People get your credit card number in more ways than most cardholders realize, and almost none of them require touching your physical card. Thieves skim it off gas pump readers, buy it in bulk after a retailer breach, trick you into typing it on a lookalike website, inject code into a real store’s checkout page, or generate valid numbers by brute force and test them with tiny charges. The reassuring part: under federal law your maximum liability for unauthorized credit card charges is $50, and Visa, Mastercard, and most issuers waive even that.1Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card2Visa. Visa Zero Liability Policy
Physical Theft, Shoulder Surfing, and Mail
The oldest method still works. A stolen wallet hands a thief everything printed on the plastic: the 16-digit account number, the expiration date, and the three-digit code on the back. No hacking required.
Shoulder surfing is even lower effort. Someone standing close in a checkout line watches you enter a PIN or type card details into your phone. Covering the keypad with your other hand eliminates the risk.
Then there’s the hand-off. When a server carries your card out of sight in a restaurant, a dishonest employee can copy the number in seconds by writing it down or using a hidden camera. Tableside readers have reduced this, but it still happens.
Mail theft gets overlooked. Fraudsters target mailboxes for new cards, statements, and pre-approved offers that carry enough personal information to commit fraud.3United States Postal Inspection Service. Credit Card Fraud If a card you expected never arrives, call the issuer that day. Signing up for USPS Informed Delivery lets you see digital previews of incoming mail so you’ll notice when something goes missing.
Skimmers and Shimmers on Card Readers
Skimmers are small devices criminals attach over the card slot on ATMs, gas pumps, and other unattended terminals. When you swipe, the skimmer reads your magnetic stripe and stores the data. The thief comes back later to download hundreds of numbers, or, with newer Bluetooth-enabled versions, pulls the data wirelessly without returning at all.
Shimming targets chip cards. A shim is a paper-thin circuit board slid inside the reader slot, sitting between your chip and the terminal’s contacts and intercepting the data your chip transmits. Because it lives entirely inside the machine, you can’t see it.
The strongest defense is to skip inserting the card in the first place. Tap-to-pay and mobile wallets like Apple Pay and Google Pay use tokenization: the terminal receives a one-time encrypted code, not your real number, so an intercepted transaction is useless to a thief. When you do have to insert a chip card, wiggle the reader before you commit. A loose overlay or bolt-on skimmer will shift; a real built-in reader won’t.
Phishing, Smishing, and Vishing
Phishing doesn’t need any physical proximity. You get an email that looks like it came from your bank, with the right logo and formatting, warning about a problem with your account. The link goes to a page that looks identical to the real login. Anything you type there goes to the criminal.
The same trick runs through text messages (smishing) and phone calls (vishing). Spoofed caller IDs make the call appear to come from your bank’s actual number, and the person on the line creates urgency, asking you to “verify” your card to protect your account. The verification is the fraud.
One rule handles most of these: your bank will never ask for your full card number over the phone or through a link in a message. If a call or text feels urgent, hang up and dial the number printed on the back of your card. Turning on two-factor authentication adds a second barrier so a stolen password alone won’t unlock the account. Authenticator apps are safer than text-message codes because they don’t fall to SIM-swap attacks, where a thief convinces your carrier to move your number to a new phone.4Federal Trade Commission. Use Two-Factor Authentication To Protect Your Accounts
Data Breaches at Companies You’ve Shopped With
Sometimes the failure has nothing to do with anything you did. When hackers get into a retailer’s servers, they can pull millions of card numbers at once. Your data sat in a database with everyone else’s, and the theft happened at the corporate level.
Stolen records typically move to dark web marketplaces. A single card can sell for $5 to $100 depending on its credit limit and issuing bank, and entire databases change hands in bulk on underground forums.
All 50 states, D.C., and U.S. territories require companies to notify you when your personal information is exposed in a breach, though the timeframes vary.5National Conference of State Legislatures. Security Breach Notification Laws You can’t prevent a breach at a store you’ve used, but you can limit the fallout. Many issuers now offer virtual card numbers that generate a unique number for each merchant; if that merchant leaks it, the number only works at that one store and can be canceled without touching your real account. Turning on transaction alerts for every charge is another way to catch breach-related fraud early.
Malware and Public Wi-Fi Interception
Keylogging software records every keystroke on your device, including card numbers and security codes. It usually arrives through a malicious email attachment, a compromised website, or a fake software download, then runs silently and ships captured data to the attacker.
Public Wi-Fi opens a different door. On an unsecured network a hacker can position themselves between your device and the router in what’s called a man-in-the-middle attack, intercepting the data flowing through the connection. That includes card details you type on legitimate sites, because the interception happens at the network layer, not the website.
A VPN encrypts everything leaving your device before it reaches the Wi-Fi network, which makes intercepted packets unreadable. If you regularly bank or shop on public networks, a VPN closes this gap entirely. For the malware side, keeping your operating system and browser updated and avoiding downloads from unfamiliar sources are the practical defenses.
