Credit Card Fraud: What It Is and What to Do
A charge you do not know is on your card. Here is what credit card fraud is, what the law says, and what to do first.
A charge you do not recognize shows up on your card. Maybe the card is still in your wallet. Someone, somewhere, has your details.
What credit card fraud means
Credit card fraud is the use of your card details without your permission. That can mean a thief charges your card number, or opens a card in your name. The card itself may never leave your hands.
It is not the same as identity theft. Identity theft is broader. Card fraud can be one part of that. If someone opened a card in your name, the FTC says to visit IdentityTheft.gov to report identity theft and get a recovery plan.
It is also not the same as debit card fraud. A debit card pulls money straight from your bank account. A credit card is a debt you pay later. That difference matters for what you could owe. If your case involves a debit card, or both, see our page on debit card fraud.
How credit card fraud happens
Thieves have many ways to get card details.
- Stolen cards. A lost or stolen card is used before you notice it is gone.
- Skimming. See our page on ATM card skimming.
Some cases cross into wider account fraud. If money left your bank account, our page on bank fraud covers that side of things.
What federal law says about unauthorized charges
The FTC says federal law protects you from unauthorized use of your credit card. The rules depend on when you report.
The FTC says you are not responsible for unauthorized charges on a credit card if you report the loss before someone uses it. If you report after someone uses it, the FTC says the most you might owe is $50.
There is a second layer. Regulation Z says a card issuer is not required to impose liability on a cardholder for the unauthorized use of a credit card. Regulation Z also says that if state law or an agreement between you and the issuer imposes lesser liability, the lesser liability governs.
Report the card to the issuer as soon as possible
The FTC says to report a lost or stolen card to the bank or credit union that issued it as soon as possible. Speed matters. The FTC says federal law does not make you pay for charges or withdrawals made without your permission after you report the loss.
You do not have to be the one who reports it. Regulation Z's official interpretation says notice of loss, theft, or possible unauthorized use need not be initiated by the cardholder.
Regulation Z says notification may be given, at the option of the person giving it, in person, by telephone, or in writing. So a call works. So does a letter.
If your case mixes a credit card with a debit card or bank transfer, Regulation Z says to check Regulation E for guidance when a case has both credit and electronic fund transfer aspects.
What the investigation may ask of you
Regulation Z describes what a card issuer may request as part of a reasonable investigation. Regulation Z says the card issuer may reasonably request the cardholder's cooperation. In practice, that can include several things.
Regulation Z says a card issuer may request documentation to assist in the verification of the claim. It may also require a written, signed statement from you or an authorized user. If you filed a police report, Regulation Z says the issuer may request a copy of it.
Keep checking statements and protect your accounts
The FTC says to keep checking your account statements and report fraudulent charges right away. Its advice is to open your monthly credit card statements promptly and compare the balance and charges with your receipts.
The FTC's advice is to protect your accounts by using multi-factor authentication when it is available. The FTC also says to check your free credit reports for accounts or charges you don't recognize. It says to check whether your homeowner's or renter's insurance covers you for card thefts.
For more ways to make things harder for thieves, see our page on how to prevent credit card fraud.
Where to go next
If the card was used but your identity was not, start with your issuer. If accounts were opened in your name, the FTC says to visit IdentityTheft.gov to report identity theft and get a recovery plan. If a debit card or bank account was hit, see our page on debit card fraud. If money left your account another way, see our page on bank fraud.