If your card never left your possession, someone still got the number through one of five common channels: a data breach at a company that stored it, a phishing message that tricked you into typing it in, a skimming or shimming device attached to a card reader you used, malware running quietly on your computer or phone, or a fraudulent Wi-Fi network that intercepted your traffic. The problem is enormous — the FTC received over 458,000 credit card fraud reports in 2024 alone.1Federal Trade Commission. Consumer Sentinel Network Data Book 2024 The good news is that federal law caps your liability for unauthorized credit card charges at $50, and the major card networks waive even that through zero-liability policies.2Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card
A Retailer or Website You Used Was Breached
Every time you shop online or let a retailer save your payment information, your card number lives on that company’s servers. An attacker who breaks into those systems can extract millions of card numbers at once and sell them in bulk on underground marketplaces. You may have done everything right on your end. The failure happened on theirs.
A related technique called formjacking targets the checkout page itself rather than the database behind it. Attackers inject malicious code into a retailer’s payment form, and every card number entered on that page is quietly copied to the attacker’s server. The transaction still goes through normally, so nothing looks wrong. High-profile breaches at major airlines and ticketing platforms have exposed millions of customers this way.
All 50 states, the District of Columbia, and U.S. territories require companies to notify you when your personal data is compromised in a breach.3National Conference of State Legislatures. Security Breach Notification Laws Financial institutions under FTC jurisdiction face a separate federal rule requiring them to report breaches affecting 500 or more consumers within 30 days of discovery.4Federal Trade Commission. Safeguards Rule Notification Requirement Now in Effect If you have received a breach notification letter in the last several months, that is a strong candidate for how your number got out, even if no fraud showed up right away.
You Were Phished
Phishing tricks you into handing over your card number voluntarily. An email or text arrives that appears to come from your bank, a shipping company, or a retailer you actually use. The message creates urgency: your account has been locked, a payment failed, a suspicious transaction needs your immediate attention. The link goes to a page that looks identical to the real site, and any card details you enter go straight to the attacker.
These scams have gotten sophisticated. Attackers clone the visual design of login pages down to the favicon and URL structure, sometimes using a domain that differs from the real one by a single character. If you clicked a link in a message in the last few weeks and typed your card number, that is a likely source, even if the page looked convincing at the time.
A Card Reader You Used Was Skimmed or Shimmed
Skimming uses a small device placed over a card reader to record the data on your magnetic stripe as you swipe. Gas pumps are a frequent target because outdoor terminals are easier to tamper with undetected, but ATMs and retail point-of-sale terminals are also vulnerable. The skimmer captures your name and account number, giving the thief enough to create a cloned card.
Shimming is the chip-era version. A paper-thin device inserted inside the card slot intercepts data exchanged between your EMV chip and the reader. Chips generate unique transaction codes that prevent perfect cloning, but the intercepted data can still be used for online purchases that don’t require the physical chip.
You can reduce your exposure by looking at a reader before you insert your card. If it wobbles, sits oversized on the machine, sticks out farther than normal, or has cracks and misaligned graphics, use a different terminal. Comparing the reader on your pump or ATM to neighboring machines is a quick way to spot something that doesn’t belong. Some internal shimmers are invisible from the outside, so paying inside the station or using contactless payment adds another layer of protection.
Malware Captured It From Your Device
Malware on your computer or phone can capture your card number without you ever noticing. Keyloggers silently record every keystroke, including the card numbers, expiration dates, and security codes you type into checkout pages. The captured data is periodically uploaded to a server the attacker controls. Because the software runs in the background with no visible symptoms, your information may be compromised for months before a fraudulent charge finally appears.
Browser autofill features that store your payment details for convenience create another point of vulnerability. Malware designed to scrape stored card data from browsers can extract this information even when it is encrypted on your device, because once the attacker has code running on your system, the decryption keys that protect that stored data become accessible. If you use browser sync across devices, one compromised account can expose saved card numbers on every linked device.
Malware typically reaches you through infected downloads, malicious email attachments, or compromised advertisements on otherwise legitimate websites. Keeping your operating system and browser updated closes the security gaps these programs exploit. Digital wallets like Apple Pay and Google Pay offer stronger protection than browser autofill because they generate one-time-use transaction codes rather than transmitting your actual card number; even if a code is intercepted, it cannot be reused.
A Fake Wi-Fi Network Intercepted Your Traffic
Public Wi-Fi used to be a major risk for card theft because data traveled unencrypted between your device and websites. The FTC now says the widespread adoption of HTTPS encryption has made connecting through public Wi-Fi “usually safe” for most browsing.5Federal Trade Commission. Are Public Wi-Fi Networks Safe? What You Need To Know The risk has not disappeared entirely, though. Attackers can create fake hotspots with legitimate-sounding names, mimicking a coffee shop or airport network, and route your traffic through their own systems.
When you connect to a fraudulent hotspot and land on a site the attacker has set up or redirected you to, encryption alone will not protect your data. The attacker operates the destination, so your card number arrives encrypted but is fully readable on their end. Using a VPN on public networks encrypts all traffic between your device and the VPN server, which prevents the network operator from reading anything that passes through.
How to Tell the Theft Just Happened: The Small Test Charge
Regardless of which method the thief used, the next step is almost always the same. Fraudsters make a purchase of a few dollars, sometimes under a dollar, to confirm the card is still active and that the charge slips past fraud detection. The smaller the amount, the less likely you are to notice it on your statement. If the test succeeds, larger purchases follow quickly before the fraud is detected and the card is shut down.
An unfamiliar charge for $1.07 at a merchant you don’t recognize is not a rounding error. It is often the first sign that your card number has been stolen, and reporting it immediately can head off the larger charges that would otherwise follow.
What to Do Right Now
Speed matters. The sooner you act, the less damage a thief can do.
- Call your card issuer using the number on the back of your card. Report the unauthorized charges and request a new card with a new number. Your liability for any charges after that call drops to zero.2Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card
- Review recent statements line by line. Look for small test charges you may have overlooked, and report every unfamiliar transaction no matter the amount.
- File a report at IdentityTheft.gov. Filing generates an FTC Identity Theft Report and a personalized recovery plan.6Federal Trade Commission. IdentityTheft.gov
- Send written dispute notice to your issuer within 60 days of the statement date. A phone call starts the process, but the Fair Credit Billing Act requires written notice for full protection, and the issuer then has up to two billing cycles to investigate and correct any errors.7Office of the Law Revision Counsel. 15 USC 1666 – Correction of Billing Errors
- Update recurring payments. Any subscription tied to the old number will fail once the new card arrives. Check your bank’s app for a list of merchants that have requested updated card information, and contact the rest directly.
One boundary worth knowing: these liability protections apply to credit cards. Debit cards draw directly from your checking account and are governed by a different federal statute with a tiered liability structure that depends on how fast you report the loss, so if the compromised card was a debit card, the timing rules are stricter and the money leaves your account first.8Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability