Credit card theft means someone uses your card number, expiration date, or security code without your permission to make purchases or withdrawals in your name.
Theft can happen in several ways. A thief might physically steal your card from your wallet or mail. They might photograph your card at a restaurant or gas pump. They might intercept your mail to get a new card before you do. Or they might buy stolen card numbers from criminals online and use them to shop or transfer money.
The key difference between credit card theft and other fraud is that the thief is using your existing account, not opening a new one in your name. They are not trying to become you — they are trying to spend your credit limit before you notice.
Key Takeaways
- Credit card theft happens when someone uses your card number or physical card to make unauthorized charges, and you are not responsible for fraudulent purchases if you report them promptly.
- Federal law caps your liability at $50 for unauthorized charges, and most card issuers waive this entirely if you report theft before the charges post.
- The first step after discovering theft is to call your card issuer's fraud line immediately — the number is on the back of your card or your statement — to freeze the account and dispute charges.
- You should also place a fraud alert with the three credit bureaus (Equifax, Experian, and TransUnion) to prevent a thief from opening new accounts in your name.
- Monitoring your statements monthly and setting up transaction alerts can catch theft within days instead of weeks, which limits the damage.
How thieves get your card information
Physical card theft is straightforward — someone takes your wallet or intercepts mail containing a new card. But most credit card theft today happens without the thief ever touching your card.
Skimming is one common method. A thief installs a hidden reader on an ATM, gas pump, or payment terminal that copies your card data when you swipe or insert it. The thief then uses that number online or sells it to someone else.
Thieves also buy stolen card numbers in bulk from data breaches at retailers, restaurants, or hotels. When a company's payment system is hacked, thousands of card numbers leak onto the dark web and sell for a few dollars each. The thief tests a batch of numbers with small purchases to find which ones still work, then makes larger charges.
Phishing emails and fake websites are another route. A thief sends you an email that looks like it came from your bank or a store you use, asking you to "verify your account" by entering your card number. If you click and enter your information, the thief has it.
What happens to your account when theft occurs
Once a thief has your card number, they typically start with small purchases — a coffee, a gas fill-up, a digital download — to confirm the card works. If those go through, they escalate to larger charges: electronics, gift cards, or cash advances.
The thief's goal is to spend as much as possible before you notice and report the card stolen. Some thieves work fast and max out your credit limit in a day. Others make smaller charges over weeks, hoping you will not notice a few dollars here and there mixed into your real spending.
Your card issuer may catch the theft before you do. Banks use fraud detection software that flags unusual patterns — a charge in another state hours after a charge at home, or a purchase at a store you have never used. When the system flags something, the issuer may freeze your card or call you to confirm the charge.
Your legal protection against unauthorized charges
Federal law, the Fair Credit Billing Act, limits your liability for unauthorized credit card charges to $50 maximum. In practice, most card issuers waive this fee entirely if you report the theft promptly.
The catch is timing. You are protected only if you report the theft before the unauthorized charges post to your account. Once charges appear on your statement, you have a window — usually 60 days from the date the statement was mailed — to dispute them in writing. After that window closes, you lose your legal protection.
This is why monitoring your account matters. If you check your statement monthly and spot a fraudulent charge within days of it posting, you can dispute it immediately and the issuer will reverse it. If you wait three months to open your statement, the issuer may deny the dispute as late.
Steps to take immediately after discovering theft
Call your card issuer's fraud line right away. The number is on the back of your card or on your most recent statement. Tell them which charges are fraudulent. The issuer will cancel your card, reverse the unauthorized charges, and mail you a replacement card.
Do not email or use the card's website to report theft. Fraud lines are staffed to handle this and can freeze your account instantly. A website form or email may take days to process.
After you hang up, follow up in writing. Send a letter to the address the issuer provides, listing each fraudulent charge, the date you called, and the name of the person you spoke with. Keep a copy for your records. This creates a paper trail that protects you if the issuer later disputes your claim.
Next, place a fraud alert with the three credit bureaus: Equifax, Experian, and TransUnion. A fraud alert tells lenders to verify your identity before opening new accounts in your name. You can place an alert by calling one bureau — they are required to notify the other two. The alert lasts one year and is free.
Preventing future theft of the same card
Once your card is replaced, the old number is dead. Thieves who have it cannot use it anymore because the issuer has deactivated it. This is why replacing the card quickly matters — it stops the bleeding.
Your new card will have a different number, expiration date, and security code. The thief's stolen data is now useless.
To catch theft faster next time, set up transaction alerts with your card issuer. Most issuers let you choose alerts for charges over a certain amount, charges in certain categories, or any charge at all. When a transaction triggers an alert, the issuer texts or emails you immediately. This means you can spot fraud within hours instead of waiting for your monthly statement.
Check your statement every month, even if you set up alerts. Alerts catch most theft, but not all. A thief might make small charges that fall below your alert threshold, or your alert might go to spam. Monthly review is your backup.
The difference between card theft and identity theft
Card theft and identity theft are related but different. Card theft is using your existing card number to make unauthorized charges. Identity theft is using your personal information — name, Social Security number, date of birth — to open new accounts, apply for loans, or take out lines of credit in your name.
A thief who steals your card number is committing card theft. A thief who steals your Social Security number and opens a credit card account in your name is committing identity theft. The second is more serious because it damages your credit report and can take months or years to fix.
If your card is stolen, place a fraud alert to protect against identity theft. If your Social Security number is stolen, you may need to go further — placing a credit freeze, which prevents anyone from opening new accounts in your name without your permission.
Frequently Asked Questions
Am I responsible for charges made with my stolen card?
No. Federal law limits your liability to $50 for unauthorized charges, and most card issuers waive this fee if you report the theft before or shortly after the charges post. You are not responsible for the fraudulent charges themselves — the issuer eats the loss.
How long does it take to get my money back after I report theft?
Most issuers credit your account within one to three business days of your call. The formal dispute process takes up to 60 days, but the issuer usually reverses the charges immediately as a courtesy while they investigate. You should see the credit on your next statement.
Can a thief use my stolen card number to open new accounts?
Not directly — they cannot open a credit card account using only your card number. But if they also have your name, address, and Social Security number, they can open new accounts in your name. This is identity theft, not card theft. A fraud alert prevents this by requiring lenders to verify your identity before opening accounts.
What if I do not notice the theft until weeks later?
You are still protected under federal law as long as you report it within 60 days of the statement date. However, the longer you wait, the more charges the thief can make. Report it as soon as you notice, even if it has been weeks. The issuer will still reverse the fraudulent charges, but you may have a larger mess to clean up.
Should I file a police report for credit card theft?
You can, but it is not required for the card issuer to reverse charges. A police report is useful if the theft is part of a larger identity theft scheme or if you want documentation for your records. Call your local police non-emergency line to file a report, or file online if your jurisdiction offers it.