Credit card fraud is when someone uses your card number, expiration date, or other payment information without your permission to make purchases or withdraw cash

Fraud can happen even if you still have your physical card in your wallet. A thief might use only your card number — obtained from a data breach, a skimmed ATM, a compromised website, or a stolen receipt — to buy things online or over the phone. They might also create a fake card with your number printed on it, or add your card to a digital wallet they control. The key is that you did not authorise the transaction.

Credit card fraud is different from identity theft, though the two often happen together. Identity theft means someone has stolen enough of your personal information — name, Social Security number, address, date of birth — to open new accounts in your name or take out loans. Fraud is narrower: it is the misuse of a payment method you already have. You can experience fraud without identity theft, and identity theft without fraud, though criminals often do both.

Key Takeaways

  • Fraudulent charges on your card are your card issuer's responsibility to investigate and reverse, not yours — you are protected by federal law from paying for unauthorised transactions.
  • Report fraud to your card issuer as soon as you notice it; the sooner you report, the faster they can freeze your account and investigate.
  • You should also file a report with the Federal Trade Commission at IdentityTheft.gov, which creates an official record and may help if the fraud is part of a larger identity theft scheme.
  • Common fraud sources include data breaches at retailers or websites, skimmed card readers at gas pumps or ATMs, phishing emails that trick you into giving out your card details, and lost or stolen physical cards.
  • Monitoring your statements regularly — at least monthly — is the fastest way to catch fraud before the thief makes many charges.

How fraudsters get your card information

Data breaches are the most common source. When a retailer, bank, airline, or other company storing card numbers gets hacked, criminals can steal thousands of card numbers at once. You may never know which company was breached; sometimes the breach is not discovered for months. Retailers like Target, Home Depot, and Equifax have all suffered major breaches that exposed customer payment information.

Skimming is a physical theft method. A criminal installs a hidden card reader on an ATM, gas pump, or payment terminal that copies your card number and PIN when you swipe or insert your card. The thief then uses that number to make fraudulent charges or sells it to other criminals. Skimmers are often hard to spot because they are designed to look like part of the machine.

Phishing is a social engineering attack. You receive an email, text, or call that appears to come from your bank or a company you use, asking you to "verify" your card details, confirm your account, or update your information. The link or phone number leads to a fake website or connects you to a scammer posing as customer service. If you enter your card number, expiration date, or CVV, the criminal has what they need.

Stolen or lost physical cards are straightforward: someone finds or steals your card and uses it before you notice it is gone. This is why reporting a lost card immediately matters.

What happens when fraud is reported

When you report a fraudulent charge to your card issuer, they open an investigation. The issuer contacts the merchant where the charge occurred and asks for proof that you authorised the transaction — usually a signature, PIN entry, or online login record. If the merchant cannot provide proof, the issuer reverses the charge and credits your account. This process typically takes 30 to 90 days, though many issuers credit your account within a few days while the investigation continues.

During the investigation, your card issuer may freeze your account or issue you a new card with a new number to prevent further fraud. They will also note the fraudulent charges in your account history so they can spot patterns — for example, if multiple charges appear in a city you have never visited, that is a red flag.

You are protected by the Fair Credit Billing Act, a federal law that limits your liability for unauthorised charges. If you report fraud before the charges post to your account, you owe nothing. If you report after they post, you owe a maximum of $50 per card, though most issuers waive even that if you report promptly. If you do not report within 60 days of the statement date, you may be liable for the full amount.

Steps to take if you notice fraudulent charges

First, contact your card issuer immediately — by phone, not email. Look for the number on the back of your card or on your statement; do not use a number from an email or text, as that could be a scam. Tell them which charges are fraudulent and ask them to freeze your account and issue a new card.

Second, file a report with the Federal Trade Commission at IdentityTheft.gov. This creates an official record of the fraud and generates an Identity Theft Report, which you can use to dispute fraudulent accounts or charges with other companies. The FTC also uses these reports to track fraud patterns and alert law enforcement.

