What Happens When You Report Credit Card Fraud?

When you report credit card fraud, your issuer cancels the compromised card, issues a replacement, opens an investigation into the disputed charges, and in most cases removes those charges from your balance while the review is pending. Federal law caps your personal liability at $50, and the major card networks voluntarily reduce that to $0 for cardholders who acted reasonably.¹² The process is straightforward if you move quickly, but a 60-day written-notice deadline governs the whole thing, and missing it can strip away every protection the law gives you.

What the Issuer Does After Your Call

Call the fraud line on the back of your card or in the issuer’s official app as soon as you spot a charge you didn’t make. Avoid numbers pulled from a search engine, which can lead to phishing operations. On the call, walk through each suspicious transaction by date, amount, and merchant name as it appears on your statement.

The issuer will close the compromised card number immediately and mail a replacement, usually within a few business days. It will also flag the disputed transactions and begin an investigation. Most issuers remove the disputed amount from your statement while they investigate. That removal isn’t legally required at this stage, but it’s standard industry practice, and it means you generally won’t see the charges on your next bill.

Behind the scenes, the issuer pulls transaction data, contacts the merchant’s bank, and reviews evidence like IP addresses, shipping addresses, or in-store surveillance video that might confirm or contradict the fraud. If the investigation confirms the charges were unauthorized, the removal becomes permanent. If it concludes the charges were legitimate, they go back on your account along with any accrued interest. A common source of denied claims is a family member using the card without the cardholder’s knowledge, or a merchant billing dispute that isn’t actually fraud.

The 60-Day Deadline That Governs Everything

The Fair Credit Billing Act gives you 60 days from the date your issuer sends the billing statement containing the unauthorized charge to notify them in writing.³ Miss that window and you lose the legal protections that force the issuer to investigate and remove the charges. This is the single most consequential deadline in the entire process.

The notice has to be in writing, not just a phone call. Send a letter to the billing inquiries address on your statement, which is not the same as the payment address. Identify yourself, the account, the specific charges you’re disputing, and why you believe they’re unauthorized. Most issuers accept an online dispute form or secure message as the written notice, but sending an actual letter by certified mail creates a paper trail with a delivery date. Call the fraud line first to shut the card down, then follow up in writing to preserve your legal rights.

How Much You Actually Owe

Federal law caps your liability for unauthorized credit card charges at $50, no matter how much a thief spent.¹ In practice, that cap rarely bites. Visa, Mastercard, American Express, and Discover all maintain zero-liability policies that eliminate cardholder responsibility for unauthorized purchases, provided you used reasonable care with the card and reported the fraud promptly.² If your card was compromised through no fault of your own and you called as soon as you noticed, expect to owe $0.

Business cards work differently. The $50 federal cap does apply to them under the Truth in Lending Act, protecting the individual cardholder.⁴ But the broader Credit CARD Act consumer protections don’t always reach business accounts, and network zero-liability policies typically exclude commercial cards. If you carry one, check the cardholder agreement.

The Timelines the Issuer Has to Meet

Once the issuer receives your written dispute, two clocks start running. It must acknowledge your notice in writing within 30 days. And it must either correct the error or send you a written explanation of why the charges are valid within two complete billing cycles, and never more than 90 days total.³

While the investigation is open, the issuer cannot try to collect the disputed amount, report it as delinquent, or charge interest on it. Those protections apply even in the rare case where the issuer doesn’t provisionally remove the charge from your statement.

If Your Fraud Claim Is Denied

A denial isn’t the end. You have the right to ask the issuer for copies of the documents it relied on to conclude you owe the money.⁵ Review them closely. Sometimes the evidence is thin, or it references a different transaction than the one you disputed.

To formally appeal, write back within the payment period the issuer gives you or 10 days after receiving the explanation, whichever is later, stating that you still dispute the charge and refuse to pay.⁵ The issuer can begin collection at that point, but it must report the amount to the credit bureaus as disputed rather than simply delinquent. If you think the issuer violated the Fair Credit Billing Act’s procedures during the investigation, you can file a complaint with the Consumer Financial Protection Bureau.

What You Should Do on Your End

The issuer’s investigation handles the disputed charges themselves. Everything else is on you.

Review Your Recent Transactions

After the fraud call, go back through your full recent transaction history, including pending charges. Fraud often shows up as a small test charge before larger ones follow. Flag anything you don’t recognize, even trivial amounts.

Update Recurring Payments

Canceling a card creates a ripple effect. Any subscription or recurring bill tied to the old card number will fail on the next billing cycle. The major card networks run automated account-updating services that push new card details to participating merchants, but coverage isn’t universal and updates can take days to propagate.⁶ Go through utilities, streaming services, insurance premiums, gym memberships, and anything else that bills on autopay, and update each one with the new card number. Missing an insurance premium can cost you far more than a late fee.

