Credit Card Fraud: Prevention, Reporting, and Your Rights

Credit card fraud prevention and your legal rights come down to a few things worth knowing before anything goes wrong: federal law caps your personal liability for unauthorized charges at $50, the major card networks voluntarily reduce that to zero, and you have a formal written dispute process under the Fair Credit Billing Act that must be used within 60 days of the statement showing the charge. Prevention is mostly a matter of layering: a mobile wallet or virtual card number for online purchases, real-time alerts from your bank, and a habit of checking terminals before you insert your card. The rules below spell out what to do before and after fraud happens, and where the boundaries of your protection actually sit.

What You Actually Owe If Your Card Is Used Fraudulently

Under 15 U.S.C. § 1643, part of the Truth in Lending Act, a card issuer can hold you liable for unauthorized use only when a specific set of conditions is met, and even then your liability is capped at $50.¹ When only your card number is stolen and the physical card stays with you, issuers have a harder time meeting those conditions at all.

In practice, the $50 figure rarely comes up. Visa’s Zero Liability Policy guarantees cardholders won’t be held responsible for unauthorized charges and requires issuers to replace stolen funds within five business days of notification.² Mastercard and the other major networks maintain similar policies. These are voluntary, though, and can be withheld for gross negligence or delayed reporting, so speed still matters.

One boundary is worth knowing before you swipe: debit cards are not credit cards for liability purposes. They fall under the Electronic Fund Transfer Act, and your exposure grows with time. Report within two business days of discovering the fraud, and you’re capped at $50. Wait longer than that but report within 60 days of the statement, and the cap rises to $500. Miss the 60-day window, and you can lose everything the thief took after that point.³ For everyday purchases, this is the strongest practical argument for reaching for the credit card instead.

Preventing Fraud in Person

The three-digit code on the back of your card is a secondary verification tool that thieves target through hidden cameras at checkout counters or quick visual scans while you pay. Keep the card face-down or in your hand until you need it, and cover the keypad when entering a PIN.

Skimmers remain a persistent threat at ATMs and gas pumps. These overlays sit on top of the real card slot and capture magnetic stripe data as you insert the card. Before you use a terminal, pull on the card slot and keypad. Legitimate hardware is bolted in; a skimmer attached with adhesive will flex or shift. If anything feels loose, walk to a different machine.

Electronic pickpocketing (a thief with a portable scanner reading contactless card data through a pocket or bag) is a lower-probability risk but a cheap one to close off. RFID-blocking wallets contain materials that block the signals those scanners rely on.

Preventing Fraud Online and on Your Phone

Stolen card numbers can be used without the physical card, which is why online fraud accounts for a disproportionate share of losses. A few layers help.

Virtual Card Numbers and Mobile Wallets

Many issuers now offer virtual card numbers: temporary, one-time or merchant-specific digits tied to your real account. If the merchant is breached, the token is useless anywhere else.

Mobile wallets like Apple Pay and Google Pay use the same tokenization principle and add another layer. Your actual card number is never shared with the merchant during an in-store, in-app, or online transaction. Each payment generates a unique one-time cryptogram that confirms the transaction came from your device, and the wallet requires fingerprint, face scan, or passcode authentication before any payment goes through. If your physical card is lost, you can keep making purchases through the wallet while a replacement is in the mail.

Encrypted Connections and Multi-Factor Authentication

The “HTTPS” prefix in your browser’s address bar means the connection is encrypted, which prevents attackers from intercepting card data in transit. Don’t enter payment information on a site showing only “HTTP.”

Turn on multi-factor authentication for your banking apps. It adds a second verification step, usually a code sent by text or generated by an authenticator app, that stops someone who has your password but not your phone. Avoid financial transactions over public Wi-Fi, where an attacker can position themselves between your device and the network.

Real-Time Alerts From Your Bank

Most banks run monitoring that flags transactions falling outside your usual patterns, and most banking apps can send you a push notification or text the moment a transaction posts. These alerts are one of the most useful fraud-prevention tools available because they let you catch an unauthorized charge within minutes rather than weeks. If you haven’t turned them on, do it in your app’s notification settings.

Reporting a Fraudulent Charge

The moment you see an unauthorized charge, call your card issuer and ask that the card be blocked or replaced.⁴ Most apps also let you freeze the card yourself while you gather details for a formal dispute.

For the dispute itself, you’ll need your account number, the merchant name exactly as it appears on your statement, the date of the transaction, and the exact dollar amount. Most issuers offer an online dispute form in the security or help section of the app, and you’ll receive a confirmation number.

The Written 60-Day Notice

Federal law gives you a separate, more formal route with stronger legal protections: a written billing error notice under 15 U.S.C. § 1666. This written notice must reach the creditor’s designated billing inquiries address (not the general payment address) within 60 days of the date the creditor sent the statement showing the error.⁵ The notice needs to identify your name and account number, state that you believe the statement contains a billing error, explain the amount, and give your reasons. Send it by certified mail so you have proof you met the deadline.

