How Payment Fraud Works and What to Do When It Happens to You

What payment fraud is and why it matters to you

Payment fraud is when someone uses your payment information—credit card number, bank account details, or digital wallet—without your permission to move money or make purchases. It can happen online, over the phone, in person, or through a compromised payment system. The person committing fraud may be a stranger who stole your information, a merchant who processes your payment, or someone with access to your accounts.

Fraud matters because it directly affects your money and your credit. When fraudulent charges appear on your account, you lose access to that cash immediately. If the fraud goes unchecked, it can damage your credit score, making it harder to borrow money later. The good news: federal law and your bank's policies limit how much you have to pay back, and there are clear steps to stop it.

Key Takeaways

• Contact your bank or card issuer the moment you notice a fraudulent charge—the faster you report it, the more protection you have under federal law.
• Your liability for unauthorized charges is capped at $50 on credit cards and $0 on debit cards if you report within two business days, but waiting longer can cost you more.
• Fraud can originate from a data breach at a merchant, a phishing email or text, a skimmed card, or someone with direct access to your account information.
• After reporting fraud, your bank will issue a new card and investigate the charges; most disputes are resolved within 10 business days, though complex cases take longer.
• You can reduce your fraud risk by monitoring statements regularly, using strong passwords, enabling two-factor authentication, and checking your credit report for accounts you did not open.

How fraudsters get your payment information

Fraud starts with access to your information. The most common sources are data breaches at merchants or payment processors—hackers break into a company's system and steal thousands of card numbers at once. You may never know which store or website was compromised. Another route is phishing: a fake email or text that looks like it comes from your bank or a trusted company, asking you to "verify" your account or click a link. If you enter your details on a fake website, the fraudster has them.

Skimming is a physical method: a device attached to an ATM, gas pump, or card reader captures your card number and PIN when you swipe. Fraudsters can also obtain your information from a lost or stolen wallet, from someone who sees you enter your PIN, or from a data broker who buys stolen information on the dark web. In some cases, fraud is internal—a cashier, customer service representative, or employee with access to your account uses it without permission.

A smaller but growing risk is synthetic identity fraud, where someone creates a fake identity using a mix of real and false information, often including your Social Security number. This type of fraud can take months to detect because it does not show up as unauthorized charges on your existing accounts.

Recognizing fraud on your account

The clearest sign of fraud is a charge you do not recognize on your bank or credit card statement. Look for small amounts—fraudsters often test stolen cards with $1 or $2 charges before attempting larger purchases. You may also notice charges from merchants in locations you have never visited, or purchases of items you would never buy.

Other red flags include missing mail (a fraudster may have changed your address to intercept statements), calls from debt collectors about accounts you never opened, or a credit report showing inquiries or accounts you did not authorize. If you receive a bill for a service you cancelled, or if your online banking password no longer works, someone may have taken control of your account.

The sooner you spot fraud, the better. Check your statements at least monthly—weekly is safer if you use your card frequently. Set up account alerts through your bank's app or website so you are notified of large charges, unusual activity, or login attempts from new devices.

What to do immediately after discovering fraud

Call your bank or card issuer right away. Do not email or use online chat for the initial report—a phone call creates a record and lets you speak to someone who can freeze your account immediately. Have your card number and a list of fraudulent charges ready. The representative will ask you to confirm your identity, describe the unauthorized transactions, and explain how you discovered them.

Your bank will cancel your current card and issue a replacement, usually within 5 to 10 business days. In the meantime, ask whether they can issue a temporary card number for online purchases or a paper check for urgent bills. Request a written confirmation of your fraud report—you will need this for your records and for any follow-up disputes.

Next, place a fraud alert on your credit report. Call one of the three major credit bureaus (Equifax, Experian, or TransUnion) and request a fraud alert. By law, that bureau must notify the other two within 24 hours. A fraud alert tells creditors to verify your identity before opening new accounts in your name. The alert lasts one year and is free. If you believe your Social Security number was compromised, you can also request a credit freeze, which prevents anyone—including you—from opening new accounts until you lift it.

How banks investigate fraud and resolve disputes

Once you report fraud, your bank opens an investigation. They review the transaction details, check the merchant's records, and look for patterns in how the fraudster used your information. They may contact the merchant directly to confirm whether the charge was legitimate. This process typically takes 10 business days, though complex cases involving multiple merchants or large amounts can take up to 45 days.

During the investigation, the bank may provisionally credit your account—meaning they return the money while they investigate—or they may ask you to wait for the outcome. Federal law requires banks to credit your account within two business days if you reported the fraud within two days of discovering it. If you waited longer, the timeline extends, and your liability increases.

