Your bank can see the merchant, the exact amount, the timestamp, an approximate location from the IP address, and details about the device and browser used, but it cannot see who was actually holding the phone or sitting at the keyboard. So the honest answer to whether the bank can see who used your card online is no, not the person. What the bank can do is compare the transaction’s digital fingerprint against your usual patterns and, if you report an unauthorized charge, apply federal rules that cap what you owe.
What Your Bank Actually Sees
Every online purchase sends a defined set of data through the payment processor to your card issuer. The bank records the merchant’s registered business name, the dollar amount, and the moment the transaction was authorized. Alongside that, it receives technical metadata: the IP address tied to the network used at checkout, plus information about the device, operating system, and browser. IP-based geolocation is imprecise, generally accurate to a city or region rather than a street address.
Many transactions now pass through an additional authentication layer called 3D Secure, branded as Visa Secure or Mastercard Identity Check. It exchanges data between the merchant, your issuer, and sometimes you directly through a one-time code or a biometric prompt on your phone.1Visa. Visa Secure EMV 3-D Secure for Merchants The newer version of the protocol shares over 150 data elements with the issuer to help it assess risk in real time. None of that data confirms the identity of the human on the other end.
Why Authentication Is Not the Same as Identification
Unlike an ATM with a camera, online purchases have no visual verification. Banks rely on credentials: a saved password, a texted code, a stored fingerprint. If a family member, a roommate, or a thief has those credentials, the system treats the purchase as yours. Fraud detection only flags something when the digital fingerprint drifts sharply from your history, such as a charge from an unusual country or an amount well outside your normal range.
This shapes how disputes go. When you report a charge as unauthorized, the bank weighs the technical markers against your profile, but it cannot definitively prove or disprove who pressed “buy.”
What You Owe If Someone Uses Your Card
Because the bank cannot identify the user, federal law does the sorting instead. It sets ceilings on your liability, and the ceilings differ sharply between credit and debit.
Credit Cards
Your liability for unauthorized credit card charges is capped at $50, regardless of how much the thief spent or how long the fraud ran.2Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card Report the card before any unauthorized charge appears and you owe nothing. The Fair Credit Billing Act also lets you dispute billing errors, including charges for items never delivered or wrong amounts, by sending written notice to your issuer within 60 days after the statement containing the error was mailed to you.3Office of the Law Revision Counsel. 15 USC 1666 – Correction of Billing Errors Most issuers accept disputes through their app or website, but the statute requires written notice. A follow-up letter sent by certified mail to the billing inquiries address on your statement preserves your rights most reliably.
Debit Cards
Debit protections under Regulation E depend on how fast you notify the bank after learning of the unauthorized transfer, and delay is expensive:
- Within 2 business days: your loss is limited to $50 or the amount of unauthorized transfers before notice, whichever is less.4eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
- After 2 business days but within 60 days of your statement: liability can rise to $500.4eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
- After 60 days: unlimited liability for transfers that occur after the 60-day window, if the bank can show they would not have happened had you reported sooner.5Consumer Financial Protection Bureau. 1005.6 Liability of Consumer for Unauthorized Transfers
A delay of a few days can move your exposure from $50 to $500. Waiting past 60 days can leave you responsible for the entire loss.
When Only the Card Number Was Stolen
Most online fraud involves a stolen card number rather than a lost physical card. Regulation E treats that differently. When unauthorized transfers happen without the physical access device, the $50 and $500 tiers do not apply. You have no liability for transfers you report within 60 days of your statement. Miss that window and you become liable for transfers that occur after the deadline.6Consumer Financial Protection Bureau. Comment for 1005.6 Liability of Consumer for Unauthorized Transfers
Visa and Mastercard Zero-Liability Policies
In practice, most cardholders end up owing nothing. Visa and Mastercard both apply zero-liability policies that go beyond federal minimums, covering unauthorized transactions made online, in stores, over the phone, and at ATMs. Mastercard’s policy removes your liability for unauthorized charges as long as you used reasonable care to protect the card and reported the loss promptly.7Mastercard. Zero Liability Protection These policies typically exclude certain commercial cards and unregistered prepaid cards like gift cards. Where a network policy conflicts with applicable law, the law controls.
