If your credit card has been hacked, lock the card in your banking app, call the issuer’s fraud line, and dispute every charge you didn’t make. Federal law caps your personal liability for unauthorized credit card charges at $50, and Visa, Mastercard, and most major issuers waive even that amount when you report the fraud promptly.1Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card The rest is a sequence: secure the account, replace the card, update anything that auto-charges it, and put a layer of protection on your credit file. Move quickly, because several of these protections have hard deadlines.
Lock the Card First
Stop the bleeding before anything else. Most banking apps have a lock or freeze toggle that instantly blocks new transactions. Use it, then call the number on the back of your card or on a recent statement to reach the fraud department. Don’t search for the number online. Phishing sites sometimes impersonate bank customer service lines.
When you reach the fraud team, you’ll choose between a temporary freeze and a permanent cancellation. A temporary freeze fits when you’ve merely misplaced the card. When card data has been stolen, cancel. The bank will void the old number and issue a replacement with a new number and security code, which makes the stolen data useless.
Ask for a case or reference number and write it down with the date and time of the call. That paper trail matters if anything goes sideways later. While you’re on the phone, ask the bank to check whether the mailing address, email, or phone number on the account has been changed recently. Fraudsters who compromise a card sometimes also change the contact information to intercept alerts.
How to File the Dispute
Before you file, pull your recent statements and identify every suspicious charge: exact date, merchant name as it appears on the statement, and dollar amount. If you were making legitimate purchases nearby with the physical card in hand while charges were posting from somewhere else, note that too.
The Fair Credit Billing Act gives you 60 days from the date your statement is sent to dispute a billing error.2Office of the Law Revision Counsel. 15 USC 1666 – Correction of Billing Errors The statute requires written notice, but federal regulations allow electronic submission if the issuer accepts it, and virtually all major issuers now do.3Consumer Financial Protection Bureau. 12 CFR Part 1026 Regulation Z – 1026.13 Billing Error Resolution Most banks have a “Dispute a Charge” button in the online portal or app. Whether you file online or by mail, include your name, account number, the charges you’re disputing, and why you believe they’re unauthorized.
Don’t let the 60-day window lull you into waiting. The sooner you report, the easier it is for the bank to trace the transactions, and the stronger your claim under both the statute and the issuer’s zero-liability policy.
What Your Liability Actually Is
Under the Truth in Lending Act, your maximum liability for unauthorized credit card charges is $50, and only if the issuer has met several conditions, including notifying you of your potential liability and providing a way to identify the unauthorized user.1Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card The burden of proof falls on the issuer, not you. The bank must show that a charge was authorized or that all the conditions for holding you liable have been met.
In practice, the $50 cap rarely comes into play. Visa, Mastercard, and most major issuers voluntarily offer zero-liability policies that eliminate even that amount, provided you used reasonable care to protect the card and reported the fraud promptly. These policies typically cover in-store, online, and phone transactions. They usually exclude commercial cards and unregistered prepaid cards like gift cards. Zero-liability sits on top of the federal floor, so you’re protected by whichever rule is more generous.
One boundary is worth naming. If the compromised card is a debit card rather than a credit card, the rules are much less forgiving. Debit cards fall under the Electronic Fund Transfer Act, and your liability depends entirely on how fast you report: $50 if you notify the bank within two business days of learning of the theft, $500 if you report after that but within 60 days of the statement, and potentially the full amount of unauthorized transfers occurring after the 60-day window.4GovInfo. 15 USC 1693g – Consumer Liability The money also leaves your checking account immediately, so you’re fighting to get it back rather than disputing the bank’s money.
What Happens After You File
Once your dispute is filed, the bank has two complete billing cycles, up to a maximum of 90 days, to investigate and resolve the claim.2Office of the Law Revision Counsel. 15 USC 1666 – Correction of Billing Errors During that window, the bank cannot try to collect the disputed amount or report it as delinquent. Many issuers apply a provisional credit so the fraudulent charges don’t eat into your available balance while the review is underway. That credit becomes permanent if the dispute is resolved in your favor.
