If someone made unauthorized credit card charges on your account, federal law caps what you can be forced to pay at $50, and in most cases your actual liability is zero. The protection kicks in fully once you report the problem, so the single most important thing is speed: call the number on the back of your card today, then follow up in writing within 60 days of the statement that shows the charge. Everything else flows from those two steps.
What You Actually Owe
The Truth in Lending Act limits a cardholder’s liability for unauthorized use to a maximum of $50, and the issuer only gets the benefit of that cap if it can prove it gave you notice of potential liability, provided a way to report loss or theft, and included a method to identify authorized users. If the issuer can’t show all three, you owe nothing. The burden of proof is on the issuer, not you.1Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card
Two details change the picture further. First, the $50 ceiling applies only to charges that posted before you notified the issuer. Anything after that notice is zero. Second, if your physical card was never lost or stolen and only the card number was compromised, you generally owe nothing under the statute, because the conditions that trigger the $50 cap are tied to loss or theft of the card itself.1Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card
Network rules go further than the statute. Visa and Mastercard both require their issuing banks to offer zero-liability policies, meaning the issuer absorbs unauthorized charges regardless of the $50 cap. Visa’s policy covers credit and debit cards and requires issuers to replace stolen funds within five business days of notification.2Visa. Visa Zero Liability Policy Mastercard offers similar protection for purchases made in stores, online, by phone, or on mobile.3Mastercard. Mastercard Zero Liability Protection Policy Neither network covers commercial cards or unregistered prepaid cards like gift cards.
Report the Charges, Then Report Them Again in Writing
The phone call protects you practically. The written notice protects you legally. You need both.
Call the Issuer First
Use the number on the back of your card. Tell the representative which specific transactions are fraudulent, ask them to cancel the compromised card, and request a replacement. That call stops the clock on further unauthorized charges and triggers provisional protections while the issuer investigates.
Before dialing, pull together a list of every charge you can identify as fraudulent, including the date it posted, the merchant name, and the amount. Check whether your physical card is still in your wallet. That one detail affects both your liability and how the issuer categorizes the fraud.
Then Send a Written Dispute
This is the step most people skip, and it’s the one that matters most for your legal rights. The Fair Credit Billing Act requires a written notice of billing errors sent to the creditor’s billing inquiry address. That notice must reach the issuer within 60 days after the statement showing the unauthorized charge was mailed or transmitted. It needs your name and account number, the charge you believe is wrong, and why you think it’s an error.4Office of the Law Revision Counsel. 15 U.S. Code 1666 – Correction of Billing Errors
Many issuers now accept electronic disputes through their websites or apps. Under Regulation Z, an electronic submission counts as written notice if the creditor says it accepts them and explains how to submit one.5Consumer Financial Protection Bureau. Regulation Z 1026.13 – Billing Error Resolution If you aren’t sure your issuer’s online form qualifies as a formal billing error notice, send a paper letter to the billing inquiry address printed on your statement. Certified mail gives you proof it arrived.
If the fraud looks broader than one card, the FTC’s IdentityTheft.gov will generate an Identity Theft Report and a recovery plan. The report carries legal weight comparable to a police report and is accepted by virtually every creditor and credit bureau.6IdentityTheft.gov. IdentityTheft.gov – Report Identity Theft
What the Issuer Has to Do, and By When
Once your written dispute is in the issuer’s hands, federal deadlines apply. The issuer must send a written acknowledgment within 30 days of receiving your notice, unless it resolves the dispute entirely in that window. It then has to finish the investigation and either correct your account or explain why it believes the charges were valid within two full billing cycles, and never more than 90 days from receipt.4Office of the Law Revision Counsel. 15 U.S. Code 1666 – Correction of Billing Errors
While the dispute is open, you are not required to pay the disputed amount or any interest that accrues on it. Most issuers go further and apply a provisional credit within a few days, so the fraudulent charges don’t eat your available credit during the review. If the charges are confirmed as fraudulent, the provisional credit becomes permanent and any related finance charges are removed.
