retailer's system, or someone with access to your information like a family member or employee. The damage ranges from a single unauthorized charge to thousands of dollars in fraudulent purchases, depending on how long the fraud goes undetected.

Key Takeaways

  • Card-present fraud involves a physical card being stolen or lost; card-not-present fraud uses only your card number and security information.
  • Fraudsters obtain card details through data breaches, phishing emails, skimming devices, or by stealing mail containing card offers or statements.
  • You are not responsible for unauthorized charges if you report them to your card issuer within the timeframe required by federal law, usually 60 days.
  • Monitoring your statements regularly and setting up transaction alerts can catch fraud within days rather than months.
  • Freezing your credit with the three major bureaus stops fraudsters from opening new accounts in your name, even if they have your card number.

How fraudsters get your card information

Data breaches are the most common source. When a retailer, bank, or other business is hacked, criminals gain access to thousands of card numbers at once. These stolen numbers are then sold on the dark web or used directly to make purchases. Major breaches at retailers, hotels, and payment processors have exposed millions of card numbers over the past decade.

Phishing emails and texts trick you into entering your card details on a fake website that looks like your bank or a retailer you trust. The fraudster then has your number and can use it immediately. Skimming devices — small machines attached to ATMs or gas pump card readers — capture your card number and PIN when you swipe. Dumpster diving and mail theft target physical statements, card offers, and pre-approved credit applications that contain enough information to open fraudulent accounts.

Social engineering is simpler: a fraudster calls your card issuer pretending to be you, answers security questions using information from social media or public records, and requests a new card sent to a different address. Family members or employees with access to your wallet, purse, or desk can steal the card directly.

The difference between fraud and unauthorized charges

Fraud is the criminal act of using someone else's card or information without permission. Unauthorized charges are the result — the specific purchases or withdrawals that appear on your statement. When you report fraud to your card issuer, you are reporting unauthorized charges and asking the issuer to investigate and reverse them.

Not every charge you don't recognize is fraud. Sometimes a charge appears under a business name you don't immediately recognize, or a subscription you forgot you signed up for continues to bill you. These are still unauthorized if you did not permit them, and you can dispute them the same way you would report fraud — by contacting your card issuer and describing what happened.

What federal law says you owe

Under the Fair Credit Billing Act, you are not responsible for unauthorized charges on a credit card if you report them to your card issuer within 60 days of the charge appearing on your statement. Your liability is capped at $50 per card, and most major card issuers waive even that $50 if you report fraud promptly.

Debit cards have weaker protections. If you report unauthorized debit card charges within two business days, your liability is capped at $50. If you wait longer than two business days but report within 60 days, you may owe up to $500. After 60 days, you may owe the full amount. This is why monitoring your debit card statements closely matters more than with credit cards.

The card issuer has 30 days to investigate your report and either reverse the charges or explain why they believe the charges were authorized. During the investigation, the issuer must remove the disputed amount from your bill so you do not have to pay it while they investigate.

Signs that your card has been compromised

Charges you do not recognize on your statement are the clearest sign. Look for small test charges — fraudsters often make a $1 or $2 purchase first to confirm the card works before making larger purchases. Missing your physical card, receiving a statement for a card you did not request, or being denied credit when you know your score is good can all indicate fraud.

Calls from debt collectors about accounts you never opened mean someone has used your information to open new credit accounts. Receiving bills or statements for accounts in your name that you did not create is a sign of identity theft, which is often paired with credit card fraud. If your credit report shows accounts, inquiries, or addresses you do not recognize, fraud may be underway.

Steps to take if you discover fraud

Contact your card issuer immediately — by phone, not email. Most card companies have a fraud hotline number on the back of your card or on your statement. Tell them which charges are unauthorized and provide the dates and amounts. The issuer will cancel your card and issue a replacement, usually within 5 to 10 business days.

Request a written confirmation of your fraud report. This creates a record in case you need to dispute charges later or if the issuer claims you never reported it. Ask the issuer to send you a new card with a different number and to confirm that no new accounts have been opened in your name.

Check your credit report with all three bureaus — Equifax, Experian, and TransUnion — to see if fraudsters have opened accounts in your name. You can order free reports at annualcreditreport.com. If you find fraudulent accounts, file a report with the Federal Trade Commission at identitytheft.gov and provide that report number to your card issuer and the credit bureaus.

Consider placing a fraud alert or credit freeze with the three bureaus. A fraud alert tells lenders to verify your identity before opening new accounts in your name. A credit freeze prevents anyone, including you, from opening new accounts until you temporarily lift it. Freezes are stronger protection but require you to unfreeze your credit when you want to open a legitimate account.

Monitoring and prevention

Review your statement every month, either online or on paper. Many frauds are caught within the first 30 days because the cardholder noticed a charge they did not make. Set up transaction alerts through your card issuer's app or website so you receive a notification by text or email each time your card is used. This catches fraud within hours rather than weeks.

Use a credit card rather than a debit card for online purchases and in unfamiliar places. Credit cards have stronger fraud protections and do not directly drain your bank account while the issuer investigates. Never share your card number, expiration date, or security code by email, text, or phone unless you initiated the contact and you are certain you are speaking to your card issuer.

Avoid using public Wi-Fi to access your bank account or make purchases. Use a VPN if you must, or wait until you are on a secure home network. Shred physical statements and credit card offers before throwing them away. Do not carry your Social Security number in your wallet, and do not write your PIN on your card.

Frequently Asked Questions

Can I be held responsible for fraudulent charges if I did not report them right away?

For credit cards, you have up to 60 days from when the charge appears on your statement to report it. After 60 days, you may lose your protection. For debit cards, report within two business days to cap your liability at $50; after that, your liability can climb to $500 or more. The sooner you report, the better.

What happens if my card issuer says the charges were authorized?

You can dispute their decision. Ask the issuer in writing to explain how they determined the charges were authorized. If you still disagree, you can file a complaint with the Consumer Financial Protection Bureau or your state's banking regulator. Keep all documentation of your dispute.

Will I get my money back?

Yes, if the issuer confirms the charges were unauthorized. The issuer reverses the charges, and you do not owe them. This process usually takes 30 to 90 days. During the investigation, the disputed amount is removed from your bill so you do not have to pay it while waiting.

Does fraud on my credit card hurt my credit score?

Fraudulent charges themselves do not hurt your score. However, if fraudsters open new accounts in your name and those accounts fall behind on payments, your score can drop significantly. This is why checking your credit report and placing a freeze or alert matters.

What is the difference between a fraud alert and a credit freeze?

A fraud alert requires lenders to verify your identity before opening accounts but does not stop them from doing so. A freeze blocks new accounts entirely until you lift it. Freezes are stronger but require you to unfreeze temporarily when you want to open legitimate accounts. Both are free.