How charges appear on your card when you never handed it over

Someone can use your credit card without physically holding it because the card number is the only thing they need. The physical card itself is just a way to carry that 16-digit number, the expiration date, and the three-digit security code on the back. If a person obtains those details through a data breach, a skimming device, a phishing email, or by watching you enter it, they can make purchases online, over the phone, or at a self-checkout terminal without ever seeing the card.

The card issuer does not verify that the person using the card is the cardholder — they verify only that the card number, expiration date, and CVV match their records. For online purchases, no signature is required. For phone orders, the merchant simply reads back the number to confirm. At a self-checkout, the card never leaves your sight but the reader still processes the full number. This is why card-not-present fraud is one of the most common types of credit card theft.

Key Takeaways

  • A thief needs only your card number, expiration date, and CVV — not the physical card — to make purchases online, by phone, or at self-checkout terminals.
  • Data breaches at retailers, restaurants, and websites expose millions of card numbers each year; your card may have been compromised even if you never noticed unusual activity.
  • Fraudulent charges typically appear within days, though some thieves test small amounts first before making larger purchases.
  • Disputing unauthorized charges with your card issuer is free and does not require you to pay the disputed amount while the investigation is underway.
  • Freezing your credit with the three major bureaus prevents someone from opening new accounts in your name, even if they have your card number.

The most common ways your card number gets stolen

A data breach is the largest source of stolen card numbers. When a retailer, restaurant, hotel, airline, or online merchant is hacked, thieves copy the card data from thousands or millions of transactions at once. You may not know your card was compromised for months or years. Target, Home Depot, Equifax, and countless smaller merchants have all experienced breaches that exposed card numbers to criminals.

A skimming device is a small reader installed on an ATM, gas pump, or card reader at a checkout. When you swipe or insert your card, the skimmer copies the number and magnetic stripe data. The thief returns later to retrieve the device or receives the data wirelessly. Gas pumps and standalone ATMs in remote locations are common targets because they are less monitored.

Phishing emails and fake websites trick you into entering your card details on a page that looks like your bank or a trusted retailer but is actually controlled by a criminal. The email may claim your account is locked, a purchase needs confirmation, or a refund is waiting. Clicking the link takes you to the fake site where you unknowingly hand over your number.

A compromised merchant account means a business you trust has weak security. An employee with access to the payment system, a hacked point-of-sale terminal, or unsecured customer records can expose your card number. Restaurants are particularly vulnerable because servers often take cards away from the table to process them.

What happens after your card number is stolen

Once a thief has your card number, they test it with a small charge — often $1 to $5 — to confirm it is active and not yet reported as stolen. If that charge goes through, they know the card works and the account is not frozen. This is why you should check your statement weekly rather than waiting for the monthly bill.

If the test charge succeeds, the thief makes larger purchases. They may buy electronics, gift cards, or items they can resell quickly. Some thieves sell the card number to other criminals on the dark web for $5 to $50, depending on the card's limit and history. A single stolen number can be used by multiple people across different countries.

The timeline varies. Some fraudulent charges appear within hours of the theft. Others appear days or weeks later, especially if the thief is waiting for a good time to use the card or testing whether you are monitoring your account. The longer you go without checking your statement, the more charges may accumulate before you notice.

How to report unauthorized charges to your card issuer

Call the customer service number on the back of your card or on your statement — not a number from a search result or email, which could be fake. Tell them you have unauthorized charges and want to dispute them. You do not need to know exactly how the theft happened; the issuer will investigate.

The issuer will ask you to confirm which charges are yours and which are not. They will issue you a new card with a new number, usually within 5 to 10 business days. While the dispute is under investigation, you are not responsible for paying the fraudulent charges — federal law (the Fair Credit Billing Act) protects you from liability for card-not-present fraud.

The investigation itself takes 30 to 90 days. During that time, the issuer contacts the merchant where the charge occurred and asks for proof that you authorized it. If the merchant cannot provide a signed receipt or other evidence of your consent, the charge is reversed and credited back to your account. If the merchant provides evidence, the issuer may rule against you, though this is rare for card-not-present transactions.

