If someone ran up charges on your credit card, here is what to do about credit card fraud, in the order it needs to happen: freeze the card through your issuer’s app, call the fraud line to report every charge you didn’t make, and follow up in writing within 60 days of the statement that first showed the fraud. Do those three things and federal law almost always leaves you owing nothing.
Lock the Card Before You Do Anything Else
The moment you spot a charge you didn’t make, freeze the card. Most issuers let you do this through their mobile app or website with a single tap. A temporary freeze blocks new transactions while you figure out whether the charge is genuinely fraudulent or just a merchant name you don’t recognize. It doesn’t cancel the card or change your account number, so you can reverse it easily if the charge turns out to be legitimate.
If you’re confident the charges are fraud, ask your issuer to close the compromised card number entirely and send a replacement. Your autopay subscriptions and recurring bills will need updating with the new number, but it eliminates any chance the thief keeps running charges. Don’t wait for business hours. Fraud departments at major issuers are staffed around the clock.
What to Have in Front of You When You Call
Pull up your recent statements before you dial. Note the exact merchant names as they appear (these often look nothing like the business you’d recognize), the dates and precise dollar amounts of every suspicious charge, your full account number, and the date of the last transaction you know you made.
Whether you still have the physical card matters too. If it’s been lost or stolen, the bank categorizes the claim differently than when your card is still in your wallet and only the number was compromised. Having all of this ready shortens the call and prevents errors in the dispute record that could slow the investigation later.
Dispute Each Charge, Then Put It in Writing
Call your issuer’s fraud line or use the dispute feature in the app to report each unauthorized charge. Ask for a case number or confirmation code. That proves you reported the fraud and when, which matters for the federal timelines below. Most issuers will post a provisional credit while they investigate, so the disputed charges don’t sit on your balance.
Here is the part most people miss. Federal law requires a written dispute notice, and your issuer must receive it within 60 days of the statement that first showed the unauthorized charge. A phone call starts the process, but the written notice is what locks in your full legal protections under the Fair Credit Billing Act. Send it to the billing inquiry address your issuer designates for disputes, not the payment address, and keep a copy.
What the Issuer Has to Do Next
Once your written dispute arrives, federal law puts the clock on the issuer. They must send you a written acknowledgment within 30 days of receiving your notice. They then have two full billing cycles, but no more than 90 days, to either correct the charges or explain in writing why they believe the bill was accurate.1Office of the Law Revision Counsel. 15 USC 1666 – Correction of Billing Errors
During the investigation window, the issuer cannot try to collect the disputed amount or report it as delinquent to credit bureaus. They can note that the amount is in dispute, but they cannot damage your credit score over charges you’ve properly challenged.1Office of the Law Revision Counsel. 15 USC 1666 – Correction of Billing Errors This protection only kicks in when you follow through with the written notice.
What You’ll Actually Owe
The Truth in Lending Act caps your personal liability for unauthorized credit card charges at $50 per card. That cap covers unauthorized transactions that happen before you notify the issuer. Once you report the fraud, you owe nothing for charges made after that point.2Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card
In practice, even the $50 is rare. The statute only imposes that liability when every condition is met: the issuer gave you adequate notice of your potential liability, provided a way to report lost or stolen cards, and had a method to identify authorized users. If the issuer fell short on any of those steps, you owe nothing at all.2Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card Beyond the federal floor, the major card networks have voluntarily eliminated even that $50 exposure for most personal cardholders. Visa’s zero-liability policy covers unauthorized charges on personal cards whether the transaction happened in a store, online, or over the phone.3Visa. Visa Credit Card Security and Fraud Protection Mastercard offers the same protection for in-store, online, telephone, mobile, and ATM transactions, with the standard exclusions for certain commercial cards and anonymous prepaid cards.4Mastercard. Mastercard Zero Liability Protection for Unauthorized Transactions
Decide Whether to Add a Fraud Alert or Freeze
Unauthorized charges on an existing card don’t necessarily mean someone has enough information to open new accounts in your name. But if your personal details were compromised alongside your card number through a data breach, stolen mail, or phishing, lock down your credit file. You have two tools, and they work differently.
A fraud alert requires lenders to verify your identity before approving new credit in your name. Contact any one of the three major credit bureaus, and that bureau is legally required to notify the other two. The alert lasts one year and can be renewed.5Federal Trade Commission. Credit Freezes and Fraud Alerts It’s free, doesn’t affect your existing accounts, and adds a speed bump for anyone trying to take out loans or open cards in your name.
A credit freeze is stronger. It blocks anyone from pulling your credit report entirely, which stops virtually all new account applications. Federal law guarantees free freezes for all consumers, and when requested online or by phone, the bureau must activate the freeze within one business day.6Federal Trade Commission. New Federal Law Allows Consumers to Place Free Credit Freezes and Yearlong Fraud Alerts You’ll receive a PIN to temporarily lift the freeze when you legitimately need someone to check your credit.
The trade-off is convenience. A freeze requires you to lift it every time you apply for credit, rent an apartment, or do anything that triggers a credit check. For isolated card fraud where your broader identity wasn’t exposed, a fraud alert is usually enough. If your Social Security number was compromised, freeze everything.
File With the FTC, and With Police If It Helps
Report the fraud at IdentityTheft.gov, the FTC’s dedicated portal. The site walks you through a series of questions and generates an Identity Theft Report, which functions as an official filing that proves to creditors and credit bureaus that someone stole your identity.7Federal Trade Commission. Identity Theft – A Recovery Plan The portal also creates a personalized recovery plan with instructions for your situation.8Federal Trade Commission. Report Identity Theft
A police report is worth filing if you know who stole your information, if the fraud involves a substantial dollar amount, or if your card issuer asks for one. The department will assign a report number you can provide to your issuer as supplementary documentation. Even when police can’t actively investigate, the report creates a formal record that strengthens your position if the dispute escalates or involves multiple creditors.
Debit Card Fraud Follows Much Harsher Rules
If the compromised card was a debit card, not a credit card, almost everything above changes. When a thief uses a debit card, the money leaves your bank account immediately. Your rent check can bounce while the bank investigates. And the liability rules under the Electronic Fund Transfer Act depend entirely on how fast you report:9Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
- Within 2 business days of learning your card was lost or stolen, liability tops out at $50.
- After 2 business days but within 60 days of receiving your statement, liability jumps to $500.
- After 60 days, the bank has no obligation to reimburse you for transactions that occurred after the 60-day window closed.
With a credit card, you’re disputing a charge on a bill you haven’t paid yet, and your maximum exposure is $50 regardless of when you report. With a debit card, your actual cash is gone from day one, and slow reporting can mean permanent loss.
Two Boundaries to Know
If the card was issued to you through your employer, don’t assume the standard protections apply. Federal regulations extend the $50 liability cap to any credit card issued to a person, including business cards, but when an issuer provides 10 or more cards to a single organization, the issuer and the company can negotiate different liability terms that override the standard protections.10Consumer Financial Protection Bureau. Regulation Z 1026.12 – Special Credit Card Provisions Your personal protection against unauthorized use by a third party survives; the override only applies between the issuer and the organization. Check the cardholder agreement if your card came through work.
And don’t plan on a tax write-off. Since 2018, individual taxpayers can only deduct personal theft losses if the theft is connected to a federally declared disaster. Standard credit card fraud doesn’t qualify.11Internal Revenue Service. Casualty, Disaster, and Theft Losses If your issuer reimburses the charges, which is the expected outcome under the rules above, you have no net loss to deduct anyway.