To find out who used your credit card without permission, work the two sources that actually hold identifying information: your card issuer’s fraud department and the merchant that processed the charge. Between them they can pull the IP address behind an online order, the shipping address the goods went to, the terminal ID of a physical swipe, whether the card was present or the number was keyed in, and often the exact second of the transaction. None of that appears on your statement. Federal law caps your liability at $50 for unauthorized credit card charges, but you have to send a written dispute within 60 days of the statement date to keep the protections that force your issuer to investigate.1Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card
Lock the Card Before You Investigate
Stop new charges before you spend an hour tracing old ones. Most banking apps let you lock the card with one tap. A lock blocks new purchases but doesn’t stop recurring charges you previously authorized, so treat it as a pause, not a cancellation.
If you see multiple unauthorized charges, or your card number was stolen rather than the physical card lost, call the issuer and ask for a full replacement. The compromised number gets cancelled and a new one issued. It’s more disruptive because you’ll have to update autopay accounts, but hoping the charges stop on their own rarely works when someone has your card data.
Read the Transaction Line for What It Already Tells You
Your online banking portal is the starting point. Each transaction shows the merchant’s registered name, which often differs from the storefront brand. A charge from “SQ*JOESCOFFEE” is a Square payment terminal at a coffee shop, not a mystery company. Check whether the charge is still pending or has cleared. Pending means the card was accessed very recently.
Click into the transaction for the fuller record. Many issuers show the city and state where the purchase happened, sometimes a specific store number. Cross-reference that with where you actually were on that date. If the charge originated in Florida and you were home in Ohio, you’ve already established someone else used the card. For online purchases, the merchant name sometimes carries a URL fragment that points to the exact website.
Merchant Category Codes classify the type of business behind the charge, whether that’s a grocery store, a gas station, or a digital subscription. Your issuer may show the code or a plain-language version of it. A gas station charge near a relative’s home tells a different story than a random online electronics order shipping across the country.
Ask the Fraud Department for the Metadata
The fraud team can see what customer service can’t: the authorization code, the terminal ID, whether the physical card was present or the number was entered manually, and often the exact time down to the second. Call the number on the back of your card and ask to be transferred to fraud or disputes.
Have the date, amount, and merchant name for each suspicious charge ready. Ask whether each transaction was card-present, meaning someone swiped or tapped a physical card, or card-not-present, meaning the number was typed into a website or given over the phone. That distinction points you in very different directions. Card-present means either your physical card was stolen or someone cloned it at a compromised terminal. Card-not-present means your number leaked, through a data breach, a phishing email, or someone who had access to your account information.
The bank will typically open a fraud investigation and issue provisional credit while they look. They may ask you to fill out a fraud affidavit, a written statement that you did not authorize the charges. Be accurate. Banks take false fraud claims seriously, and filing one can lead to account closure and a report to ChexSystems, which makes it harder to open accounts elsewhere.
Get the Merchant’s Order File
The merchant holds a separate layer of evidence the bank doesn’t have. For online orders, the retailer’s records typically include the IP address used to place the order, the email address on the account, and the shipping address the goods went to. For in-store purchases, the merchant may have surveillance footage from the time of the transaction.
Call the merchant’s customer service or loss prevention department and give them the transaction ID from your bank statement. Ask them to pull the order file. Some merchants will share details directly once you verify you’re the cardholder. Others have privacy policies that block disclosure until a police report or bank investigation is formally open. If a merchant won’t cooperate with you personally, the information still comes out once your bank opens a chargeback. The merchant has to respond with documentation to contest the reversal, so the shipping address, IP, and account email get produced either way.
File the Reports That Unlock the Rest
Formal reports create the paper trail that gives your claim legal weight and pushes merchants and investigators to release records. Start at IdentityTheft.gov, the FTC’s portal. You’ll answer questions about what happened, and the site generates an Identity Theft Report and a personalized recovery plan.2Federal Trade Commission. Identity Theft: IdentityTheft.gov Save the report number. Your bank will want it.
File a police report with your local department as well. Officers may or may not actively investigate a single credit card fraud, but the report creates a criminal record of the unauthorized use in your jurisdiction and gives your bank additional documentation supporting your claim. Bring your transaction details, your FTC report number, and any merchant information you’ve gathered. The more specific your evidence, the easier it is for the officer to document the crime properly.
Once you have both report numbers, hand them to the fraud department. Your claim shifts from “customer says they didn’t make the charge” to “customer has filed federal and local reports,” and the investigation proceeds with more weight behind it.
When the Trail Leads Into Your Own Household
This is the uncomfortable scenario, and it’s more common than people expect. A spouse, child, roommate, or visiting relative uses the card without asking, and the charges look like fraud. The investigation steps above will often lead you back to your own address, a shipping address you recognize, a merchant near your home, or a transaction time that matches when a family member was out.
If you suspect a household member, you have a decision to make before filing anything. Reporting charges as unauthorized may require a fraud affidavit and a police report, and filing those about a family member can trigger criminal fraud charges against them. Some cardholders resolve it privately by confronting the person and arranging repayment, which avoids the legal consequences but also means the bank treats the charges as legitimate and you eat them.
One legal distinction matters here. If the person is an authorized user on your account, charges they make are not unauthorized under federal law, even if they exceeded what you verbally allowed. The dispute is between you and them, not between you and the bank. If someone who is not an authorized user got hold of your card, the standard fraud process applies, but banks tend to scrutinize claims more carefully when the person had physical access to the card inside your home. Accuracy on the fraud affidavit is not optional. Claiming you have no idea who made the charges when you know it was your teenager creates real legal exposure for you.
Your Liability and the 60-Day Deadline
Under 15 U.S.C. § 1643, your liability for unauthorized credit card charges cannot exceed $50, and even that applies only when the issuer gave you notice of potential liability and a way to report the loss.1Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card Most major networks go further in practice. Visa’s Zero Liability Policy states that cardholders won’t be held responsible for unauthorized charges, though provisional credit can be withheld if the issuer finds gross negligence or a delay in reporting.3Visa. Visa Zero Liability Policy
The catch is timing. A separate provision, 15 U.S.C. § 1666, requires you to send written notice of a billing error within 60 days of the date your issuer transmitted the statement containing the charge. Meet that deadline and your issuer must acknowledge the dispute within 30 days and either correct the error or explain why they believe the charge is valid within two billing cycles, no more than 90 days.4Office of the Law Revision Counsel. 15 USC 1666 – Correction of Billing Errors Miss it and you lose the formal dispute process that forces the issuer to investigate. This is where people get burned. They spot a charge months later on an old statement and find out the window has closed. Read every statement when it arrives, even if you mostly use autopay.