If someone uses your credit card without your permission, federal law caps what you personally owe at $50, and you owe nothing at all if the thief used only your card number rather than the physical card. Most major issuers waive even that $50 under their own zero-liability policies. Those protections apply automatically, but keeping them intact depends on calling your issuer quickly and sending a written dispute within 60 days of the statement that shows the charge.
What You Actually Owe
The Fair Credit Billing Act sets a hard ceiling of $50 on your personal liability for unauthorized charges, and that ceiling only applies if the issuer gave you notice of potential liability, a way to report a lost or stolen card, and a method to identify authorized users. If the issuer missed any of those requirements, your liability is zero no matter how much was charged.1Office of the Law Revision Counsel. 15 USC 1643 Liability of Holder of Credit Card
When the physical card wasn’t presented and the thief used only the account number or other information printed on the card, the issuer cannot hold you responsible for any amount. That covers online purchases, phone orders, and fraud that stems from data breaches.2Consumer Financial Protection Bureau. Section 1026.12 Special Credit Card Provisions
On top of that federal floor, Visa, Mastercard, Discover, and American Express each publish their own zero-liability policies that waive the $50 even when the physical card is stolen. These are voluntary network rules rather than federal law, so terms vary slightly, but the practical result for most cardholders is the same: you pay nothing.
Call the Card Issuer Right Away
The moment you spot a charge you didn’t make, call the number on the back of the card or on your statement. Federal liability only covers charges made before you notify the issuer, so every hour you wait is another hour the thief can keep spending on your account.1Office of the Law Revision Counsel. 15 USC 1643 Liability of Holder of Credit Card
On the call, identify each fraudulent transaction. The bank will cancel the compromised card and send a replacement with a new number. Standard delivery runs several business days; some issuers offer expedited shipping, and a few provide free next-day delivery.3Office of the Comptroller of the Currency (OCC). Credit Card and Debit Card Fraud
Write down the date and time of the call, the representative’s name, and any reference number they give you. That record matters if there is ever a dispute about when you reported the fraud.
Send a Written Dispute Within 60 Days
This is the step most people skip, and it carries the strongest legal protection. Calling freezes the card and triggers the $50 cap, but the Fair Credit Billing Act’s billing-error rules only kick in when you send a written notice. Without that letter, the bank is not legally obligated to investigate on a set timeline, credit your account during the investigation, or hold off on collection efforts.4Office of the Law Revision Counsel. 15 USC 1666 Correction of Billing Errors
Your written notice has to reach the issuer’s billing dispute address within 60 days after the statement containing the charge was mailed to you. Do not send it to the general mailing address or clip it to a payment stub. Use the specific billing-dispute address on your statement or the issuer’s website. Include your name, account number, the disputed amount, and a brief explanation of why the charge is unauthorized. Send it by certified mail with a return receipt so you can prove when it arrived.4Office of the Law Revision Counsel. 15 USC 1666 Correction of Billing Errors
What the Bank Must Do Next
Once the issuer receives your written notice, it must acknowledge the dispute in writing within 30 days. It then has two complete billing cycles, and no more than 90 days total, to finish investigating and either correct your account or explain in writing why it believes the charges are valid.5Consumer Financial Protection Bureau. Billing Error Resolution
During the investigation, you do not have to pay the disputed amount, and the issuer cannot try to collect it or report it as delinquent. Many banks post a provisional credit so the charges stop affecting your available balance and don’t accrue interest. If the investigation confirms fraud, the credit becomes permanent and any related finance charges have to come off.4Office of the Law Revision Counsel. 15 USC 1666 Correction of Billing Errors
The burden of proof is on the bank. If the issuer wants to hold you liable, it has to prove either that the use was authorized or that the conditions for imposing liability were met. You do not have to prove you didn’t make the purchase.1Office of the Law Revision Counsel. 15 USC 1643 Liability of Holder of Credit Card
Update Every Recurring Charge Tied to the Old Number
When the old card number is canceled, every automatic payment attached to it will fail. Streaming services, gym memberships, insurance premiums, loan payments, utilities. Pull two or three months of statements, list every recurring charge, and update each one when the new card arrives. Quarterly and annual subscriptions are easy to miss, so check back a full year if you can. A missed insurance or loan payment can trigger late fees or a lapse in coverage, which quickly becomes a bigger problem than the fraud itself.
