Can Someone Use My Credit Card With Just the Number?

Yes, someone can use your credit card with just the number, but only at merchants that don’t ask for the other pieces of data printed on the card or tied to your account. Even when a thief pulls it off, federal law caps your personal liability at $50, and Visa, Mastercard, and most major issuers waive even that if you report the charge on time. The real work on your end is spotting the charge and disputing it inside the legal window.

What the Number Alone Can and Can’t Do

Online and phone purchases are card-not-present transactions: no swipe, no tap, no chip. The merchant sends the numbers you typed to your issuer, the issuer checks that the account is active and the data matches, and the charge goes through or gets declined. The system has no way of knowing whose fingers are on the keyboard.

That’s why most merchants ask for more than the long account number. Each additional field is a gate that stolen data has to clear:

The CVV, the three-digit code on the back of the card (four digits on American Express). Card networks prohibit merchants from storing it after a transaction, so it’s harder to grab in a database breach.
The expiration month and year, which have to match what the issuer has on file.
Address Verification System checks that compare the billing zip code you enter to the one on your account. A mismatch can trigger a decline or a manual review.
3D Secure authentication, where your bank sends a one-time passcode to your phone or asks for a fingerprint or face scan before approving. Stolen numbers are essentially useless against this because the thief also needs your device.

Not every merchant enforces every check. Smaller retailers sometimes skip the CVV or address verification to keep checkout smooth. Subscription services often process recurring charges without re-verifying the security code. Automated fraud tools can also generate valid-looking numbers by cycling through digits behind a known Bank Identification Number, then testing them against merchants with weak filters. Those gaps are where a bare account number becomes enough.

What You Actually Owe if a Thief Succeeds

Federal law tilts hard in your favor. Under the Truth in Lending Act, your maximum liability for unauthorized credit card use is $50, and that cap only applies if the issuer met a set of conditions, including giving you notice of your potential liability and providing a way to identify authorized users.¹ If any of those conditions aren’t met, the statute says you owe nothing.

In practice the $50 rarely comes up. Visa, Mastercard, and most major issuers keep voluntary zero-liability policies that eliminate even that amount for cardholders in good standing. So if someone runs charges on your stolen number, you’re almost certainly not paying.

One detail that trips people up: the burden of proof is on the card issuer, not you. If the issuer wants to hold you liable, the issuer has to show the use was authorized or that all statutory conditions for liability were met.¹ You don’t have to prove you didn’t make the purchase.

The 60-Day Dispute Window

To keep those federal protections, you have to send written notice of the billing error to your issuer within 60 days of the statement date on which the unauthorized charge appeared.² Calling is a fine first move, but the written notice is what starts the legal clock.

Once the issuer has your written dispute, it has to acknowledge it within 30 days and finish the investigation within two complete billing cycles, and no later than 90 days.² While the case is open you don’t pay the disputed amount or any interest on it, and the issuer cannot report it as delinquent to the credit bureaus.³ A fraud dispute you reported on time should not damage your credit score.

Miss the 60 days and you lose the right to withhold payment, and the issuer no longer has to investigate. Treat it as a hard deadline.

Debit Cards Are a Different Story

If the stolen number is on a debit card rather than a credit card, everything above changes. Debit charges pull directly from your checking account, and the federal protections under Regulation E depend entirely on how fast you report.

Report within 2 business days and your liability is capped at $50.⁴
Between 2 and 60 days, liability jumps to as much as $500.⁴
After 60 days, you can be liable for everything stolen past that point, with no cap.⁴

There’s also a cash-flow problem credit cards don’t have. A fraudulent credit charge is a line on a statement you can dispute before paying. A fraudulent debit charge is money already gone from your account, and getting it back can take days or weeks. Bills can bounce and overdraft fees can stack up in the meantime. If you have a choice about which card to type into an online checkout, that’s the case for credit over debit.

What to Do the Moment You See a Charge You Didn’t Make

Move fast, especially on debit, where the liability tiers are measured in business days.

Call your card issuer. The number is on the back of the card and on your statement. Ask to freeze or cancel the card and have a replacement issued. That stops further charges.
Send a written billing error notice within 60 days to the dispute address your issuer designates, which is usually not the payment address. Include your name, account number, the disputed amount, and why you believe it’s unauthorized. Keep copies.⁵
Check your other accounts. If one number leaked through a breach or phishing message, others may be exposed too. Look at bank accounts, other cards, and saved payment methods for anything unfamiliar.

Log every call: the date, who you spoke to, and what was said. If the dispute drags, that log is your evidence that you acted on time.

Cutting Your Exposure Going Forward

You can’t stop retailers from getting breached, but you can shrink what stolen data is worth.

Virtual Card Numbers

Several major issuers let you generate a temporary number tied to your real account. You use the virtual number at checkout, and if that merchant is later breached, the stolen number is either expired or locked to that one retailer. Some virtual cards can be set to deactivate after a single use or a set dollar amount, which makes them useless to anyone who intercepts them later.

Fraud Alerts and Credit Freezes

If your data was exposed in a large breach, add a layer at the credit bureau level. A fraud alert tells lenders to verify your identity before opening any new account; you only have to contact one of the three major bureaus and it notifies the other two. A freeze goes further and blocks access to your credit report entirely until you lift it, which stops anyone from opening new accounts in your name, including you.⁶ Both are free. An alert is the lighter option; a freeze fits when you know your information has been significantly compromised.

Everyday Habits

Check your statements at least once a week instead of waiting for the monthly cycle. Turn on transaction alerts in your issuer’s app so every charge triggers a push notification. Don’t enter card details on a site you reached through a link in an email or text; the FTC notes that legitimate companies won’t email or text you a link to update payment information.⁷ And when a retailer offers to save your card, weigh the convenience against adding your number to one more database that could be breached later.

1
Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card
2
Consumer Financial Protection Bureau. Regulation Z 1026.13 – Billing Error Resolution
3
Federal Trade Commission. Fair Credit Billing Act
4
eCFR. 12 CFR Part 205 – Electronic Fund Transfers (Regulation E)
5
Consumer Financial Protection Bureau. How Do I Dispute a Charge on My Credit Card Bill?
6
Federal Trade Commission. Credit Freezes and Fraud Alerts
7
Federal Trade Commission. How To Recognize and Avoid Phishing Scams