How to Report an Unauthorized Charge
Before you call, pull together a few things so the process moves quickly:
- The date, amount, and merchant name as they appear on your statement, plus any transaction ID.
- Your card number or last four digits and the name on the account.
- A short description of the problem: completely unauthorized, duplicate, item never received, or wrong amount.
- Any emails, chats, or call records showing you tried to resolve it with the merchant first.
You can file a dispute through your bank’s app or website (most have a “Dispute a Charge” link inside the transaction detail), by calling the fraud number on the back of the card, or by mailing a letter to the billing inquiries address on your statement. For credit card disputes, sending written notice by certified mail is the safest way to lock in your rights under the Fair Credit Billing Act, even if you also file online.3Office of the Law Revision Counsel. 15 USC 1666 – Correction of Billing Errors
What Happens After You File
For credit cards, your issuer must acknowledge a written complaint within 30 days and resolve the dispute within two full billing cycles, no more than 90 days from receipt of your notice.8Consumer Advice – FTC. Using Credit Cards and Disputing Charges
For debit cards, the clock is tighter. The bank must investigate within 10 business days of receiving your error notice. It can extend the investigation to 45 days, but only if it provisionally credits your account within those first 10 business days.9Consumer Financial Protection Bureau. 1005.11 Procedures for Resolving Errors For point-of-sale debit disputes, the extended deadline stretches to 90 days. The provisional credit stays in your account until the bank reaches a final decision; if it concludes no error occurred, it can reverse the credit after notifying you.
Expect the compromised card to be canceled and reissued with a new number. In some cases the bank places temporary restrictions on the account while it reviews the situation, and it is not always transparent about why or for how long.
While a credit card dispute is under investigation, your issuer cannot report the disputed amount as delinquent to credit bureaus. If the investigation concludes you owe the amount, you get at least 10 days to pay before any delinquency can be reported. If you keep disputing the charge in writing, the issuer can report you as delinquent, but the report must note the amount is still in dispute, and the issuer must tell you who received the delinquency report.10Office of the Law Revision Counsel. 15 USC 1666a – Regulation of Credit Reports
If Your Dispute Is Denied
A denial is not the end. For credit card disputes, you can appeal within the time period your issuer gives you for payment, or 10 days after receiving the explanation, whichever is later.8Consumer Advice – FTC. Using Credit Cards and Disputing Charges
For debit disputes, the bank must send you a written explanation of its findings and tell you that you can request the documents it relied on.9Consumer Financial Protection Bureau. 1005.11 Procedures for Resolving Errors Reviewing those documents often surfaces gaps in the investigation or new evidence you can add. If you withdrew a dispute earlier and want to reassert it, you can, as long as you are still within the original 60-day reporting window.
If the bank will not move, you can file a complaint with the Consumer Financial Protection Bureau, which oversees both credit and debit dispute rules. Small claims court is a last resort; filing fees vary by jurisdiction and generally run from roughly $30 to $75, though they can be higher depending on the amount claimed.
A Warning About Disputing Charges You Actually Made
Filing a dispute for a charge you authorized, sometimes called friendly fraud or first-party fraud, carries real risk. At a minimum, your bank may close the account and flag you internally, which can make it hard to open accounts elsewhere. The federal bank fraud statute makes it a crime to obtain money from a financial institution through false representations, punishable by a fine of up to $1,000,000, up to 30 years in prison, or both.11Office of the Law Revision Counsel. 18 USC 1344 – Bank Fraud Prosecutions of individual false chargebacks are uncommon, but merchants and banks increasingly use the same technical evidence that limits what the bank can see about a legitimate user, IP matches, delivery records, and authentication logs, to identify fraudulent claims.