Picture a hypothetical Tuesday night. Your phone buzzes with a purchase alert: $412.88 at an electronics site you’ve never used. Two minutes later, another one for $389. The card is sitting in your wallet. You didn’t buy anything.
That sinking feeling is normal. The good news is that federal law puts most of the risk on the card issuer, not on you, as long as you act quickly and leave a paper trail. What you do in the next 24 hours determines how smooth the cleanup is.
The checklist
- Lock or freeze the card in your issuer’s app, if it offers that feature.
- Call the number on the back of the card and report the charges as fraud.
- Ask for a new card number and confirm the old one is closed.
- Note every unauthorized charge, the date you called and the name or ID of the representative.
- Follow up in writing to the issuer’s billing-dispute address.
- Change the password on the card account and on your email.
- Update autopay and subscriptions with the new number.
- Pull your credit reports and decide whether you need a fraud alert or a credit freeze.
Hour one: stop the bleeding
Most issuers let you lock a card from their app in seconds. A lock blocks new purchases but usually keeps the account open, which buys you time if you can’t get through on the phone right away. Do it first.
Then call. Use the number printed on the card or in the official app, never a number from a text or email that “alerted” you to the fraud. Scammers often follow a real breach with a fake fraud call asking you to “verify” your card number, PIN or a one-time code. A real issuer won’t ask you to read back a code it just sent you.
On the call, go through recent transactions line by line. Fraudsters often test a card with a tiny charge, a dollar or two, before a large purchase. Flag those too. Ask the representative to cancel the card, issue a new number and send you written confirmation that you reported the charges as unauthorized.
What the law says about your liability
The Fair Credit Billing Act limits what you can owe for unauthorized credit card use. According to the Federal Trade Commission, the most you can be held responsible for is $50 if your physical card was lost or stolen and used before you reported it. If only your card number was stolen and the card itself is still with you, you aren’t responsible for unauthorized charges at all. Many issuers also advertise zero-liability policies that go beyond the legal minimum.
The law also gives you a formal dispute process for billing errors, which includes unauthorized charges. To keep the full protection, send a written dispute to the address your issuer lists for billing errors so that it arrives within 60 days after the first statement showing the charge was sent to you. A phone call alone may not preserve those rights. The issuer must acknowledge your letter and resolve the dispute within set time limits, and it can’t make you pay the disputed amount while it investigates.
Debit cards work under a different law with weaker protection and tighter deadlines, which is one reason many people prefer credit cards for online shopping.
Hours two to six: close the side doors
Ask how the thief got the number. Sometimes the answer is a data breach at a merchant. Other times it’s your own account that was compromised. Assume the second until proven otherwise:
- Change your passwords for the card account and the email address tied to it. If you reused that password anywhere else, change it there too.
- Turn on two-factor authentication using an app or security key rather than text messages when possible.
- Check your other cards and bank accounts for anything odd. A thief with your email access can reach a lot more than one card.
- Look at saved payment methods in shopping and food delivery apps. A compromised account at a retailer can leak your card again after it’s replaced.
Hours six to 24: check whether it’s more than one card
A single stolen card number is a nuisance. A new account opened in your name is identity theft, and it needs a different response. Pull your credit reports from Equifax, Experian and TransUnion through AnnualCreditReport.com and look for accounts, addresses or hard inquiries you don’t recognize.
If you see signs of broader misuse, you have two free tools:
- Fraud alert. Placing one with any one of the three bureaus requires lenders to take extra steps to verify your identity before opening new credit. That bureau must notify the other two. An initial alert lasts one year.
- Credit freeze. A freeze blocks most new lenders from seeing your report at all, which stops most new accounts cold. It’s free, and you place it separately with each bureau. You can lift it temporarily when you apply for credit yourself.
If someone opened accounts in your name, report it at IdentityTheft.gov. The site builds a personal recovery plan and an identity theft report you can use to dispute fraudulent accounts with creditors and bureaus.
After the dust settles
Once the new card arrives, update every place the old number lived: utilities, phone plan, subscriptions, insurance premiums, digital wallets. Missing one can lead to a failed payment that looks like your fault. Our guide on what happens after a missed payment explains why it’s worth catching those fast.
Watch the next two statements closely. The disputed charges should show as credits, either provisional or final. If the issuer reverses a provisional credit, it has to explain why in writing, and you can ask for the documents it relied on.
Then set up habits that make the next incident smaller:
- Turn on real-time alerts for every transaction, not just large ones. Thieves count on small test charges going unnoticed.
- Use your phone’s digital wallet or a virtual card number for online purchases where available, so merchants never store your real number.
- Read every statement, even on cards you rarely use.
Frequently asked questions
Will credit card fraud hurt my credit score?
Unauthorized charges on an existing account shouldn’t, provided you dispute them. The issuer can’t report the disputed amount as delinquent while the dispute is open. The risk comes from new accounts opened in your name, which is why checking your reports matters.
Should I file a police report?
For a single compromised card that the issuer is handling, it’s usually not required. For identity theft involving new accounts, an identity theft report from IdentityTheft.gov is often enough for creditors, though some situations, such as debt collectors or a known suspect, may call for a police report too.
Can I keep my old card number?
No. Once a number is compromised, the issuer will close it and send a new one. Your account history, credit limit and rewards normally carry over to the replacement.
What if the charge is from a merchant I did use, but the amount is wrong?
That’s a billing error rather than fraud. Contact the merchant first, then use the same written dispute process with your issuer if it isn’t fixed.