Your credit report also has some protection during the dispute. If a business keeps reporting the disputed amount to a credit bureau, it must flag the amount as disputed, and the bureau must include that notation in your file. If the investigation ends in a correction, the bureau must, on your request, send notice of the correction to anyone who received your report in the past six months.7Consumer Advice – FTC. Disputing Errors on Your Credit Reports
When Someone You Know Used the Card
Fraud by a stranger is straightforward. Use by a family member or friend is messier. Federal regulations define “unauthorized use” as use by someone who lacks actual, implied, or apparent authority and from which the cardholder receives no benefit. If you handed your card to a relative to pick up groceries and they went shopping, that person had some authority from you, even if they exceeded it.8Consumer Financial Protection Bureau. Regulation Z 1026.12 – Special Credit Card Provisions
The regulatory commentary spells out the consequence: when a cardholder gives a card to someone who then exceeds the authority granted, the cardholder is liable for those transactions unless they have notified the creditor that the person is no longer authorized to use the card. Even then, liability for that series of unauthorized charges can’t exceed $50 or the value obtained before notification, whichever is less.9Consumer Financial Protection Bureau. Comment for Regulation Z 1026.12 – Special Credit Card Provisions
If someone you trusted misused your card, call the issuer and revoke that person’s authorization right away. And know this: if you added someone as a formal authorized user on your account, their spending is generally your responsibility whether or not you approved each purchase.
Debit Cards Are Not Covered the Same Way
If the charge hit a debit card instead of a credit card, none of the figures above apply. Debit cards fall under a different law with a sliding scale: $50 if you report within two business days of learning of the theft, $500 if you report after two business days but within 60 days of the statement, and unlimited liability for unauthorized transfers that happen more than 60 days after the statement was sent.10Consumer Financial Protection Bureau. Regulation E 1005.6 – Liability of Consumer for Unauthorized Transfers With a credit card the floor of your protection is strong; with a debit card it depends almost entirely on how fast you catch the problem.
If the Issuer Denies Your Claim
Issuers do deny fraud claims, usually because they say the evidence doesn’t support the dispute. Start by requesting a written explanation. The problem is often insufficient documentation rather than genuine disbelief. Gather what supports your case: your FTC Identity Theft Report or police report, receipts or records placing you elsewhere when the charge posted, and your communication log with the issuer. Submit all of it as a formal appeal.
If the appeal goes nowhere, file a complaint with the Consumer Financial Protection Bureau at consumerfinance.gov/complaint or by calling (855) 411-2372. Describe what happened, the amount at stake, and the resolution you want. The CFPB forwards the complaint to the issuer, which must respond, and the agency publishes response data and tracks patterns.11Consumer Financial Protection Bureau. So, How Do I Submit a Complaint?
If neither the appeal nor the CFPB complaint resolves it, a consumer protection attorney is a reasonable next call. Many offer free initial consultations, and federal consumer protection statutes sometimes allow recovery of attorney’s fees, so the cost may not fall entirely on you.
Locking Things Down Afterward
Two federal tools are free and worth using after a fraud incident. A credit freeze blocks anyone, including you, from opening new credit in your name until you lift it. It is the stronger option if you’re worried about new accounts being opened with stolen information.12Consumer Advice – FTC. Credit Freezes and Fraud Alerts
A fraud alert is lighter: instead of blocking access, it tells lenders to verify your identity before granting new credit. An initial alert lasts one year and can be renewed. If you have an FTC Identity Theft Report or police report, you can place an extended fraud alert that lasts seven years. You only need to contact one of the three major credit bureaus; that bureau must notify the other two.13Office of the Law Revision Counsel. 15 U.S. Code 1681c-1 – Identity Theft Prevention; Fraud Alerts and Active Duty Alerts
Catching unauthorized charges early is what keeps every protection above at its strongest. The statute, the network policies, and the dispute timelines all reward speed, and they all lose force the longer a fraudulent charge sits on your account unreported.