Credit card fraud is when someone uses your card number, expiration date, or other card details without your permission to make purchases or withdraw cash

The person committing the fraud may be a stranger who obtained your information through a data breach, a hacked website, or a skimming device at a gas pump. They may also be someone you know — a family member, roommate, or employee with access to your card. The result is the same: charges appear on your statement that you did not authorize.

Fraud differs from a billing error or a purchase you regret. A billing error is a mistake by the card issuer or merchant. A regretted purchase is one you authorized but now wish you had not. Fraud means you never gave permission in the first place.

Key Takeaways

  • Credit card fraud occurs when someone uses your card information without your permission to make unauthorized charges.
  • Fraudsters obtain card details through data breaches, phishing emails, skimming devices, or by stealing physical cards.
  • Federal law limits your liability for unauthorized charges to $50 if you report the fraud promptly, and most card issuers waive this amount entirely.
  • Reporting fraud to your card issuer within 60 days of receiving your statement protects your rights and starts the dispute process.
  • Monitoring your statements regularly and setting up transaction alerts are the most effective ways to catch fraud early.

How fraudsters get your card information

Data breaches are the most common source. When a retailer, bank, or website is hacked, criminals may steal millions of card numbers at once. You may not know your information was compromised until charges start appearing or you receive a notification from the company.

Phishing is when someone sends you an email or text pretending to be your bank or a trusted company, asking you to "verify" your card details or click a link. The link leads to a fake website that looks real but captures whatever you type. Legitimate banks and card issuers do not ask for full card numbers or security codes by email or text.

Skimming devices are small machines attached to card readers — usually at gas pumps, ATMs, or restaurant payment terminals — that copy your card information when you swipe or insert it. The fraudster retrieves the device later and has your data.

Stolen physical cards are straightforward: someone takes your wallet or intercepts your mail. They then use the card in stores or online before you notice it is missing.

Types of credit card fraud

Card-present fraud happens when the fraudster has your actual card or a counterfeit copy and uses it in person at a store or ATM. This is less common now because most merchants and banks use chip readers or contactless payment, which are harder to counterfeit than magnetic stripe cards.

Card-not-present fraud occurs when the fraudster has only your card number, expiration date, and security code — the information visible on the front and back of your card. They use this to make online purchases, phone orders, or mail orders without ever having the physical card. This is the most common type today.

Account takeover is when a fraudster gains access to your online banking account or card issuer account and changes your password, address, or phone number. They may then order a replacement card sent to a new address or make charges directly from your account. This often starts with a phishing email or a data breach that exposed your login credentials.

What federal law says about your liability

The Fair Credit Billing Act limits your liability for unauthorized credit card charges to $50 per card, provided you report the fraud within 60 days of receiving the statement showing the unauthorized charge. In practice, most card issuers waive the $50 entirely and hold you responsible for zero dollars.

This protection applies only to credit cards and cards that function as credit cards — not debit cards. Debit card fraud carries different protections under a different law, the Electronic Funds Transfer Act, which depends on how quickly you report the fraud.

Your liability may increase if you were negligent — for example, if you wrote your security code on the back of your card or shared your full card number with someone you did not trust. However, straightforward losing your card or having it stolen does not count as negligence in most cases.

Steps to take if you notice fraud on your statement

First, contact your card issuer when ready. Call the number on the back of your card or on your statement — not a number from an email or text, which could be fraudulent. Tell them which charges are unauthorized. They will typically cancel your current card and issue a replacement.

Second, request a written dispute. Ask the card issuer to send you a dispute form or confirm in writing that they have received your report. Keep this documentation. The issuer must investigate within 30 days and resolve the dispute within two billing cycles (usually 60 to 90 days).

Third, monitor your account for the next few months. Fraudsters sometimes make small test charges before attempting larger ones. If more unauthorized charges appear, report them when ready.

Fourth, consider a fraud alert or credit freeze if you believe your personal information was compromised beyond just your card number. A fraud alert tells credit bureaus to contact you before opening new accounts in your name. A credit freeze prevents anyone from accessing your credit report without your permission. Both are free.

How to reduce your risk of fraud

Review your statements monthly, either online or on paper. Most fraud is caught this way. Set up transaction alerts through your card issuer's app or website so you receive a notification each time your card is used. This lets you spot unauthorized charges within hours rather than weeks.

Never share your full card number, expiration date, or security code unless you initiated the transaction with a merchant you trust. Legitimate companies do not ask for this information by email, phone, or text.

Use chip readers and contactless payment when available. These are more find than magnetic stripe cards. When you must swipe, inspect the card reader first — skimming devices are sometimes loose or visibly out of place.

Create strong, unique passwords for your online banking and card issuer accounts. Use a password manager to store them. This prevents account takeover even if your card number is stolen.

Shred documents containing your card number, account statements, or personal information before throwing them away. Dumpster diving is a real source of fraud.

What happens during the dispute process

When you report fraud, your card issuer opens an investigation. They contact the merchant where the charge occurred and ask for evidence that you authorized the transaction — typically a receipt with your signature or a record of your billing address and security code being used correctly.

If the merchant cannot provide this evidence, the charge is usually reversed and credited back to your account. If the merchant claims they have proof you authorized it, the issuer may ask you for additional information — for example, whether you were traveling at the time or whether you recognize the merchant name.

During the dispute, the charge remains on your statement but is typically marked as disputed. You are not required to pay the disputed amount while the investigation is ongoing. Once the issuer resolves the dispute in your favor, the charge is removed and your account is credited.

Frequently Asked Questions

Will I have to pay the fraudulent charges while the dispute is being investigated?

No. Under the Fair Credit Billing Act, you do not have to pay a disputed charge while the issuer investigates. The charge remains on your statement but is marked as disputed. Once the investigation concludes and the fraud is confirmed, the charge is removed and your account is credited.

What if the fraudster used my card at a store I actually shop at?

Report it anyway. The card issuer will investigate by checking the time and location of the charge, whether the security code was entered correctly, and whether the transaction matches your normal spending patterns. If you were not at that location at that time, the charge will likely be reversed. Provide the issuer with your location at the time of the charge if you can.

Can someone commit fraud using just my card number without the security code?

Yes. Card-not-present fraud — online purchases, phone orders, and mail orders — can happen with just your card number and expiration date. The security code adds a layer of protection but is not required for every transaction. This is why monitoring your statements is so important.

If my card is used fraudulently, will my credit score be affected?

Not directly. Fraudulent charges do not appear on your credit report because they are not legitimate debt. However, if the fraud goes undetected for months and results in a high balance, that could temporarily affect your credit utilization ratio. Catching fraud early prevents this problem.

What should I do if I think someone I know committed the fraud?

Report it to your card issuer the same way you would report any fraud. You are not required to investigate or confront the person yourself. The card issuer will handle the dispute. If the amount is large or the person has ongoing access to your information, you may also consider reporting it to local police, though police involvement is not required to dispute the charge.