Credit card fraud is when someone uses your card number or account information without your permission to make purchases or withdraw cash

The fraudster might have stolen your physical card, copied your number from a receipt or website, or obtained it through a data breach at a store or bank. They then use that information to buy things online, in person, or over the phone — sometimes in small amounts to avoid detection, sometimes in large charges they know you'll notice anyway. The key point: you did not authorize the transaction, and you are not responsible for paying it.

Fraud happens constantly because card numbers are valuable. A stolen number can be sold on the dark web for anywhere from a few dollars to tens of dollars depending on how much information comes with it. Criminals run thousands of small test charges to see which cards are still active, then move to bigger purchases if the small ones go through. Some target specific people; most cast a wide net and see what sticks.

Key Takeaways

  • You are not responsible for fraudulent charges on your credit card — federal law caps your liability at $50, and most card issuers waive that entirely.
  • Fraudsters obtain card numbers through data breaches, stolen physical cards, skimmed card readers, phishing emails, or by copying information from receipts and websites.
  • Report fraud to your card issuer as soon as you notice it; they will cancel the card and investigate the charges within 10 business days.
  • Your card issuer will likely refund fraudulent charges while the investigation is underway, so you do not have to pay them out of pocket.
  • Monitoring your statements monthly and setting up transaction alerts can catch fraud early, before large amounts are charged.

How fraudsters get your card number

The most common source is a data breach — a hack of a retailer, restaurant, hotel, or bank that exposes millions of card numbers at once. When Target was breached in 2013, roughly 40 million card numbers were stolen. When Equifax was breached in 2017, personal information on 147 million people was exposed. These breaches are public news, but your card number may have been in a smaller breach you never heard about.

A skimmed card reader is a device a criminal installs on an ATM, gas pump, or payment terminal that copies your card data when you swipe or insert it. The thief returns later to retrieve the device and the stolen numbers. Skimmers are hardest to spot at unmanned machines like gas pumps and ATMs in remote locations.

A phishing email or text tricks you into entering your card number on a fake website that looks like your bank or a retailer. The criminal collects the information you type and uses it when ready. Phishing messages often create urgency — "Your account has been locked" or "Confirm your information now" — to make you act without thinking.

A stolen physical card is straightforward: someone takes your wallet, purse, or mail and uses the card before you notice it is gone. Mail theft is common enough that some people request their card issuer hold new cards at the branch instead of mailing them.

Criminals also copy card information from receipts you throw away, unsecured websites where you entered your number, or social engineering — calling your bank pretending to be you and convincing a representative to read back your number.

What happens when you report fraud to your card issuer

Call the number on the back of your card or log into your online account and report the fraudulent charges. Have your statement in front of you so you can point to the specific transactions. The card issuer will ask you to confirm which charges are yours and which are not — be clear about this, because they use your answer to investigate.

The issuer will cancel your current card when ready and order a replacement, which arrives in 5 to 10 business days. They will also reverse the fraudulent charges from your account while they investigate — you do not have to pay them or wait for the investigation to finish. Most issuers credit your account within 2 to 3 business days.

The investigation itself takes up to 10 business days. The issuer contacts the merchant where the fraud occurred, reviews the transaction details, and determines whether the charge was truly unauthorized. If the merchant confirms they did not process the transaction, or if the charge happened in a location you could not have been in, the fraud is confirmed and the charge stays reversed.

If the investigation finds the charge was authorized — for example, if a family member made the purchase without telling you — you may be held responsible. This is rare with true fraud, but it is why being specific about which charges you did not make matters.

Your legal protection against fraud

Federal law limits your liability to $50 per fraudulent transaction, and only if the fraud is reported after the charge posts. Most card issuers waive the $50 entirely and hold you responsible for $0. Check your card's terms to see what your issuer's policy is — many advertise zero fraud liability as a selling point.

This protection applies only to credit cards and debit cards issued by banks. Prepaid cards, gift cards, and some store cards have different rules and may not offer the same protection. If you use a debit card, report fraud even faster than you would with a credit card, because the money comes directly from your bank account and the timeline for recovering it is shorter.

The protection also assumes you reported the fraud in a timely manner. If you wait months to report it, the issuer may argue you were negligent in monitoring your account and reduce your protection. This is another reason to check your statement at least monthly and set up alerts.

How to spot fraud before it becomes a big problem

The easiest way is to review your statement monthly — either online or on paper — and look for charges you do not recognize. Most fraud is caught this way. You do not need to remember every purchase; you just need to notice something that looks wrong.

Set up transaction alerts through your card issuer's app or website. You can choose to be notified of any charge over a certain amount, any charge in a specific category, or any charge at all. Alerts arrive by text or email within minutes of the transaction, so you can report fraud while it is still happening instead of weeks later.

Watch for small test charges — $1 or $2 transactions from unfamiliar merchants. Fraudsters use these to confirm a stolen card number is active before attempting larger purchases. If you see one, report it when ready; the issuer will cancel the card and investigate.

Be cautious with your card number online. Only enter it on websites with "https://" in the address bar (the "s" means the connection is encrypted). Avoid using your card on public Wi-Fi networks. Do not reply to emails or texts asking you to confirm your card information — legitimate banks never ask this.

What to do if fraud happens repeatedly

If the same card number is used fraudulently multiple times, or if fraud happens again shortly after you report it, ask your card issuer whether the breach was on their end or yours. If the issuer's systems were compromised, they may offer you a new card number and extra monitoring. If the breach was at a retailer where you used the card, you may want to avoid that retailer or use a different payment method there.

Repeated fraud can also signal that your personal information — not just your card number — has been compromised. Consider placing a fraud alert with the three credit bureaus (Equifax, Experian, and TransUnion). A fraud alert tells creditors to verify your identity before opening new accounts in your name, which slows down identity theft. You can place a fraud alert for free by contacting any one of the three bureaus; they notify the other two automatically.

If fraud is tied to identity theft — meaning someone opened accounts or took out loans in your name — you may need to file a report with the Federal Trade Commission and take additional steps to find your credit. But card fraud alone, without identity theft, is usually resolved by canceling the card and reversing the charges.

Frequently Asked Questions

Can I be charged for fraud if I gave my card number to someone and they used it without permission?

It depends on whether you authorized the person to have the number. If you gave it to a family member or friend and they made a purchase you did not approve, that is technically not fraud — it is an unauthorized transaction between people who know each other. Your card issuer may still reverse the charge if you report it, but they may also ask you to resolve it with the person directly. True fraud involves someone you did not give the number to.

What if the fraudster used my card at a store in another state or country?

Report it anyway. The location does not matter for fraud protection — if you did not make the purchase, it is fraudulent regardless of where it happened. In fact, a charge in a location you could not have been in makes the fraud easier to prove. The card issuer will use location data as part of their investigation.

How long does it take to get my money back after I report fraud?

Most card issuers credit your account within 2 to 3 business days while they investigate. The formal investigation takes up to 10 business days. You should see the refund before the investigation is complete. If it takes longer than 10 business days, contact your issuer and ask for a status update.

Do I need to file a police report for credit card fraud?

You do not have to, and most police departments will not investigate card fraud because it is too common and the amounts are usually small. However, if the fraud is part of a larger identity theft scheme, filing a report creates an official record that can help you dispute fraudulent accounts. You can file a report online with your local police department or in person.

Will fraud hurt my credit score?

No. Fraudulent charges do not appear on your credit report because they are not legitimate debt. Once the issuer reverses the charges, they are gone from your account entirely. Your credit score is based on your payment history and credit usage, not on fraud that happened to you.