Formjacking on Real Websites
Formjacking catches careful people because they’re doing everything right. A hacker injects malicious code into a legitimate store’s checkout page. When you type your card number into the payment form, the hidden code copies it and sends it to the attacker’s server the moment you click submit. The real transaction completes normally, so neither you nor the merchant sees anything wrong.
The site itself is genuine. You didn’t click a suspicious link. The compromise usually rides in through third-party code the store uses for shopping cart features, analytics, or ad tracking, and a single infected script can hit every customer until the merchant finds and removes it.
There’s no reliable way for a shopper to spot formjacking as it happens. Virtual card numbers again limit the damage, since a compromised one can be revoked without touching your real account. Payment services like PayPal that complete the sale without ever exposing your card number to the merchant’s checkout page also reduce your exposure.
Brute Force Number Generation
This one needs no stolen data and no contact with you at all. Automated software guesses valid card numbers using math. Every card starts with a Bank Identification Number (the first six to eight digits) that identifies the issuing bank and is publicly known. The software churns through combinations for the remaining digits and tests them by attempting small transactions on websites with weak fraud detection.
The test charges are deliberately small, often a few cents to a few dollars, so they don’t trip fraud alerts. Once the software confirms a number is live, the attacker either runs up bigger charges or sells it. A single program can validate hundreds of accounts in a short session.
This is why tiny unfamiliar charges on your statement matter. A 47-cent charge from a company you don’t recognize isn’t a rounding error. It’s likely a probe checking whether your number works. Report it the day you see it.
Warning Signs Your Number Was Stolen
Fraud doesn’t always show up as a shopping spree. The signals are often quiet:
- Small charges from merchants you don’t recognize, which may be test transactions.
- Charges where the business name on the statement doesn’t match anywhere you shopped.
- Transactions declined for reaching your credit limit sooner than expected.
- Statements or new cards that never arrive in the mail.6USAGov. Identity Theft
- Fraud alerts from your bank. Take them seriously, but verify by calling the number on the back of your card rather than clicking anything in the text or email.
Reviewing statements regularly catches what automated systems miss. Real-time push notifications for every transaction are better still, because you’ll see an unauthorized charge in seconds instead of at the end of the month.
What to Do If Your Card Number Is Stolen
Speed matters, especially with debit. Work through these steps in order.
Call your card issuer first, using the number on the back of the card. Identify the unauthorized charges, ask them to close the compromised account, and request a new card number. Most major issuers ship replacements at no charge.
Place a fraud alert with one of the three credit bureaus (Equifax, Experian, or TransUnion). It’s free, lasts one year, and the bureau you contact is required to notify the other two. A credit freeze goes further by blocking new creditors from pulling your report entirely, and federal law lets you freeze and unfreeze at all three bureaus for free. You’ll contact each bureau separately, but online requests process immediately.
Report the fraud to the FTC at IdentityTheft.gov. The site walks you through a recovery plan, generates an Identity Theft Report you’ll need to dispute fraudulent accounts, and pre-fills letters to send to businesses. You can also call 1-877-438-4338.7Federal Trade Commission. Identity Theft – What To Do Right Away
If the fraud involved an online transaction, file a complaint with the FBI’s Internet Crime Complaint Center at ic3.gov. IC3 doesn’t investigate individual cases, but it feeds information to the agencies that do. Include transaction dates, amounts, and any messages from the fraudster.8Internet Crime Complaint Center. FAQ
What You’ll Actually Owe
Federal law splits credit cards and debit cards sharply, and the gap is big enough that it should shape which one you reach for online.
Credit Cards
Under the Fair Credit Billing Act, your maximum liability for unauthorized credit card charges is $50, and that cap only applies if the issuer met certain conditions, including giving you a way to report the theft. If the issuer didn’t meet all of them, you owe nothing.1Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card In practice you’ll almost always pay $0, because Visa, Mastercard, and the other major networks have zero-liability policies that waive even the $50 statutory maximum.2Visa. Visa Zero Liability Policy
Debit Cards
Debit is a different story. Your liability depends entirely on how fast you report the problem:
- Report within 2 business days: liability capped at $50, or the amount of unauthorized transfers before you reported, whichever is less.
- Report after 2 business days but within 60 days of your statement: up to $500 in unauthorized transfers.
- Report after 60 days from your statement: unlimited liability for any unauthorized transfers that occur after that 60-day window.
That last tier is where people get hurt. If a thief has your debit card number and you don’t catch it within two months of the relevant statement, the bank has no legal obligation to reimburse you for later charges.9Consumer Financial Protection Bureau. Comment for 1005.6 – Liability of Consumer for Unauthorized Transfers It’s the single strongest reason to run online and everyday purchases through a credit card rather than a debit card tied directly to your checking account.