How Credit Card Theft Works and What Happens When It Does

Credit card theft is when someone uses your card number or account information without your permission to make purchases or withdraw cash

The thief doesn't always need the physical card. They can steal just the number — from a data breach, a skimmed ATM, a phishing email, or even by watching you type at a checkout. Once they have the number, expiration date, and CVV (the three-digit code on the back), they can shop online or by phone. If they have more information — your name, address, and Social Security number — they might open new accounts in your name, a crime called identity theft.

The good news is that federal law limits what you owe. Under the Fair Credit Billing Act, your liability for unauthorized charges stops at $50 per card, and most card issuers waive that entirely if you report the theft quickly. The catch is that you have to notice and report it, and the faster you do, the better protected you are.

Key Takeaways

• A thief needs only your card number, expiration date, and CVV to make online or phone purchases — they don't need the physical card.
• Federal law caps your personal liability at $50 per card for unauthorized charges, and most issuers waive that fee if you report theft within 60 days.
• Reporting theft to your card issuer immediately stops new charges and starts an investigation, but you must act within 60 days to get full protection.
• Debit card theft is riskier than credit card theft because the money comes directly from your bank account, and your liability protection is weaker if you wait to report it.
• Monitoring your statements monthly and setting up fraud alerts with the credit bureaus can catch theft early, before the thief runs up large charges.

How thieves get your card number

Data breaches are the most common source. A retailer, restaurant, or hotel's payment system gets hacked, and thousands of card numbers leak at once. You might not know your number was stolen until you see a charge you didn't make. Skimming — a device placed on an ATM or gas pump that reads your card as it slides through — is another common method. Phishing emails that look like they're from your bank, asking you to "verify" your account, trick you into typing your number on a fake website.

Thieves also buy stolen card numbers on the dark web, sometimes for just a few dollars. They test the numbers with small purchases first — a $1 charge to see if it goes through — then move to bigger purchases if it works. Some thieves go old-school: they watch you enter your PIN at a checkout, or they steal your physical card from your wallet or mailbox.

What happens when you report the theft

Call your card issuer's fraud line immediately. The number is on the back of your card or your statement. Tell them which charges are not yours. The issuer will cancel your card and send a replacement, usually within 5 to 10 business days. They'll also start an investigation into the unauthorized charges.

During the investigation, the issuer will contact the merchants where the charges occurred and ask for proof that you authorized them. If the merchant can't prove you did, the charge gets reversed — the money comes back to your account. Most investigations wrap up within 30 to 90 days, though complex cases can take longer. While the investigation is open, you don't have to pay the disputed charges.

Follow up your phone call with a written dispute letter. Send it to the address on your statement, not the customer service number. Include your account number, the date you called, the name of the person you spoke to, and a list of the unauthorized charges. Keep a copy for your records. This creates a paper trail and resets the clock on your 60-day reporting window if needed.

Why credit cards are safer than debit cards for theft

When someone uses your credit card fraudulently, they're borrowing the card issuer's money, not yours. The issuer has the incentive to investigate and reverse the charge quickly. You're also protected by federal law from day one — your liability is capped at $50, and most issuers waive it.

With a debit card, the thief is taking money directly from your bank account. That's your money, not the bank's, so the bank has less urgency to act. Your liability protection is also weaker: if you report the theft within two business days, you're liable for only $50. But if you wait more than 60 days to report it, you could lose everything in the account. The money is also gone immediately, which can bounce checks or cause overdraft fees while the bank investigates.

Steps to take right after discovering theft

First, call your card issuer and report the unauthorized charges. Have your statement in front of you so you can list each fraudulent charge by date and amount. Ask the issuer to cancel the card and send a replacement. Request a case number for your records.

Second, place a fraud alert with the three credit bureaus — Equifax, Experian, and TransUnion. You only need to call one bureau; they'll notify the other two. A fraud alert tells creditors to verify your identity before opening new accounts in your name. It's free and lasts one year. You can renew it annually if you want ongoing protection.

Third, check your credit reports at annualcreditreport.com (the only free, official site). Look for accounts you didn't open or inquiries from creditors you didn't contact. If you find fraudulent accounts, dispute them with the bureaus and the creditors directly.

Fourth, monitor your statements closely for the next few months. Thieves sometimes make small charges to test whether the card is still active. Catch these early and report them immediately.

How to reduce your risk of card theft

Check your statements monthly — online or by mail — and report anything unfamiliar within 60 days. Many people wait for the paper statement to arrive, which can delay reporting by weeks. Set up online account access and review charges as soon as they post.

Use chip readers when available. Chip technology (the small square on newer cards) is harder to counterfeit than the magnetic stripe. Online, shop only on secure websites — the URL should start with "https://" and show a padlock icon. Never enter your card number on a website that doesn't look official or that you reached through an email link.

Don't carry your Social Security number in your wallet, and don't write your PIN on your card. When you're done with a card, cut it up before throwing it away. Be cautious with receipts — they show your card number (usually partial) and should be shredded or kept secure. At restaurants and stores, keep your card in sight during the transaction, or use contactless payment (tap or phone) when available.

Consider setting up purchase alerts with your card issuer. Many issuers let you choose a dollar amount — say, $100 — and they'll text or email you whenever a charge exceeds it. This catches large fraudulent purchases before they rack up.

What to do if your card is lost or stolen

If you lose the physical card, call your issuer immediately, even if you don't see unauthorized charges yet. A thief might wait days or weeks before using it. The issuer will cancel it and send a replacement. You're not liable for charges made after you report the card missing, as long as you report it before the thief uses it.

If your card is stolen along with other documents — like your ID or utility bills — the risk is higher. A thief with your name, address, and card number can open new accounts. Place a fraud alert and monitor your credit reports closely. If you see new accounts you didn't open, file a report with the Federal Trade Commission at identitytheft.gov and with your local police. Keep copies of the report; creditors often want to see it before they'll remove fraudulent accounts.

Frequently Asked Questions

Can I get my money back if I don't report the theft within 60 days?

It depends on your card issuer's policy. Federal law protects you only if you report within 60 days of receiving your statement. After 60 days, the issuer can hold you liable for the full amount. However, many issuers extend protection beyond 60 days as a courtesy — call and ask. The sooner you report, the stronger your position.

Will I get a new card number or the same number?

You'll get a new card number. The issuer cancels the old card entirely and issues a replacement with a different number. This prevents the thief from using the old number again. You'll need to update any recurring charges (subscriptions, gym memberships, autopay bills) with the new number once the card arrives.

What if the thief opened a credit card account in my name?

This is identity theft, not just card theft. File a report with the Federal Trade Commission at identitytheft.gov and with your local police. Contact the creditor that opened the fraudulent account and tell them it was opened without your permission. Ask them to close it and provide written confirmation. Dispute the account with the credit bureaus. Place a credit freeze with all three bureaus to prevent the thief from opening more accounts.

Do I have to pay interest on fraudulent charges while the investigation is happening?

No. Federal law says you don't have to pay the disputed amount or any interest or fees related to it while the issuer investigates. Once the investigation concludes and the charge is reversed, you owe nothing. If the issuer finds the charge was authorized after all, they'll notify you in writing and you'll owe the amount from that point forward.

Can I use my card while the fraud investigation is open?

Your old card is canceled, so you can't use it. Your replacement card should arrive within 5 to 10 business days. In the meantime, you can use other payment methods — another credit card, debit card, or digital wallet. Some issuers offer temporary card numbers or digital card access while you wait for the physical replacement.