Credit cards limit what you owe if someone uses your card without permission

When fraud occurs on a credit card, federal law caps your liability at $50 — and most card issuers waive that entirely if you report the fraud before the charge posts. This is fundamentally different from a debit card, where the money leaves your account immediately and you have to fight to get it back. With a credit card, the issuer's money is at risk first, not yours, which gives them strong incentive to investigate quickly and reverse charges.

The protection applies to any unauthorized use: a stolen card number used online, a physical card taken from your wallet, or fraudulent charges appearing on your statement from a source you never authorized. You do not have to prove you were careful or that the fraud was not your fault. The law protects you regardless.

Key Takeaways

  • Federal law limits your liability to $50 for unauthorized credit card charges, and most issuers waive this fee if you report fraud before the charge posts.
  • You must report unauthorized charges within 60 days of the statement date to keep the $50 cap; after that window, you may owe the full amount.
  • Credit card issuers investigate fraud claims and typically reverse charges within two billing cycles while they investigate.
  • Fraud monitoring systems flag suspicious activity automatically, and many issuers contact you to confirm large or unusual purchases before they post.
  • Debit cards and bank transfers lack these protections, making credit cards the safer payment method for transactions where fraud risk exists.

How the 60-day reporting window works

The moment you spot an unauthorized charge, you have 60 days from the date your statement was mailed or made available to report it. This is the hard deadline. If you report within that window, the $50 cap applies and the issuer must investigate. If you report after 60 days, you lose the federal protection and may owe the full fraudulent amount.

Most card issuers let you report fraud online, by phone, or through their mobile app. When you report, the issuer typically freezes your account, cancels the card, and sends a replacement. They will ask you to confirm which charges are fraudulent and which are legitimate. Write down the date and time you reported, the name of the person you spoke with (if by phone), and any confirmation number they provide — you may need this if the investigation takes longer than expected.

The issuer then has up to two billing cycles (roughly 60 days) to investigate and either reverse the charge or explain why they believe it was authorized. During this time, the disputed amount does not have to be paid, though it may appear on your statement as "disputed" or "under investigation."

Fraud monitoring systems that catch suspicious activity before you do

Credit card issuers run automated systems that flag transactions that do not match your normal spending pattern. A charge from a country you have never visited, a purchase five times larger than your average transaction, or multiple charges within minutes of each other can trigger a hold or a call from the issuer asking you to confirm the purchase.

These systems are not perfect — they sometimes block legitimate charges, which is why you may get a call asking "Did you just buy a plane ticket to Denver?" — but they catch many fraudulent transactions before they post to your account. If the issuer contacts you and you confirm the charge is legitimate, it goes through. If you say no, the issuer blocks it and may send you a new card.

Some issuers also offer real-time alerts via text or email whenever a charge posts, letting you spot fraud the moment it happens rather than waiting for your monthly statement. Check your card issuer's app or website to see what alerts are available and turn on the ones that matter to you.

What happens during a fraud investigation

Once you report a charge as fraudulent, the issuer contacts the merchant and the payment network (Visa, Mastercard, American Express, or Discover) to gather evidence. They ask the merchant for proof that you authorized the charge — a signature, a PIN entry, an IP address match, or shipping confirmation. If the merchant cannot provide convincing proof, the issuer reverses the charge and credits your account.

If the merchant does provide proof of authorization, the issuer may side with them and deny your dispute. This is rare when the charge is truly fraudulent, because fraudsters rarely have legitimate proof. But it can happen if, for example, someone in your household made the charge and the merchant has your shipping address on file.

The issuer must notify you of the investigation outcome in writing. If they reverse the charge, the credit appears on your next statement. If they deny the dispute, they explain their reasoning and tell you how to escalate the complaint if you disagree.

Why credit cards are safer than debit cards for fraud

A debit card draws money directly from your bank account. If someone uses your debit card fraudulently, that money is gone immediately. You have to contact your bank and file a dispute, but while the investigation happens — which can take weeks — you are without that money. If you need it to pay rent or buy groceries, you are stuck.

A credit card is the issuer's money, not yours. When fraud occurs, the issuer investigates and reverses the charge, and you never owe anything. You keep your money in your account the whole time. This is why financial advisors recommend using a credit card for online purchases, travel, and any transaction where the merchant is unfamiliar — the fraud protection is built in.

Debit cards do have some federal protection under the Electronic Funds Transfer Act, but the rules are weaker and the timelines are longer. If you report debit card fraud within two business days, your liability is capped at $50. If you report after two business days but within 60 days, you may owe up to $500. After 60 days, you may owe the full amount. Credit cards offer the same $50 cap regardless of when you report, as long as it is within 60 days.

Steps to take if you notice unauthorized charges

First, contact your card issuer immediately — do not wait for the next statement. Call the number on the back of your card or log into your online account and report the fraud through the secure messaging system. Have your card and statement handy so you can describe the unauthorized charges clearly.

Second, ask the issuer to cancel your current card and send a replacement. Do not use the card for new purchases until you receive the replacement, because the fraud may still be active.

Third, monitor your credit report for the next few months. If someone has your card number, they may also have other personal information. Check your credit report at annualcreditreport.com (the free, official source) to see if anyone has opened new accounts in your name. If they have, contact the credit bureaus and place a fraud alert on your file.

Fourth, change passwords for any online accounts where you used that card, especially banking and email. If a fraudster has your card number, they may have other login credentials too.

Frequently Asked Questions

Do I have to pay the fraudulent charge while the investigation is happening?

No. Once you report the charge as unauthorized, you do not have to pay it while the issuer investigates. The charge may appear on your statement as "disputed" or "under investigation," but it does not count against your credit limit or your payment due date. Pay the rest of your bill as normal.

What if the issuer says the charge was authorized and I disagree?

You can escalate the dispute. Ask the issuer for the evidence they used to conclude the charge was authorized — the signature, the IP address, the shipping address, whatever they have. If you can show that evidence is forged or does not match you, you have grounds to push back. Some issuers have a second-level dispute process; others may require you to file a complaint with the Consumer Financial Protection Bureau.

Can I get my money back if I report fraud after 60 days?

You lose the federal $50 liability cap, but you can still try to dispute the charge. Contact your issuer and explain what happened. Some issuers will reverse charges even outside the 60-day window if the fraud is clear, but they are not required to. The sooner you report, the better your chances.

Does fraud protection apply to online purchases from small merchants?

Yes. The protection applies to any charge on your credit card, regardless of the merchant's size or whether they are online or in person. The issuer investigates the same way whether you were defrauded by a major retailer or a small business.

What if someone uses my credit card number but I still have my physical card?

That is one of the most common types of fraud — someone obtained your card number through a data breach, a skimmed card reader, or a phishing email, but your physical card was never stolen. Report it the same way: contact your issuer, report the unauthorized charges, and ask for a replacement card. The issuer will cancel your current card number and issue a new one.