Once the investigation concludes, the bank will notify you in writing of the outcome. If they determine the charge was fraudulent, they remove it permanently and you owe nothing. If they determine it was authorized—perhaps because you made the purchase yourself or gave someone permission—they will explain their reasoning. You have the right to dispute their decision in writing within 10 days.

Your legal protection against fraud

Federal law caps your liability for unauthorized charges. On credit cards, you are responsible for no more than $50 per card, and only if the card issuer can prove you were negligent. On debit cards, your liability depends on when you report the fraud: if you report it within two business days, you owe no more than $50; if you report it between two and 60 days, you owe up to $500; if you wait more than 60 days, you may owe the full amount.

In practice, most major banks and card issuers waive your liability entirely, even if you do not report fraud immediately. They do this to retain customers and because investigating fraud is cheaper than fighting disputes. However, this is a courtesy, not a legal may provide. The sooner you report, the stronger your legal position.

If your bank refuses to remove fraudulent charges and you believe they are wrong, you can file a complaint with the Consumer Financial Protection Bureau (CFPB) or your state's banking regulator. You can also dispute the charges through your credit card company's chargeback process, which forces the merchant to prove the charge was legitimate.

Reducing your fraud risk going forward

Monitor your statements regularly—at least monthly, ideally weekly. Set up account alerts for transactions over a certain amount, unusual merchants, or login attempts from new devices. Most banks offer these alerts free through their app or website.

Use strong, unique passwords for each online account, especially banking and email. A strong password has at least 12 characters and mixes uppercase and lowercase letters, numbers, and symbols. A password manager like Bitwarden or 1Password can generate and store these for you. Enable two-factor authentication (2FA) on your bank account and email—this requires a second form of verification, like a code from an app or text message, even if someone has your password.

Be cautious with unsolicited emails, texts, and calls. Your bank will never ask you to confirm your password, Social Security number, or full card number via email or text. If you receive a suspicious message, do not click links or download attachments. Instead, go directly to your bank's website or call the number on the back of your card.

When making purchases, use a credit card rather than a debit card when possible—credit cards offer stronger fraud protection. At physical stores, watch the cashier process your card and never let it out of your sight. At ATMs and gas pumps, inspect the card reader for loose parts or signs of tampering before inserting your card. Shred documents with account numbers, Social Security numbers, or other sensitive information before throwing them away.

What happens if fraud affects multiple accounts or your identity

If you discover fraudulent accounts opened in your name—credit cards, loans, utilities, or phone lines—the situation is more complex. This is identity theft, a broader crime than simple payment fraud. You will need to contact each creditor and merchant directly to report the fraud and request that the accounts be closed.

File a report with the Federal Trade Commission (FTC) at IdentityTheft.gov. This creates an official record and generates a recovery plan tailored to your situation. You can also file a police report, which some creditors require before removing fraudulent accounts from your credit report.

Request a full credit report from all three bureaus (AnnualCreditReport.com provides free reports once per year). Look for accounts, inquiries, and addresses you do not recognize. Dispute any fraudulent items directly with the credit bureau in writing—include copies of your FTC report and police report if you filed one. The bureau must investigate within 30 days and remove items that cannot be verified.

Frequently Asked Questions

How long do I have to report fraud before I lose protection?

For credit cards, you have no legal deadline, but reporting within 60 days keeps your liability at $50 or less. For debit cards, report within two business days to limit your liability to $50; waiting longer can cost you up to $500 or more. Most banks offer better protection than the law requires, but do not rely on that—report as soon as you notice.

Will I get my money back if the bank finds fraud?

Yes, if the bank determines the charge was unauthorized, they must remove it. Most banks credit your account within two business days of your report, even while investigating. If the investigation takes longer, you may see the credit as "provisional" until it is finalized, usually within 10 business days.

Can I be held responsible if someone I know committed the fraud?

If you gave someone permission to use your card and they exceeded that permission, the situation is murky legally. If you explicitly authorized the purchase, it is not fraud. If you authorized them to use your card for one thing and they used it for another, report it as fraud—your bank will investigate and make a information based on the evidence.

What should I do if my bank denies my fraud claim?

Request a written explanation of why they denied it. If you disagree, file a complaint with the Consumer Financial Protection Bureau (CFPB) at consumerfinance.gov or contact your state's banking regulator. You can also dispute the charge through your credit card company's chargeback process, which forces the merchant to prove the charge was legitimate.

Does fraud affect my credit score?

Fraudulent charges themselves do not directly damage your credit score—they are removed once confirmed as fraud. However, if a fraudster opened accounts in your name and missed payments on those accounts, those missed payments will appear on your credit report and hurt your score. That is why checking your credit report and disputing fraudulent accounts quickly is important.