When a Police Report and FTC Report Help
Issuers usually don’t require a police report for a straightforward credit card fraud dispute. Filing one still creates an official record that matters if the fraud is part of a broader identity theft problem. Bring a government-issued photo ID, proof of your address, and any evidence of the fraud, such as bank statements or correspondence from the issuer.6Federal Trade Commission. Identity Theft Recovery Steps
Before heading to the police station, file an identity theft report at IdentityTheft.gov. The FTC site walks you through the process and generates an Identity Theft Affidavit. Combined with your police report, that affidavit becomes a formal Identity Theft Report, which carries legal weight with creditors and credit bureaus. Some won’t act without it. Keep both documents; you’ll need them if you later have to dispute fraudulent accounts or errors on your credit reports.7Federal Trade Commission. IdentityTheft.gov Recovery Checklist
Check Your Credit Reports
A single stolen card number can be a signal that more of your personal information is out there. Pull your reports from Equifax, Experian, and TransUnion and look for accounts you didn’t open, addresses you don’t recognize, and hard inquiries you didn’t authorize. All three reports are available free once a week at AnnualCreditReport.com, a program the bureaus have made permanent.8Federal Trade Commission. You Now Have Permanent Access to Free Weekly Credit Reports
If you spot fraudulent information, dispute it directly with the bureau online, by phone, or by mail, and attach your police report or Identity Theft Report. The bureau has 30 days to investigate and must delete anything it cannot verify. If you provide additional relevant information during that window, the investigation can be extended by up to 15 days, but no longer. Pull your reports again afterward to confirm the corrections went through.9Office of the Law Revision Counsel. 15 USC 1681i Procedure in Case of Disputed Accuracy
Fraud Alert or Credit Freeze
If you’re worried the fraud could extend to new accounts opened in your name, you have two tools. They work differently and can be used together.
A fraud alert tells lenders to verify your identity, usually by phone, before approving any new credit. You only have to contact one of the three bureaus, which must notify the other two. An initial alert lasts one year. With an Identity Theft Report, you can request an extended alert that stays on file for seven years.10Office of the Law Revision Counsel. 15 USC 1681c-1 Identity Theft Prevention Fraud Alerts and Active Duty Alerts
A credit freeze goes further and blocks access to your credit report entirely, which effectively prevents anyone from opening new credit in your name. You have to contact each bureau separately to place or lift a freeze, and you’ll get a PIN or password to temporarily lift it when you need to apply for credit yourself. Both alerts and freezes are free. A freeze is the stronger choice if you’re not planning to apply for credit soon; a fraud alert is less disruptive if you’re in the middle of shopping for a mortgage, auto loan, or similar product.11Federal Trade Commission. Fraud Alert and Credit Freeze Whats the Difference
If the Bank Denies Your Claim
Banks sometimes deny fraud claims, usually because the transaction looks consistent with your normal spending or the merchant produced evidence like a delivery confirmation or IP address. If your claim is denied and you believe the charge was genuinely fraudulent, ask the issuer for a written explanation. Under the Fair Credit Billing Act, the creditor must provide one on request. Read it closely, because denials sometimes rest on incomplete information you can correct with additional documentation.4Office of the Law Revision Counsel. 15 USC 1666 Correction of Billing Errors
If the issuer still won’t move, file a complaint with the Consumer Financial Protection Bureau at consumerfinance.gov/complaint or by calling (855) 411-2372. The CFPB forwards the complaint to the company, which is required to respond, and then lets you review the response and reply. The process doesn’t guarantee a reversal, but companies tend to take complaints more seriously when a federal regulator is involved.12Consumer Financial Protection Bureau. So How Do I Submit a Complaint
One Note on Debit Cards
Credit cards and debit cards look alike, but their fraud protections are not comparable. If someone uses your debit card, the Electronic Fund Transfer Act applies instead of the Fair Credit Billing Act, and your exposure depends on how fast you report. Reported within two business days, you’re capped at $50. Reported after two business days but within 60 days of the statement, you could lose up to $500. Not reported within 60 days of the statement, there is no cap at all on what you could owe.13Office of the Law Revision Counsel. 15 US Code 1693g – Consumer Liability
The other difference is cash flow. A fraudulent credit card charge is the bank’s money until you pay your bill. A fraudulent debit card charge pulls real money straight out of your checking account, and getting it back can take days or weeks during the investigation.