Someone can use your credit card without ever holding it because an online, phone, or mail-order purchase only needs three things: the card number, the expiration date, and the security code. Those three pieces of data can be stolen through a breach, captured by malware, guessed by software, tricked out of you over the phone, or copied at a card reader you never suspected. Once a thief has them, any merchant that accepts card-not-present transactions will treat the charge as legitimate until you say otherwise.
The good news is that federal law and the major card networks put almost all of the financial risk on the issuer, not on you, as long as you catch the fraud and report it in time.
Stolen in Bulk: Data Breaches
Large-scale breaches at retailers, hotels, and service providers are one of the biggest sources of stolen card data. Hackers can walk away with millions of numbers at once, then resell them in bulk on dark-web marketplaces. A single card’s details might sell for anywhere from a few dollars to about fifty, depending on the credit limit and the issuing bank. The person who ultimately runs charges on your card is often not the person who stole the data in the first place; they simply bought it.
Captured From Your Own Devices
Malicious software installed on your computer or phone can silently record every keystroke you make. When you type your card number at an online checkout, a keylogger sends the data straight to an attacker’s server. This kind of software often arrives through infected email attachments, shady app downloads, or compromised websites, and it can run undetected for months.
Public Wi-Fi creates a related risk. On an unencrypted network, a tool called a packet sniffer lets an attacker read data traveling between your device and the router. If the site you’re shopping on doesn’t use a secure connection, your card details can be picked up in plain text as they cross the network.
Guessed by Software: BIN Attacks
Sometimes a thief doesn’t need to steal your specific card number. They generate it. Every card begins with a bank identification number, or BIN, made up of the first four to six digits that identify the issuing bank. Because BINs are publicly known, criminals run automated software that rapidly produces and tests possible combinations of the remaining digits, expiration dates, and security codes. They verify each guess with a small charge at an online merchant. When one goes through, they save the working combination and start making larger purchases before the card can be canceled.
Handed Over: Phishing, Smishing, and Vishing
Social engineering gets you to give up the details yourself. Phishing emails imitate the branding of banks and major retailers, usually with a warning about a locked account or suspicious activity and a link that leads to a lookalike login page. Anything you type on that page goes to the attacker.
The same trick works over text (smishing) and by phone (vishing). A caller pretending to be a fraud investigator asks you to “confirm” your card number to protect your account. Automated systems let scammers reach thousands of people at once, and the manufactured urgency pushes targets to respond before they think it through. The charges follow within minutes.
Copied in Person, Used Online
Physical proximity still matters even when the card stays in your wallet. Shoulder surfing, meaning simply watching you enter your details in a store or coffee shop, needs nothing more than a good angle. A dishonest employee at a restaurant or checkout counter can photograph both sides of the card with a phone in seconds.
Skimmers are small hardware devices attached to legitimate card readers at gas pumps and ATMs. A related device, a shimmer, sits inside the card slot between the chip and the reader and copies data from a chip transaction. The stolen information is used to build a digital profile of your card and run purchases online, so the thief never needs the plastic itself.
Spotting the Charges Early
Fraudsters usually test stolen data with tiny purchases, sometimes under a dollar, to confirm the card is active before running up bigger amounts. If the test charge goes unnoticed, larger ones follow. Checking your transaction history regularly, rather than waiting for your monthly statement, is the most reliable way to catch fraud early. Most banking apps let you turn on push notifications for every transaction, so an unauthorized charge shows up on your phone within minutes.
When you review a statement, look for unfamiliar merchant names, charges in cities you haven’t visited, and duplicate transactions. Write down the exact date, the merchant name as printed, and the dollar amount of anything suspicious. You’ll need those details when you call your issuer.
What You Actually Owe if It Happens
Federal law limits your personal exposure to unauthorized credit card charges. Under Regulation Z, your liability cannot exceed the lesser of $50 or the amount charged before you notified the issuer, so once you report the fraud you owe nothing for charges that follow.1eCFR. 12 CFR 1026.12 – Special Credit Card Provisions If the issuer failed to give you adequate notice of your potential liability or a way to report loss, even that $50 cap may not apply.2Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card
In practice you’ll likely owe nothing at all. Visa and Mastercard both maintain zero-liability policies that cover unauthorized transactions made in stores, online, by phone, or at ATMs, going well beyond the federal $50 floor.3Visa. Visa Zero Liability Policy4Mastercard. Mastercard Zero Liability Protection Policy Those policies generally require that you used reasonable care in protecting the card and reported the fraud promptly. Anonymous prepaid cards and certain commercial cards are typically excluded.
