Credit card fraud is when someone uses your card number or account information without your permission to make purchases or withdraw money
Fraud happens in two main ways. Card-present fraud occurs when a thief physically has your card — they've stolen it from your wallet, found it, or you handed it to them. Card-not-present fraud happens online or over the phone when someone uses just your card number, expiration date, and CVV (the three-digit code on the back). They don't need the physical card at all.
The reason this matters to you: your card issuer — the bank that issued your card — is legally responsible for most fraudulent charges. You are not. But you do need to report it quickly, and you need to understand what happens next so you're not left without a card while the bank investigates.
Key Takeaways
- Card-present fraud involves a stolen physical card; card-not-present fraud uses only your number and happens online or by phone.
- Your card issuer covers most fraudulent charges by law, but you must report them within 60 days of seeing them on your statement to stay protected.
- Thieves get card numbers through data breaches at stores or websites, by stealing mail, or by skimming devices on ATMs and gas pumps.
- Checking your statement monthly and setting up transaction alerts are the fastest ways to catch fraud before it becomes a bigger problem.
How thieves get your card information
Data breaches are the most common source. When a store, restaurant, or website gets hacked, thieves steal thousands of card numbers at once. You may never know which merchant was breached — your card issuer will contact you if they detect unusual activity, but sometimes fraud shows up weeks or months later.
Skimming devices are physical tools thieves attach to ATMs, gas pumps, or card readers. When you swipe or insert your card, the device copies your number. Some skimmers also have tiny cameras pointed at the keypad to capture your PIN. Chip readers (the ones you insert your card into) are harder to skim than older magnetic stripe readers, which is one reason chip cards are more secure.
Mail theft is simpler but still common. A thief steals your new card from your mailbox before you do, or they intercept statements and use the card number printed there. Lost or stolen wallets are straightforward — someone finds your card and uses it before you notice it's gone.
Phishing and social engineering are less common but worth knowing about. A scammer sends you a fake email or text pretending to be your bank, asking you to "verify" your card details by clicking a link. If you enter your information, they have it.
Signs that fraud has happened to your account
The clearest sign is a charge on your statement that you did not make. This could be a small test charge (thieves sometimes make a $1 purchase to see if the card works before making larger ones) or a large purchase. Check your statement every month, even if you think you know what you spent — fraudsters count on people not looking closely.
You might also notice that your card was declined when you tried to use it, even though you have available credit. This can happen if the issuer's fraud detection system flagged suspicious activity and temporarily blocked the card. Your issuer will usually call you to confirm the charge was legitimate.
Missing mail is another warning sign. If your statement or new card doesn't arrive when you expect it, someone may have intercepted it. Call your issuer to confirm they sent it and ask them to reissue your card.
Some card issuers offer free transaction alerts — notifications by text or email whenever a charge is made. If you have alerts turned on and you get one for a purchase you didn't make, report it immediately.
What to do if you spot fraudulent charges
Call your card issuer right away. The phone number is on the back of your card or on your statement. Tell them which charges are not yours and describe what you remember about them — the merchant name, the amount, and the date. Do not email or use the website chat for this; a phone call creates a record and lets you speak to someone who can start the investigation immediately.
Your issuer will ask you questions to confirm your identity — they may ask for your address, Social Security number, or recent legitimate charges. This is normal. They want to make sure they're talking to the real cardholder.
After you report the fraud, your issuer will issue you a new card with a new number. The old card will be cancelled. This usually takes 5 to 10 business days. In the meantime, you may not be able to use that card for purchases, though some issuers will let you use it for recurring charges (like a subscription) until the new one arrives.
The issuer will investigate the fraudulent charges, which typically takes 30 to 60 days. During this time, the charges will usually stay on your statement, but they'll be marked as disputed. Once the investigation closes, the issuer will remove them and credit your account. You will not owe anything for charges the issuer confirms were fraudulent.
How fraud affects your credit report and credit score
Fraudulent charges themselves do not damage your credit score. Your score is based on your payment history, credit utilization (how much of your available credit you're using), and other factors — not on whether someone committed fraud against you.
However, if the fraud goes unnoticed and unpaid for a long time, the issuer might close your account or send it to collections. That would hurt your score. This is why catching fraud quickly matters: you stop the damage before it spreads to your credit report.
If a thief opens new accounts in your name (which is identity theft, a step beyond card fraud), that can damage your score significantly. You can check your credit report for free once a year at annualcreditreport.com, which is run by the three major credit bureaus. Look for accounts you did not open.
Steps to lower your fraud risk
Check your statement monthly. This is the single most effective thing you can do. Set a calendar reminder if you need to. Even five minutes a month catches most fraud before it becomes a bigger problem.
Use your card's chip when possible. Chip readers are harder to counterfeit than magnetic stripe readers. If a store or restaurant doesn't have a chip reader, ask if they do before handing over your card.
Never give your card number, expiration date, or CVV to someone who calls you, even if they say they're from your bank. Your bank already has this information. Legitimate companies will never ask for your full card number or CVV over the phone.
Be cautious with your card at restaurants and gas stations. Some thieves work as employees and skim cards as they process them. If possible, use chip readers or contactless payment (tap or mobile wallet) instead of swiping.
Sign up for transaction alerts if your issuer offers them. You'll get a text or email every time your card is used, so you'll know immediately if someone else is using it.
Protect your mail. If you're expecting a new card, consider having it held at your bank branch for pickup instead of mailed to your home. If you're not expecting mail, remove it promptly so it doesn't sit in your mailbox.
The difference between fraud and identity theft
Credit card fraud is the unauthorized use of your card number or account. Identity theft is broader — it means someone is using your personal information (your name, Social Security number, date of birth) to open new accounts, apply for loans, or commit other crimes in your name.
You can have card fraud without identity theft. A thief uses your card number for a few purchases, you report it, and it's resolved. But if a thief opens a credit card, car loan, or utility account in your name, that's identity theft, and it's more serious because it affects your credit report and can take months to fix.
If you suspect identity theft, place a fraud alert on your credit report by contacting any of the three major bureaus (Equifax, Experian, or TransUnion). A fraud alert tells lenders to verify your identity before opening new accounts in your name. You can also place a credit freeze, which blocks access to your credit report entirely until you lift it.
Frequently Asked Questions
Am I responsible for paying fraudulent charges?
No. Federal law limits your liability to $50 if you report the fraud within 60 days of seeing it on your statement. Most card issuers waive even that $50. If you report it after 60 days, you may be liable for all fraudulent charges, so report quickly.
How long does it take to get my money back?
Your issuer will usually credit your account within 30 to 60 days after you report the fraud, once their investigation is complete. Some issuers credit you temporarily while they investigate, so you're not without the money the whole time. Ask your issuer about their process when you call.
Will fraud affect my credit score?
Fraudulent charges themselves do not hurt your score. But if the fraud goes unreported and unpaid for months, your account could be closed or sent to collections, which would damage your score. Catching and reporting fraud quickly prevents this.
What should I do if I lost my card but haven't seen fraudulent charges yet?
Call your issuer immediately and report the card lost. They will cancel it and send you a new one. You do not have to wait for fraudulent charges to appear. Reporting it lost right away prevents someone from using it.
Can I dispute a charge I made but want to return instead?
That is a chargeback or return, not fraud. Contact the merchant first and ask for a refund. If they refuse, you can dispute the charge with your issuer, but be honest that you made the purchase — disputing legitimate charges as fraud is itself illegal.