How Credit Card Fraud Works and What to Do If It Happens to You

Credit card fraud is when someone uses your card number or account information without your permission to make purchases or withdraw cash

Fraud happens in two main ways. Card-present fraud occurs when someone physically has your card — they've stolen it from your wallet, found it, or taken it during a transaction. Card-not-present fraud happens online or over the phone when a thief uses only your card number, expiration date, and security code. They might get this information from a data breach at a store or website, from intercepting mail, or by tricking you into sharing it.

The good news: you are not responsible for fraudulent charges under federal law. Your card issuer — the bank or company that issued your card — must investigate and remove unauthorized charges from your account. The process usually takes 30 to 60 days, though many issuers resolve it faster.

Key Takeaways

• Federal law limits your liability for fraudulent charges to $50 if you report the fraud, and most card issuers waive even that amount.
• Call your card issuer immediately when you notice unauthorized charges; most have a fraud hotline available 24/7.
• Your issuer will cancel your current card and send a replacement, usually within 7 to 10 business days.
• Monitor your statements regularly — catching fraud early means faster resolution and less disruption to your accounts.
• Protecting your card number, never sharing your PIN or security code, and using secure websites reduces your fraud risk significantly.

How thieves get your card information

Thieves use several methods to obtain your card details. Skimming is when a device is placed on an ATM, gas pump, or card reader that copies your information when you swipe or insert your card. You may not notice anything wrong with the machine. Phishing involves fake emails or text messages that look like they're from your bank or a store, asking you to "verify" your account by clicking a link and entering your card number. The link takes you to a fake website designed to steal your information.

Data breaches at retailers and websites expose millions of card numbers at once. When a store's payment system is hacked, criminals gain access to cards used there during a specific time period. Dumpster diving — literally searching through trash — can turn up receipts, statements, or pre-approved credit offers with your name and partial card information. Mail theft is common too; thieves steal statements or new cards from mailboxes.

Social engineering is manipulation: a scammer calls pretending to be from your bank's fraud department and asks you to confirm your card number "to verify your identity." In reality, they're recording it. Never give your full card number, expiration date, or security code to anyone who calls you, even if they claim to be from your bank.

Signs that your card has been compromised

The most obvious sign is a charge you did not make. Check your statement for small test charges — fraudsters often make a $1 or $2 purchase first to see if the card works before making larger purchases. Look for charges from merchants you do not recognize, in locations you have never visited, or at times you know you were not shopping.

Other warning signs include a missing card from your wallet, a statement that arrives late or not at all, calls from collection agencies about accounts you never opened, or a credit report showing accounts or inquiries you do not recognize. If you receive a new card you did not request, or if your bank calls to confirm unusual activity, take it seriously. Your bank's fraud detection systems flag patterns — multiple charges in different cities within hours, or large purchases followed by cash withdrawals — so a call from them means something triggered their alert.

What to do immediately after discovering fraud

Call your card issuer right away. The phone number is on the back of your card or on your statement. Most issuers have a dedicated fraud line available 24/7. Have your card and a recent statement in front of you. Tell the representative which charges are fraudulent and when you first noticed them. Do not assume they already know — you are reporting it, and the date you report it matters for your protection under federal law.

The issuer will cancel your card and start an investigation. They will ask you questions about the fraudulent charges: Do you recognize the merchant? Were you traveling? Did you lose your card? Answer honestly. They are building a record. Request a new card and ask when it will arrive. Most take 7 to 10 business days, though some issuers offer expedited delivery.

Ask the issuer to send you a written confirmation of the fraud report. This creates a paper trail. Request the case number and the name of the representative you spoke with. Write down the date and time of your call. You may need this information later if a charge is not removed or if a merchant disputes the chargeback.

How the investigation works and how long it takes

Once you report fraud, your card issuer opens an investigation. They contact the merchant where the fraudulent charge occurred and request documentation — the receipt, the shipping address, the IP address if it was an online purchase. They compare this information to your account history. If you have never shopped at that merchant before, or if the shipping address is in a state you have never visited, that strengthens your case.