The 60-Day Deadline
The Fair Credit Billing Act gives you 60 days after the card issuer sends a billing statement to submit a written dispute about any charge on that statement. Miss the window and you lose important protections; the issuer is no longer required to investigate or correct the error. Your written notice has to go to the issuer’s billing inquiries address, which is different from the payment address. Both are printed on your statement. Include your name, account number, the amount you believe is wrong, and a short explanation of why.
A Note on Debit Cards
If the compromised card is a debit card, a different federal law applies and the stakes are higher because the money leaves your checking account directly. Under Regulation E, your liability is capped at $50 if you report within two business days, can rise to as much as $500 if you report between two and 60 days, and is uncapped for unauthorized transfers that happen after the 60-day window closes.5Consumer Financial Protection Bureau. Regulation E 1005.6 – Liability of Consumer for Unauthorized Transfers Report suspicious debit charges immediately, even small ones.
Disputing the Charge
Call your issuer as soon as you see an unauthorized transaction. You can report fraud by phone, in person, or in writing; any method that gets the information to the issuer counts as notification.1eCFR. 12 CFR 1026.12 – Special Credit Card Provisions The issuer will normally freeze or cancel the compromised number and send a replacement. If the card is tied to automatic payments, update those accounts with the new number. Some networks push updated card details to merchants with recurring billing relationships, but not every merchant participates.
Once you formally dispute a charge, the issuer has two complete billing cycles, and no more than 90 days, to investigate and resolve the claim.6eCFR. 12 CFR 1026.13 – Billing Error Resolution During that period the issuer cannot try to collect the disputed amount, charge you interest on it, or report it as delinquent.7Consumer Financial Protection Bureau. Regulation Z 1026.13 – Billing Error Resolution Some issuers give you a temporary credit while the investigation runs, though they aren’t legally required to. If the investigation confirms the charge was fraudulent, the credit becomes permanent and the charge comes off your statement.
When to File an FTC Identity Theft Report
A single fraudulent charge on one card usually just needs a dispute with your issuer. If your card information is being used across multiple accounts, or if someone has opened new accounts in your name, that’s identity theft, and an FTC Identity Theft Report gives you stronger legal tools. You can file one for free at IdentityTheft.gov, where you answer questions about what happened and receive a personalized recovery plan.8Federal Trade Commission. IdentityTheft.gov
The report unlocks specific rights: an extended fraud alert on your credit reports lasting seven years, the ability to require creditors to stop reporting fraudulent accounts, the right to block fraudulent debts from appearing on your credit file, and access to copies of transaction records or applications the thief submitted in your name.9Federal Trade Commission. Identity Theft: A Recovery Plan Sending a copy of the report to debt collectors also requires them to stop collection activity on the fraudulent accounts.
Reducing the Odds Going Forward
A few habits shrink the chance that your card details get taken in the first place, and shorten the window if they do. Turn on real-time transaction alerts in your banking app so every charge lands on your phone. Use single-use or merchant-locked virtual card numbers for online shopping if your issuer offers them; a compromised virtual number can’t be reused elsewhere. Avoid public Wi-Fi for purchases, or run a VPN if you have to shop on one. Treat tiny unfamiliar charges as a warning sign rather than a rounding error. And after any card replacement, walk through your subscriptions and bills to update the number, so a legitimate charge doesn’t get declined while you’re focused on the fraudulent one.
If you want a stronger backstop against someone using stolen personal information to open new accounts in your name, a credit freeze blocks new credit accounts from being opened until you lift it, and is free to place and remove at all three major credit bureaus under federal law.10Federal Trade Commission. Free Credit Freezes Are Here A freeze won’t stop someone from using existing card numbers, but it closes off a common next step after a card is compromised. A fraud alert is a lighter option that tells lenders to verify your identity before approving a new application.11Federal Trade Commission. Credit Freezes and Fraud Alerts