Keep records of your dispute: the date you called, the name of the representative, the confirmation number, and the list of disputed charges. If the issuer does not resolve the dispute within the stated timeframe, follow up in writing and reference your confirmation number.

Protecting yourself after fraud is discovered

Place a fraud alert with the three major credit bureaus — Equifax, Experian, and TransUnion. A fraud alert tells lenders to contact you before opening new accounts in your name. You can place an alert by calling one bureau; they are required to notify the other two. The alert lasts one year and is free.

A credit freeze is stronger than an alert. It locks your credit file so that no one can open a new account, take out a loan, or apply for a credit card without your permission. You must unfreeze it temporarily if you want to apply for credit yourself. Freezes are free in most states and last until you remove them.

Monitor your credit report for accounts you did not open. You can view your report free once per year at AnnualCreditReport.com, which is the official site run by the three bureaus. Look for new credit cards, loans, or inquiries from lenders you did not contact. If you find fraudulent accounts, dispute them with the bureau and the creditor.

Change passwords for any online accounts where you used the same password as your email or banking sites. If a thief has your card number, they may also have usernames and passwords from a breach. Use a password manager to create unique passwords for each account.

Why your card issuer may not catch fraud before you do

Card issuers use fraud detection software that flags unusual patterns — a purchase in another country hours after a domestic purchase, a very large charge compared to your normal spending, or multiple charges in a short time. However, these systems are not perfect. A thief who makes small, scattered purchases that match your spending habits may slip through.

The issuer also cannot contact you instantly. They may flag a charge as suspicious and hold it for review, but they do not call you to ask permission for every purchase. If you have enabled transaction alerts in your mobile app or through email, you will see charges in real time, which is faster than waiting for the issuer to catch them.

Some issuers offer zero-liability protection, which means you are not responsible for unauthorized charges regardless of how the fraud happened. However, this protection applies only if you report the fraud within a certain window — usually 60 days from when the statement is mailed. This is why checking your statement weekly matters.

What to do if you spot fraud but have not yet received your statement

If you see a charge in your online account or mobile app that you did not make, contact your issuer immediately. Do not wait for the statement to arrive. The sooner you report it, the sooner the issuer can freeze the card and begin an investigation.

If the charge is still pending (not yet posted), the issuer may be able to block it before it settles. If it has already posted, the issuer will reverse it during the dispute process. Either way, reporting early protects you and helps the issuer catch patterns of fraud faster.

Ask the issuer whether they can issue a temporary card number for online purchases while your new physical card is on the way. Some issuers offer this service, which lets you keep shopping without interruption.

Frequently Asked Questions

Can the thief use my card again after I report it?

No. Once you report the card as fraudulent, the issuer deactivates it immediately. Any new charges will be declined. The thief may try to use the number again, but the merchant's system will reject it. This is why getting a new card quickly is important — you want to make sure you can use your own card while the old one is blocked.

Will I have to pay interest on the fraudulent charges while the dispute is being investigated?

No. Federal law prohibits the issuer from charging interest or fees on amounts you are disputing. You are not responsible for paying any part of the fraudulent charge, including interest, until the investigation is complete. If the issuer rules in your favor, the charge is removed entirely.

What if the merchant says I authorized the charge?

If you did not authorize it, tell the issuer that in your dispute. The merchant must provide proof of authorization — a signed receipt, a recorded phone call, or an email from your account. For online purchases, merchants rarely have this proof. If the merchant cannot prove you authorized it, the issuer will reverse the charge.

Should I close my account after fraud?

You do not have to close the account, but you can if you want. Closing it will not hurt your credit score if the account has no balance. However, keeping the account open with a zero balance can actually help your credit score because it lowers your overall credit utilization ratio. Ask the issuer whether they will waive the annual fee if you keep the account open.

How do I know if my card number is in a data breach?

You can check your card number against known breaches using Have I Been Pwned (haveibeenpwned.com), though this site does not cover all breaches. Your card issuer may also notify you by mail or email if your card was exposed in a breach they are aware of. If you are notified, monitor your account closely for the next several months and consider placing a fraud alert.