How to check if your card number has been compromised

You can search for your credit card number in known data breaches using Have I Been Pwned (haveibeenpwned.com), a free database that aggregates stolen data from public breaches. Enter your email address or, on some breach-specific pages, search by card number directly. The site tells you which breaches your information appears in and when the breach occurred.

Your card issuer — the bank or credit union that issued your card — also monitors for your card number in hacker databases as part of their fraud detection systems. You do not have to do anything to trigger this. If your number appears in a breach they discover, they will contact you by phone or mail, usually within days of learning about it. Many issuers also let you check your account online under a "Security" or "Fraud Protection" section to see if any suspicious activity has been flagged.

If you find your card number in a breach, contact your card issuer immediately. They can cancel the card and issue a replacement, usually within 5 to 10 business days. A cancelled card stops working for new charges, but pending transactions and recurring payments may still process, so ask your issuer which transactions are at risk.

Key Takeaways

  • Have I Been Pwned is a free public database where you can search for your email address or card number to see if it appears in known breaches.
  • Your card issuer monitors for your card number in breaches automatically and will contact you if they find it, so you do not have to wait for a breach notification to take action.
  • A card number in a hacker database does not mean fraud has occurred yet — it means the number is available for potential misuse.
  • Cancelling your card stops new charges but may not stop pending or recurring transactions, so confirm with your issuer which payments are affected.
  • Monitoring your account statements weekly for the next 3 to 6 months after a breach is more effective at catching fraud than waiting for your issuer to catch it.

What happens when a card number enters a hacker database

A card number in a hacker database means the number has been stolen and is now available to criminals, but it does not mean someone has already used it. Hackers sell stolen card numbers in bulk on dark web marketplaces, sometimes for as little as $5 to $15 per number. A buyer might test the number with a small purchase to see if it still works, or they might sit on it for months before using it.

The time between a breach and actual fraud varies widely. Some stolen numbers are used within hours; others never are. The card networks (Visa, Mastercard, American Express, Discover) and your issuer have fraud detection systems that flag unusual purchases, so a criminal cannot always use a stolen number even if they have it.

Your liability for fraudulent charges depends on when you report the fraud. If you report it before the charge posts to your account, you have zero liability. If you report it after the charge posts but within 60 days, your liability is capped at $50 under federal law (Regulation Z). If you wait longer than 60 days, your liability can be much higher. Most card issuers waive the $50 cap as a matter of policy, but the 60-day window is the legal floor.

Where to search for your card number in breaches

Have I Been Pwned is the most widely used breach database. It is run by security researcher Troy Hunt and is updated regularly as new breaches are discovered and made public. The site is free and does not require you to create an account. Search by email address first — this will show you all breaches associated with that email. Some breaches are also searchable by card number, though not all databases publish card numbers directly.

The site also offers a paid notification service ($3.99 per month) that alerts you by email if your email address appears in a new breach. This is optional; the search itself is always free.

Other breach databases exist, but Have I Been Pwned is the most comprehensive and most frequently updated. If your card number does not appear there, it may still be in a breach that has not been made public or that is being sold only on private dark web forums. A breach that is not yet public is harder to detect without help from your issuer.

Why your issuer knows about breaches before you do

Card networks and payment processors have their own breach monitoring systems. Visa, Mastercard, American Express, and Discover all employ security teams that monitor dark web marketplaces, work with law enforcement, and receive tips from security researchers. When a large breach occurs, these teams often learn about it within days, sometimes before the breach is publicly announced.

Your card issuer receives alerts from the card network about breaches that affect their customers. They then cross-reference the stolen card numbers against their own customer database to see whose cards are at risk. If your card number is in the breach, your issuer will attempt to contact you by phone (the fastest method) or by mail.

This is why you may receive a call from your bank saying your card has been compromised, even if you have not seen any news about a breach. Your issuer is acting on information from the card network, not from a public announcement.

Steps to take if your card number is in a breach

Step 1: Contact your card issuer. Call the number on the back of your card. Confirm that your card number is in the breach and ask them to cancel the card and issue a replacement. Do not wait for them to contact you first — calling immediately shows you are monitoring your account actively.