Third, check your credit reports from all three bureaus — Equifax, Experian, and TransUnion — at AnnualCreditReport.com. Look for accounts you did not open or inquiries you did not authorise. If you find fraudulent accounts, dispute them with the bureau and the creditor. You can also place a fraud alert on your credit file, which tells lenders to verify your identity before opening new accounts in your name.

Fourth, monitor your statements closely for the next several months. Fraudsters sometimes make small test charges first to see if you notice, then make larger ones. Catching these early stops them from escalating.

Preventing fraud before it happens

Use strong, unique passwords for online shopping accounts and banking portals. A password manager like Bitwarden or 1Password can generate and store these for you. Never reuse passwords across sites, because if one site is breached, a criminal can use that password to access your other accounts.

Enable two-factor authentication on your bank and credit card accounts if your issuer offers it. This means you have to enter a code sent to your phone or generated by an app before you can log in or make changes, even if someone has your password.

Do not click links in unsolicited emails or texts, even if they look like they come from your bank. Instead, go directly to the company's website by typing the address into your browser, or call the number on your statement. Legitimate companies will never ask you to confirm your card number, CVV, or PIN by email or text.

Check your statements monthly, not just when you think there might be a problem. Many people only look at their statements once or twice a year, which means fraud can go undetected for months. Set a calendar reminder to review your statement on the same day each month.

Use your card's virtual card number feature if your issuer offers it. Services like Citi Virtual Account Numbers, Capital One Eno, or American Express Digital Secure Numbers generate a unique, temporary card number for each online purchase. If that number is stolen, it cannot be used anywhere else.

What to do if fraud is part of identity theft

If the fraudulent charges are accompanied by new accounts opened in your name — credit cards, loans, utilities, phone lines — you are dealing with identity theft, not just fraud. The steps are similar but more involved. File a report at IdentityTheft.gov, which will generate an Identity Theft Report you can use to dispute the fraudulent accounts with creditors and credit bureaus.

Contact each creditor or company where a fraudulent account was opened and tell them the account is fraudulent. Provide them with your Identity Theft Report. Ask them to close the account and remove it from your credit report. You may need to do this multiple times; some companies are slow to act.

Place a credit freeze with all three credit bureaus. A freeze prevents anyone, including you, from opening new accounts in your name without unfreezing first. It is free and takes about 15 minutes per bureau. You can freeze and unfreeze online at each bureau's website. A freeze is stronger than a fraud alert because it stops new accounts entirely, rather than just requiring verification.

Frequently Asked Questions

Am I responsible for paying fraudulent charges on my credit card?

No. Federal law limits your liability to $50 per card if you report fraud after charges post, and $0 if you report before they post. Most card issuers waive the $50 entirely if you report promptly. Your issuer is responsible for investigating and reversing unauthorised charges.

How long does it take to get my money back after I report fraud?

Many issuers credit your account within 3 to 5 business days while they investigate. The full investigation typically takes 30 to 90 days. If the merchant cannot prove you authorised the charge, the credit becomes permanent. If the merchant disputes the reversal, the issuer may remove the credit temporarily while they gather more evidence.

Can I still use my card while fraud is being investigated?

Your issuer may freeze your account to prevent further fraud, which means you cannot use the card. They will usually issue you a new card with a new number within 7 to 10 business days. You can ask them to expedite it if you need it sooner. In the meantime, you can use other payment methods or ask the issuer for a temporary card number.

What if the same fraudster uses my card again after I report it?

Report each new instance of fraud to your issuer. Each fraudulent charge is investigated separately. If you see a pattern — the same merchant, the same amount, the same time of day — mention it to your issuer, as it may help them identify the thief or catch them faster. If fraud keeps happening after you have received a new card, your issuer may investigate whether the breach is ongoing or if your information is being sold repeatedly.

Do I need to close my credit card account after fraud?

Not necessarily. Closing the account does not erase the fraud from your credit history, and it may actually hurt your credit score by reducing your available credit. Keep the account open if the issuer has resolved the fraud and issued you a new card. You can close it later if you want, but there is no benefit to closing it immediately.