Stolen card numbers are sold, used for online purchases, or tested on small transactions before larger fraud

When a criminal obtains your credit card number, they typically follow one of three paths: sell it to another criminal on the dark web, use it themselves for purchases or cash advances, or test it with a small charge to confirm it works before attempting larger fraud. The card number alone—without the CVV, expiration date, or cardholder name—has limited usefulness but is still valuable enough to sell for a few dollars to someone willing to try it.

Understanding what happens after theft matters because it changes how quickly you need to act and what your card issuer can recover. A number used immediately for a $500 online purchase leaves a transaction record. A number that sits in a criminal database for months before use may never be traced back to the original breach. Your liability and the issuer's fraud investigation depend partly on which scenario occurred.

Key Takeaways

  • Stolen card numbers are most often used for online purchases, subscription fraud, or small test charges to verify the card is active.
  • Your card issuer can see fraudulent charges within hours or days if the thief uses the number immediately, but may never detect charges made months later if the card is no longer active.
  • Federal law caps your liability at $50 for unauthorized charges, and most card issuers waive this entirely if you report fraud promptly.
  • Closing the card stops new fraud but does not erase charges already made; the issuer's fraud department handles the investigation and reversal.
  • Monitoring your statements weekly rather than monthly catches fraud faster and gives the issuer more time to recover funds before they clear the banking system.

How criminals use stolen card numbers in the first hours and days

The first use of a stolen card number typically happens within 24 to 72 hours of the theft. Criminals test the number with a small charge—often $1 to $5—at a merchant that does not require a CVV or address verification. Gas stations, vending machines, and some online retailers accept card-not-present transactions with only the number and expiration date. If the charge goes through, the thief knows the card is active and the account holder has not yet noticed.

Once the test charge succeeds, larger purchases follow. Online retailers like Amazon, eBay, and Walmart are common targets because they ship to addresses the thief controls—often a reshipping service or a stolen address in a different state. The thief may also attempt cash advances at ATMs or convenience stores if they have the PIN, though most card-not-present theft does not include the PIN.

Subscription services are another immediate target. Fraudsters use stolen numbers to sign up for streaming services, software subscriptions, or digital goods that do not require shipping. These charges are harder to detect because they recur monthly and blend into legitimate subscription clutter on your statement.

What happens when the card number is sold instead of used immediately

Not every stolen number is used by the thief who obtained it. Many are sold on dark web marketplaces in batches—sometimes thousands of numbers at once from a single data breach. A card number with full details (number, expiration date, CVV, and cardholder name) sells for $5 to $50 depending on the card type and the seller's reputation. Numbers without CVV or expiration date sell for less.

When a number is sold and resold, weeks or months may pass before anyone uses it. By that time, the original cardholder may have already closed the card, reported it stolen, or the card may have expired naturally. The buyer who eventually uses the number may face a declined transaction because the card is no longer active—a dead end that wastes their money and leaves no fraud trail for you to discover.

This delay is actually a protection. If your card number is stolen in a breach but not used for months, you have time to notice the breach through notification letters from the affected company, monitor your account, or proactively request a new card. Many people discover their number was compromised only after receiving a breach notification, not after fraudulent charges appear.

How your card issuer detects and investigates fraudulent charges

Card issuers use automated fraud detection systems that flag unusual patterns: a charge in a different state hours after a charge in your home state, multiple small charges in rapid succession, or a purchase category you have never used before. These systems catch many frauds within hours, and the issuer may decline the transaction or contact you to verify before the charge posts to your account.

When a charge does post as fraudulent, the issuer's fraud department investigates by requesting documentation from the merchant—the IP address of the purchase, the shipping address, the device used, and the time of the transaction. They compare this to your account history and your stated location. If the merchant cannot produce evidence that you authorized the charge, the issuer reverses it and credits your account.

The investigation timeline varies. Simple cases—a charge at a retailer in a state you have never visited, shipped to an address you do not recognize—may be reversed within 3 to 5 business days. Complex cases, especially those involving cash advances or transfers, can take 30 to 60 days. During this time, the charge remains on your statement but is marked as disputed.

Your liability and what the card issuer covers

Federal law under the Fair Credit Billing Act limits your liability for unauthorized credit card charges to $50 per card. In practice, most card issuers waive this $50 entirely and cover 100% of fraudulent charges if you report them within 60 days of the statement date. Some issuers offer zero-liability policies that cover fraud regardless of when you report it, though this varies by card type and issuer.