The investigation typically takes 30 to 60 days. During this time, the fraudulent charges remain on your statement, but most issuers place them in dispute status so they do not count against your credit. You are not required to pay disputed charges while the investigation is ongoing. However, you should still pay the rest of your bill on time to avoid late fees and credit damage.

Once the investigation concludes, the issuer removes the fraudulent charges from your account. You will receive written notice of the outcome. If the issuer rules against you — which is rare — you have the right to dispute that decision. Request the documentation they used to make their information and submit a written response explaining why you believe the charge was fraudulent.

Protecting yourself from card fraud going forward

Monitor your statements regularly. Many people check their credit card statement only once a month, but checking weekly or even after each purchase catches fraud faster. Set up account alerts through your card issuer's app or website. Most issuers let you choose alerts for purchases over a certain amount, purchases in specific categories, or any purchase made outside your home state. These alerts arrive by text or email within minutes of a charge.

Never share your card's security code — the three-digit number on the back — with anyone, even if they claim to be from your bank. Your bank already has this information and will never ask for it. The same applies to your PIN. Do not write these numbers down or store them in your phone. Do not use obvious PINs like your birth year or address.

When shopping online, use secure websites only. Look for "https://" at the start of the web address and a small padlock icon in the browser. Avoid entering your card information on public Wi-Fi networks; use your phone's data connection or a home network instead. Consider using a virtual card number for online shopping — many issuers offer this feature, which generates a temporary card number linked to your real account. If the virtual number is compromised, the thief cannot use it again.

Protect your physical card. Do not leave it unattended at restaurants, stores, or gas stations. When you hand your card to a cashier, watch them process it. At gas pumps and ATMs, inspect the card reader before inserting your card — if it looks loose or damaged, use a different machine. Shred receipts, statements, and pre-approved credit offers before throwing them away. Thieves can use partial information from these documents to commit fraud.

What happens to your credit if you are a fraud victim

Fraudulent charges do not damage your credit score if you report them promptly. The charges are disputed and removed from your account, so they never appear on your credit report. However, if fraud goes unnoticed for months and the issuer writes off the debt, it can appear on your credit report as a charge-off or collection account. This is why monitoring your statements matters — catching fraud early prevents this outcome.

If a thief opened new accounts in your name, that is identity theft, not just card fraud. New accounts appear on your credit report and damage your score. If you suspect identity theft, place a fraud alert on your credit file by contacting one of the three major credit bureaus — Equifax, Experian, or TransUnion. A fraud alert tells lenders to verify your identity before opening new accounts in your name. You can also place a credit freeze, which prevents anyone from opening accounts without your permission.

Frequently Asked Questions

Am I responsible for paying fraudulent charges while the investigation is happening?

No. Under federal law, you are not liable for unauthorized charges. While the investigation is ongoing, the charges remain on your statement but are marked as disputed. You should still pay the rest of your bill on time to avoid late fees, but you do not have to pay the disputed amount.

What if the merchant says I authorized the charge?

The merchant's claim does not override your fraud report. Your issuer investigates by looking at the transaction details — the shipping address, the device used, the timing, and your account history. If the evidence supports your claim that you did not authorize it, the charge is removed. If you genuinely did authorize it but forgot, you may need to withdraw your dispute.

How long does it take to get a replacement card?

Most issuers mail a replacement card within 7 to 10 business days. Some offer expedited shipping for an extra fee or at no charge if fraud is involved. Ask your issuer about rush delivery options. In the meantime, you can request a temporary card number or use a digital wallet like Apple Pay or Google Pay if your issuer supports it.

Can I get my money back if I already paid the fraudulent charge?

Yes. Report the fraud to your issuer, and they will investigate and refund the amount if they determine the charge was unauthorized. The refund is credited back to your account, usually within 30 to 60 days, though many issuers process it faster.

What should I do if I notice fraud on a card I closed?

Contact the issuer that issued the closed card. They still have a record of your account and can investigate charges that occurred before you closed it. Report the fraud as soon as you notice it, even if the card is no longer active. The issuer can still remove fraudulent charges and may refund them to your original payment method or issue a check.