Miss the 60-day window and you can lose the Fair Credit Billing Act’s legal protections entirely, potentially leaving you responsible for charges you didn’t authorize. The billing inquiries address is printed on your statement and is not the same as the payment address.⁶

Once the creditor receives a valid written billing error notice, it must send you a written acknowledgment within 30 days. It then has two complete billing cycles, but no more than 90 days, either to correct the error or to send a written explanation of why it believes the charge is valid.⁵

Your Rights While the Investigation Is Pending

While the creditor investigates, you are not required to pay the disputed amount or any related finance charges and fees, and the creditor cannot try to collect them. If you’re on autopay, the creditor must stop deducting the disputed portion, provided you submitted your billing error notice at least three business days before the next scheduled payment.⁶

The creditor is also barred from reporting the disputed amount as delinquent to credit bureaus or threatening adverse credit reporting during the investigation. Your statement may still show the charge, but it must include a notice that payment isn’t required until the dispute is resolved.⁷

Many banks issue a provisional credit while they investigate, temporarily restoring the amount to your available balance. That’s an industry practice, not a legal requirement.

If Your Dispute Is Denied

If the creditor concludes no billing error occurred, it must send you a written explanation and, on request, copies of the documentary evidence it relied on.⁶ Ask for the evidence every time. It shows the basis for the denial and gives you something to work from if you escalate.

If you think the denial is wrong, file a complaint with the Consumer Financial Protection Bureau. The CFPB forwards your complaint directly to the company and tracks the response. Companies generally respond within 15 days, though complex cases may take up to 60. The CFPB also shares complaint data with other federal and state enforcement agencies.⁸

Stopping the Wider Damage

Disputing the charge fixes the immediate financial problem. It doesn’t stop a thief from using your information to open new accounts in your name. Three additional steps close that gap.

Fraud Alerts

Under 15 U.S.C. § 1681c-1, you can place a fraud alert on your credit file by contacting any one of the three major credit bureaus, which is then required to notify the other two. An initial fraud alert lasts at least one year and signals to any lender pulling your report that it should take extra steps to verify your identity before extending credit. While the alert is active, you’re also entitled to a free copy of your credit report.⁹

Credit Freezes

A credit freeze (also called a security freeze) goes further. It blocks credit bureaus from releasing your report to new creditors entirely, which prevents anyone from opening accounts in your name. Federal law requires all three major bureaus to place and lift freezes for free. You’ll get a PIN or password to temporarily lift the freeze when you apply for legitimate credit.

FTC Identity Theft Reports

The Federal Trade Commission runs IdentityTheft.gov as the federal government’s centralized resource for reporting and recovering from identity theft. Filing a report there produces a personalized recovery plan, pre-filled letters you can send to creditors, and documentation that serves as proof of the crime when you deal with banks and credit bureaus.¹⁰

Boundaries Worth Knowing

A few situations sit outside the protections most people assume cover them.

Merchant disputes are not the same as fraud disputes. If you’re contesting defective goods, undelivered services, or a billing mistake by a merchant, 15 U.S.C. § 1666i lets you assert claims against your card issuer, but the transaction generally must exceed $50 and must have occurred in your home state or within 100 miles of your billing address.¹¹ Those limits don’t apply if the merchant is the issuer or is controlled by the issuer, or if the transaction came through a mail or online solicitation the issuer participated in. You also have to try to resolve the problem with the merchant first, and you can recover only the amount still outstanding on the transaction when you notify the issuer.

Business cards work differently. If your employer issues you a company card, your personal exposure is still protected. Under 15 U.S.C. § 1645, when a business issues cards to ten or more employees, the company and the issuer may negotiate their own terms for the business’s liability, but the statute prohibits either from imposing more than $50 in liability on an individual employee.¹² The business itself may face higher contractual liability, and small businesses with fewer than ten cardholding employees don’t fall under this provision. Zero-liability policies for consumer cards often don’t extend to business accounts, so read the cardholder agreement.

Tax deductions generally don’t apply. For tax years beginning after 2017, personal casualty and theft losses are deductible only if attributable to a federally declared disaster. Credit card fraud doesn’t qualify, so personal losses from unauthorized charges generally can’t be deducted. Two narrow exceptions exist: fraud in a transaction you entered into for profit may still be deductible as a theft loss on income-producing property, and personal casualty gains in the same tax year can be offset by unrelated personal theft losses.¹³

1
Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card
2
Visa. Visa Zero Liability Policy
3
Office of the Law Revision Counsel. 15 US Code 1693g – Consumer Liability
4
Office of the Comptroller of the Currency. Credit Card and Debit Card Fraud
5
Office of the Law Revision Counsel. 15 USC 1666 – Correction of Billing Errors
6
Consumer Financial Protection Bureau. 12 CFR 1026.13 – Billing Error Resolution
7
eCFR. Truth in Lending – Regulation Z
8
Consumer Financial Protection Bureau. Submit a Complaint
9
Office of the Law Revision Counsel. 15 US Code 1681c-1 – Identity Theft Prevention; Fraud Alerts
10
Federal Trade Commission. Report Identity Theft
11
Office of the Law Revision Counsel. 15 USC 1666i – Assertion by Cardholder Against Card Issuer of Claims and Defenses
12
Office of the Law Revision Counsel. 15 US Code 1645 – Business Credit Cards; Limits on Liability of Employees
13
Internal Revenue Service. Publication 547 – Casualties, Disasters, and Thefts