Your liability increases only if you were negligent—for example, if you wrote your PIN on the back of the card or shared your number knowingly with someone who then misused it. Theft through a data breach, phishing, or a lost card is not considered negligence, and you are protected.

Debit cards have different protections. If you report a fraudulent debit card charge within two business days, your liability is capped at $50. If you wait longer, your liability can rise to $500 or more. This is why monitoring your statements closely matters more for debit cards than for credit cards.

Why closing the card does not stop fraud that has already been charged

Closing your card immediately after discovering fraud stops new charges but does not erase charges already made. The fraudster cannot use the number again once the card is closed, but the charges they already placed are still in the banking system and must be handled through the dispute process, not through card closure.

When you close a card, the issuer sends you a new card with a new number. Legitimate recurring charges—subscriptions, insurance payments, loan payments—must be updated with the new number, or they will fail. This is why the issuer usually asks you to identify which recurring charges are legitimate before closing the card.

The fraud investigation continues even after the card is closed. You still need to dispute each fraudulent charge, and the issuer still needs to contact merchants and gather evidence. Closing the card is a necessary step to prevent future fraud, but it is not the same as resolving past fraud.

How to monitor your account to catch fraud early

The fastest way to limit fraud damage is to catch it before the thief makes large purchases. Check your statement online weekly rather than waiting for the monthly statement to arrive. Most card issuers offer real-time alerts via text or email when a charge is posted, and you can set thresholds—for example, alert me for any charge over $50.

When you spot a fraudulent charge, contact your issuer immediately by phone, not email. Verbal reporting creates a record and allows the issuer to freeze the account faster. Have your statement in front of you and be ready to describe each fraudulent charge: the merchant name, the amount, and the date. The issuer will ask whether you recognize the merchant and whether you authorized the charge.

After you report fraud, the issuer will typically issue a new card within 3 to 7 business days and reverse the fraudulent charges within 10 business days, though some issuers are faster. Ask the issuer for a case number and a timeline for each charge reversal. Request written confirmation of the dispute so you have documentation if a charge reappears on your account later.

What to do if the same card number is used multiple times

If you see multiple fraudulent charges from the same card number, the thief likely has your full card details and is testing different merchants or making rapid purchases before you notice. This is more serious than a single charge because it suggests the thief has your number, expiration date, and possibly your CVV.

Close the card immediately and request expedited replacement. Ask the issuer whether they can issue a temporary card number for online purchases while you wait for the physical card. Report all fraudulent charges at once rather than waiting to see if more appear—the issuer's fraud team can flag the account and monitor for additional attempts.

If multiple charges appear from the same merchant, the merchant may have been compromised. Check whether you made a legitimate purchase there recently. If you did, the breach likely occurred at that merchant's payment processor, and thousands of other customers may be affected. The merchant should send you a breach notification within 30 days, though this varies by state law.

Frequently Asked Questions

Can a thief use my card number without the CVV?

Yes. Card-not-present transactions—online purchases, phone orders, and some in-person retailers—often do not require the CVV. Gas pumps, vending machines, and older payment systems may accept just the number and expiration date. The CVV adds a layer of security but is not required for every transaction.

How long does it take for fraudulent charges to be reversed?

Simple cases are usually reversed within 3 to 5 business days. Complex cases involving cash advances or transfers can take 30 to 60 days. During the investigation, the charge remains on your statement but is marked as disputed. Ask your issuer for a specific timeline when you report the fraud.

Will I have to pay interest on fraudulent charges while they are being investigated?

No. Once you report a charge as fraudulent, the issuer must not charge interest on that amount during the investigation. If interest was already charged before you reported it, ask the issuer to remove it as part of the dispute resolution.

What if the thief used my card number to open a new account in my name?

This is identity theft, not simple card fraud. Contact the Federal Trade Commission at IdentityTheft.gov and file a report. You will receive an Identity Theft Report that you can use to dispute fraudulent accounts with creditors and credit bureaus. Also place a fraud alert on your credit file by contacting one of the three major credit bureaus.

Should I request a new card number even if no fraud has appeared yet?

If your card number was exposed in a data breach, you can request a new card as a precaution, though it is not required. Many issuers will replace the card for free if the number was part of a known breach. Check your issuer's website or call to see whether your card was affected by any recent breaches.