How Credit Card Numbers Get Stolen and What Happens Next

Thieves use stolen credit card numbers to make purchases before you notice

When someone steals your credit card number, they typically use it to buy things online or over the phone within hours — before you've noticed the card is missing or the number is compromised. They may test the number with a small purchase first, then make larger ones if it works. Some thieves sell the number to other criminals instead of using it themselves. Either way, the goal is to extract money from your account before the fraud is caught.

The good news is that you are not responsible for fraudulent charges on a credit card once you report them. Federal law caps your liability at $50, and most card issuers waive even that if you report the theft promptly. The process of disputing the charges and getting your money back is straightforward, though it does require you to act quickly and document what happened.

Key Takeaways

• Stolen credit card numbers are used for online purchases, phone orders, or resold to other criminals within hours of being compromised.
• You are protected by federal law from paying for fraudulent charges if you report them to your card issuer within 60 days.
• Contact your card issuer immediately by calling the number on the back of your card or your statement — not a number from an email or text.
• Your card issuer will cancel the card, send you a replacement, and investigate the fraudulent charges while you dispute them in writing.
• Monitor your statements for at least three months after fraud to catch any delayed charges or identity theft attempts.

How thieves obtain credit card numbers in the first place

Credit card numbers are stolen through several common routes. Data breaches at retailers, restaurants, or hotels expose thousands of card numbers at once when hackers break into company databases. Skimming devices attached to ATMs or gas pumps read your card when you swipe it. Phishing emails or texts trick you into entering your number on a fake website. Mail theft, dumpster diving for receipts, and simply watching over your shoulder at checkout are older methods that still work.

Once stolen, your number often ends up in an underground marketplace where criminals buy and sell batches of card data. A single stolen card number might sell for a few dollars to $50 depending on how much information comes with it — whether the thief also has your name, expiration date, and security code. The longer the delay between theft and discovery, the more damage a thief can do.

What to do immediately if you suspect fraud

Call your card issuer right now using the number on the back of your card or your most recent statement. Do not use a number from an email, text, or website — scammers often send fake fraud alerts with numbers that route to them instead. When you reach your issuer, tell them which charges are fraudulent and ask them to cancel the card immediately.

Your issuer will send you a replacement card, usually within 5 to 10 business days. They will also start an investigation into the fraudulent charges and typically remove them from your account within one to three billing cycles while they investigate. You do not have to pay those charges while the dispute is pending. Ask your issuer for a case number and the name of the person handling your dispute so you have a reference point.

How to document and dispute fraudulent charges in writing

After you call, send a written dispute to your card issuer within 60 days of the fraudulent charge appearing on your statement. Most issuers accept disputes by mail, email, or through their online account portal. Include your account number, the date and amount of each fraudulent charge, and a brief description of why it is fraudulent — for example, "I did not make this purchase and did not authorize this merchant."

Keep copies of everything you send. Your issuer is required by the Fair Credit Billing Act to acknowledge your dispute in writing within 30 days and to resolve it within two billing cycles (usually 60 days). If they find the charge was indeed fraudulent, it will be removed permanently and you will not owe it. If they find it was authorized, they will explain why and you can dispute it again if you disagree.

Protecting yourself from future fraud

Sign up for free fraud alerts through the three major credit bureaus — Equifax, Experian, and TransUnion. A fraud alert tells creditors to verify your identity before opening new accounts in your name, which slows down identity theft. You can place a fraud alert by contacting any one of the three bureaus, and it lasts one year (you can renew it). The process takes about 15 minutes online.

Monitor your credit reports for accounts you did not open. You can view your reports free once per year at AnnualCreditReport.com, which is the official site run by the three bureaus. Check for new credit cards, loans, or other accounts opened in your name. If you find unauthorized accounts, contact the creditor and the credit bureaus immediately to have them removed.

When to consider a credit freeze or lock

A credit freeze prevents anyone — including you — from opening new accounts using your Social Security number without a PIN you set. It is free and lasts until you remove it. A credit lock is similar but managed by the credit bureau and can be toggled on and off through an app. Freezes are stronger because they require a PIN; locks can sometimes be removed by customer service without verification.

You do not need a freeze after a single fraudulent charge on an existing card. A freeze is most useful if your Social Security number has been stolen or if you discover accounts opened in your name. Place a freeze by contacting each of the three bureaus separately — Equifax, Experian, and TransUnion — through their websites. You will receive a PIN to unfreeze your credit when you need to open a new account.

What happens if you ignore fraudulent charges

If you do not report fraudulent charges within 60 days of the statement date, you lose your federal protection and may be held responsible for the full amount. Your card issuer may also refuse to investigate or remove the charges. Additionally, if fraudulent charges go unreported, the thief may continue using your number or sell it to others, leading to more fraud on the same account or identity theft.

Ignoring fraud also makes it harder to prove later that you were a victim. If the thief uses your information to open new accounts or take out loans in your name, you will have a harder time disputing those accounts without documentation of the original fraud. Report it as soon as you notice it, even if you are not sure whether the charge is fraudulent — your issuer can help you figure that out.

Frequently Asked Questions

Am I responsible for paying fraudulent charges on my credit card?

No. Federal law limits your liability to $50 if you report the fraud within 60 days of the statement date. Most card issuers waive even the $50 and cover the full amount. You are not responsible for charges you did not authorize once you report them to your issuer.

How long does it take to get fraudulent charges removed?

Your issuer must acknowledge your dispute within 30 days and resolve it within two billing cycles, usually 60 days total. Many issuers remove the charges within one to three weeks while they investigate. You do not have to pay the disputed amount while they investigate.

What if the thief used my card number at a store in person?

Call your card issuer the same way — they will cancel the card and investigate. If the thief used a counterfeit card with your number, the store's security cameras may have footage. Your issuer will handle the investigation; you just need to report it and dispute the charges in writing.

Can I get a new card number without closing my account?

Yes. When you report fraud, your issuer will cancel the compromised card and send you a replacement with a new number. Your account stays open and active. Any recurring charges (subscriptions, autopay bills) linked to the old number will need to be updated with your new card number.

Should I close my credit card after fraud?

You do not have to close the account, but you can if you want to. Closing it does not hurt your credit score as much as it used to, but keeping the account open with a zero balance actually helps your credit score slightly. Ask your issuer whether closing is necessary or if simply canceling the card is enough.