Step 2: Ask about pending and recurring charges. A cancelled card stops new charges, but transactions that have already been authorized may still post. Ask your issuer which of your recurring payments (subscriptions, utilities, insurance) are tied to this card and whether they will continue to process after cancellation. You will need to update those merchants with your new card number once you receive the replacement.

Step 3: Review your statements for the past 3 months. Look for charges you do not recognize. Fraudsters sometimes test a stolen card with a small charge ($1 to $5) before attempting a larger purchase. If you find unauthorized charges, report them to your issuer in writing (email or mail) and by phone. Document the date and time of each call.

Step 4: Monitor your account weekly for 3 to 6 months. Set a phone reminder to check your account every Sunday for the next 6 months. This is more effective at catching fraud early than relying on your issuer's fraud detection system. If you spot a charge you did not make, report it immediately.

Step 5: Consider a credit freeze if the breach included personal information beyond your card number. If the breach also exposed your name, address, Social Security number, or date of birth, a credit freeze prevents criminals from opening new accounts in your name. You can place a free freeze through Equifax, Experian, or TransUnion. A freeze does not affect your existing accounts or your credit score.

The difference between a card number breach and identity theft

A card number breach means your card number is in a hacker database. Identity theft means someone has used your personal information (name, Social Security number, address, date of birth) to open new accounts or take out loans in your name. These are different risks with different solutions.

If only your card number was stolen, your risk is limited to fraudulent charges on that specific card. Cancelling the card stops the risk. If your card number was stolen along with your name, address, and Social Security number, your risk is broader — a criminal could open a credit card, take out a loan, or open a utility account in your name. In that case, a credit freeze is the right next step.

Check the breach notification from your issuer or the Have I Been Pwned entry to see what information was stolen. The notification will specify whether it was card number only or card number plus personal details.

What you cannot do to prevent future breaches

You cannot prevent your card number from being stolen in a breach. Breaches happen at merchants, payment processors, and other companies that store card data — not because of anything you did wrong. You did not cause the breach by using your card at a compromised merchant.

You also cannot prevent your card issuer from being breached. Even if you use your card only at secure websites and never share your number, a breach at your bank or credit union could still expose your card number. This is why monitoring your account and acting quickly when a breach occurs is more practical than trying to prevent breaches.

What you can do is reduce the window of time between when your card number is stolen and when you discover it. Checking your statements weekly and setting up transaction alerts through your issuer's app both help. Some issuers offer virtual card numbers (a temporary number that works for one transaction or one merchant) — using these for online shopping adds a layer of protection because the virtual number cannot be reused if it is stolen.

Frequently Asked Questions

If my card number is in a breach but no one has used it yet, do I still need to cancel it?

Yes. A card number in a breach is a liability waiting to happen. Cancelling it stops the number from being used at all, which is simpler than monitoring for fraud for months. Your issuer will send a replacement card within 5 to 10 business days, and you can use it immediately once it arrives. The inconvenience of updating recurring payments is worth the peace of mind.

How long does it take to get a replacement card after mine is cancelled?

Most issuers mail a replacement card within 5 to 10 business days. Some offer expedited shipping for $15 to $25, which can reduce the wait to 2 to 3 business days. Ask your issuer about expedited options when you call to cancel. In the meantime, you can usually make purchases online using your account number and routing number, or you can request a temporary card number to use immediately.

Can I use my old card number after it has been cancelled?

No. Once a card is cancelled, the number is deactivated and will not process any new charges. Pending transactions that were authorized before cancellation may still post, but new charges will be declined. This is why you need to update your recurring payments with your new card number as soon as you receive the replacement.

What if Have I Been Pwned says my card is in a breach but my issuer has not contacted me?

Contact your issuer directly. It is possible the breach was just made public and your issuer has not yet processed the notification, or it is possible your issuer is still working through the list of affected customers. Do not wait — call the number on the back of your card and tell them you found your card number in a public breach database. They can confirm whether it is one they are aware of and cancel your card if needed.

Do I need to place a credit freeze if only my card number was stolen?

A credit freeze is most useful if your Social Security number, name, and address were also stolen. If only your card number was stolen, cancelling the card is usually enough. However, if you are concerned about future identity theft or if the breach included multiple pieces of personal information, a free credit freeze through Equifax, Experian, or TransUnion takes about 15 minutes to set up and provides extra protection.