Behind the scenes, the bank contacts the merchant’s payment processor and asks for proof the transaction was authorized. If the merchant can’t produce convincing evidence, the dispute is resolved in your favor and the charges are removed. If the bank fails to follow the investigation procedures or misses the deadline, it forfeits the right to collect the disputed amount.2Office of the Law Revision Counsel. 15 USC 1666 – Correction of Billing Errors
If the Bank Denies Your Dispute
Banks sometimes deny disputes, and when they do, they must tell you in writing how much they believe you owe and why. You have the right to request copies of the documents the bank relied on.5Federal Trade Commission. Using Credit Cards and Disputing Charges Review them. If the merchant’s proof is weak, like a delivery confirmation to the wrong address or an IP address from a location you’ve never been, you have grounds to push back.
If the issuer won’t budge, file a complaint with the Consumer Financial Protection Bureau at consumerfinance.gov/complaint. The CFPB forwards your complaint directly to the company, which generally has 15 days to respond, up to 60 in complex cases.6Consumer Financial Protection Bureau. Submit a Complaint Include your dispute timeline, the denial letter, and any evidence supporting your claim.
Update Everything That Auto-Charges the Old Card
Canceling a compromised card kills every automatic payment linked to it. Streaming services, insurance premiums, gym memberships, utility bills, and loan payments will all fail on their next billing date. Some will retry and send you a notice. Others will lapse silently, and you won’t know until your coverage is canceled or a late fee hits.
Major card networks run automatic account-updating services that push your new card number to participating merchants, but not every merchant participates and the updates don’t always happen right away. The safe move is to log in to every service that charged the old card and update the payment method manually once you have the new number. Start with the most consequential accounts: insurance, loan payments, and anything that charges late fees.
Secure the Accounts That May Have Been the Entry Point
Card data often leaks through compromised merchant databases, phishing emails, or malware. Once the bank side is handled, turn to the digital environment that may have been the source.
Change passwords on every retail or service account where the compromised card was saved as a payment method. If you reused the same password across sites, change all of them. Attackers routinely take stolen credentials from one breach and try them across dozens of other platforms. A password manager makes unique passwords practical: it generates random, complex passwords and stores them, so a single breach doesn’t cascade.
Turn on multi-factor authentication everywhere it’s available, especially on financial accounts and email. Even if someone gets your password, they can’t log in without the second factor. If your issuer offers virtual card numbers, they add another layer for online shopping by generating a randomly assigned number linked to your real account but usable for only one merchant or a limited time.
Report the Fraud to the FTC
Reporting the fraud to government agencies creates a paper trail that strengthens your position with creditors and credit bureaus. Start at IdentityTheft.gov, the FTC’s dedicated portal for identity theft victims. Filing there generates an FTC Identity Theft Report, which functions as an official affidavit that the charges were fraudulent.7Federal Trade Commission. Identity Theft – IdentityTheft.gov That report carries weight with creditors, debt collectors, and credit bureaus if any of the fraudulent charges create lingering problems.
A police report is worth filing if the fraud is substantial, if you have any idea who the perpetrator might be, or if your bank specifically asks for a case number. Local police may not have resources to investigate international card fraud rings, but the report is a useful document for dispute escalation and credit bureau corrections.
Put a Layer of Protection on Your Credit File
A hacked credit card doesn’t automatically mean someone will open new accounts in your name, but it’s a warning sign. Taking protective steps now costs nothing.
Credit Freeze
A credit freeze blocks lenders from pulling your credit report, which prevents anyone from opening new accounts in your name. You can place a freeze for free with each of the three national bureaus: Equifax, Experian, and TransUnion.8Office of the Law Revision Counsel. 15 USC 1681c-1 – Identity Theft Prevention; Fraud Alerts and Active Duty Alerts The freeze stays in place until you lift it. When you need to apply for credit, rent an apartment, or take any action that requires a credit pull, you can temporarily lift the freeze online or by phone and reinstate it afterward. Lifting is also free and takes effect within one hour for electronic requests.9Federal Trade Commission. Credit Freezes and Fraud Alerts
Fraud Alerts
A fraud alert is a lighter alternative. Instead of blocking access, it tells lenders to verify your identity before extending credit. An initial fraud alert lasts one year and requires a request to only one of the three bureaus, which must then notify the other two.8Office of the Law Revision Counsel. 15 USC 1681c-1 – Identity Theft Prevention; Fraud Alerts and Active Duty Alerts If you filed an identity theft report with the FTC, you qualify for an extended fraud alert that lasts seven years. Placing either type also entitles you to free copies of your credit report from each bureau.
A freeze is stronger protection; a fraud alert is easier to manage if you expect to apply for credit soon. You can use both. Check your credit reports at least a few times over the following year to confirm no new accounts or inquiries have appeared that you don’t recognize.