Secure Related Accounts

If the compromised card’s online account shared a password with any other financial account, change those passwords now and turn on two-factor authentication where available. Reused passwords are the easiest path for a thief to move from one account to another.

Check Your Credit Reports

Pull your credit report from Equifax, Experian, and TransUnion at AnnualCreditReport.com, which is free once per week from each bureau on a permanent basis.⁷ Look for accounts you didn’t open, addresses you don’t recognize, and hard inquiries you didn’t authorize. Any of those suggests the fraud extends beyond the one card.

Place a Fraud Alert or Freeze

An initial fraud alert stays on your credit file for one year and requires lenders to take extra steps to verify your identity before approving new credit.⁸ You only need to contact one bureau, which is then required to notify the other two. It’s fast and free.

A credit freeze goes further. It blocks access to your credit file entirely, so no one can open a new account in your name until you lift it. Freezes are free by federal law, and you can lift them temporarily when you need to apply for credit yourself.⁹ Unlike a fraud alert, you have to contact each bureau separately to place and lift a freeze.

If you’ve confirmed actual identity theft rather than a single compromised card, you’re eligible for an extended fraud alert lasting seven years, which requires an FTC Identity Theft Report or a police report.¹⁰ Active-duty military members can place an active-duty alert that lasts 12 months and also removes their name from prescreened credit offer lists for two years.¹¹

File an FTC Identity Theft Report if Fraud Spreads

If the fraud goes beyond one unauthorized charge, meaning new accounts in your name, unfamiliar debts on your credit report, or collection calls for accounts you never opened, file a report at IdentityTheft.gov. The FTC’s report carries specific legal weight under the Fair Credit Reporting Act.¹² With it, you can permanently block fraudulent accounts from appearing on your credit reports, stop creditors from continuing to collect debts caused by the theft, and qualify for the seven-year extended alert.¹³ If you create an account on the site, the FTC generates a personalized recovery plan with pre-filled letters for creditors, debt collectors, and the credit bureaus.

File a Police Report When It Matters

You usually don’t need a police report for a straightforward credit card fraud dispute. It becomes important when the fraud is large enough that the issuer requests one, when identity theft has spread across multiple accounts, or when you need an official record to support an extended fraud alert or an insurance claim.¹² File with your local police department, bring your FTC Identity Theft Report if you have one along with a photo ID, proof of address, and copies of the fraudulent transactions, and ask for a copy of the report before you leave. Credit card fraud cases rarely lead to arrests, but the report itself has real utility with creditors, insurers, and the bureaus.

A Note on Debit Cards

Everything above applies to credit cards. Debit card fraud falls under a different federal law, the Electronic Fund Transfer Act, with far less favorable terms. Your maximum liability depends on how fast you report:

Within 2 business days of learning of the loss or theft, liability is capped at $50.
After 2 business days but within 60 days of your statement, liability can reach $500.
After 60 days from your statement, there’s no cap at all.¹⁴

The investigation process is different too. Under Regulation E, if a bank can’t complete a debit card fraud investigation within 10 business days, it must provisionally credit your account for the disputed amount while continuing to investigate, up to 45 days total.¹⁵ For credit cards there’s no equivalent rule, because the issuer can’t collect the disputed amount during the investigation anyway. The upshot: if you have a choice between a credit card and a debit card for everyday purchases, the credit card is meaningfully safer.

1
Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card
2
Mastercard. Mastercard Zero Liability Protection Policy
3
Office of the Law Revision Counsel. 15 USC 1666 – Correction of Billing Errors
4
HelpWithMyBank.gov. Does the Truth in Lending Act Apply to Credit Cards Issued for Business Purposes?
5
Consumer Advice. Using Credit Cards and Disputing Charges
6
Visa. Visa Account Updater for Merchants
7
Federal Trade Commission. Free Credit Reports
8
Office of the Law Revision Counsel. 15 USC 1681c-1 – Identity Theft Prevention; Fraud Alerts
9
Federal Trade Commission. New Federal Law Allows Consumers to Place Free Credit Freezes and Yearlong Fraud Alerts
10
Consumer Advice. Credit Freezes and Fraud Alerts
11
Consumer Financial Protection Bureau. Fraud Protection Tools to Help Safeguard Servicemembers
12
Federal Trade Commission. Steps for Identity Theft
13
Federal Trade Commission. FTC Memo to Law Enforcement on Identity Theft Reports
14
Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
15
Consumer Financial Protection Bureau. Regulation E 1005.11 – Procedures for Resolving Errors