If your credit card has been hacked, call your card issuer’s fraud line right away to shut down the compromised number, then send written notice of the unauthorized charges within 60 days of the statement they appear on. Federal law caps your liability for unauthorized credit card charges at $50, and Visa, Mastercard, and most other networks voluntarily bring that to zero.1Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card2Visa. Visa Zero Liability Policy Once you notify the issuer, you owe nothing for any charges made after that point. From there, secure your online account, watch your recurring charges, and decide whether a fraud alert or credit freeze fits your situation.
Call Your Card Issuer First
The fraud number on the back of your card, or inside your issuer’s mobile app, is usually staffed around the clock. Tell the representative which charges you did not authorize. They will cancel the compromised card number and mail you a replacement with a new number and security code. Ask for a confirmation or claim number before hanging up so you can reference the report later.
The phone call stops further charges quickly, but on its own it does not give you the full protection federal law offers. For that, you also need to put your dispute in writing.
Send Written Notice Within 60 Days
Under the Fair Credit Billing Act, you have 60 days from the date the statement containing the unauthorized charge was mailed to you to send written notice to your card issuer.3Office of the Law Revision Counsel. 15 USC 1666 – Correction of Billing Errors Miss that window and your legal standing to dispute the charge weakens considerably.
Send the letter to the address your issuer designates for billing inquiries, which is not the same as the payment address. Include your name, account number, the amount and date of each disputed charge, the merchant name as it appears on your statement, and a short explanation of why the charge is not yours. Keep copies of everything. Many issuers accept disputes through their app or over the phone as well, but written notice is what triggers the full protections under federal law.
What the Issuer Must Do Next
Your issuer has to send a written acknowledgment of your dispute within 30 days and then resolve it within two complete billing cycles, and in any event no more than 90 days.3Office of the Law Revision Counsel. 15 USC 1666 – Correction of Billing Errors While the investigation is open, the issuer cannot try to collect the disputed amount, close or restrict your account over it, or report the disputed balance as delinquent to the credit bureaus.4Office of the Law Revision Counsel. 15 U.S. Code 1666 – Correction of Billing Errors You still owe the rest of your bill, including finance charges on the undisputed portion.
Lock Down Your Online Account
A hacked card is often a sign of a compromised login. Change the password on your card issuer’s website or app, and do not reuse a password from any other site. Turn on multi-factor authentication so signing in requires a one-time code as well as your password.
Check the security settings for a list of authorized devices and remove anything you don’t recognize. Just as important, look at the email address, phone number, and mailing address on file. Attackers who get into an account sometimes swap in their own contact details so they can intercept password-reset codes and keep access even after you change the password.5Internet Crime Complaint Center (IC3). Account Takeover Fraud (ATO) Also review any third-party payment apps linked to the account and disconnect anything unfamiliar.
Handle Your Recurring Charges
Getting a new card number does not necessarily stop your subscriptions and autopay arrangements. Visa, Mastercard, American Express, and Discover all run updater services that automatically pass your new card number to merchants who bill you on a recurring basis. That is convenient for bills you want to keep paying, but a subscription you meant to cancel can follow you onto the replacement card.
Scan your last few statements for every recurring charge. For anything you want to keep, confirm the new card details are on file. For anything you want to end, contact the merchant directly and go through their cancellation process. A new card number alone will not do it.
Consider a Fraud Alert or Credit Freeze
If you’re worried the hack went beyond the card itself, the next step is deciding between a fraud alert and a credit freeze on your credit files.
Fraud Alert
A fraud alert tells lenders your information may have been compromised and asks them to take extra steps to verify your identity before opening new credit. You only have to contact one of the three major credit bureaus (Equifax, Experian, or TransUnion); federal law requires that bureau to notify the other two.6Office of the Law Revision Counsel. 15 U.S. Code 1681c-1 – Identity Theft Prevention; Fraud Alerts and Active Duty Alerts It’s free, and an initial alert lasts one year. If you’ve filed an FTC identity theft report or a police report, you can request an extended fraud alert that lasts seven years.7FTC: Consumer Advice. Credit Freezes and Fraud Alerts
A fraud alert does not block anyone from pulling your credit report. It just flags the file.
Credit Freeze
A credit freeze goes further. While it’s in place, no one can access your credit report to open a new account in your name, and that includes you.7FTC: Consumer Advice. Credit Freezes and Fraud Alerts Placing and lifting a freeze is free under federal law.8Consumer Advice. Free Credit Freezes and Year-Long Fraud Alerts Are Here You have to contact each bureau separately. Each one gives you a PIN or password to temporarily lift the freeze when you’re applying for credit yourself. A freeze does not expire, does not affect your credit score, and does not block your existing creditors or debt collectors.
A freeze is worth the extra effort when your Social Security number, date of birth, or address may have been exposed along with your card number, because that combination is what someone needs to open entirely new accounts in your name.
File With the FTC If the Fraud Is Broader
If someone did more than run charges on your card, for example if new accounts were opened in your name, file a report at IdentityTheft.gov. The site walks you through what happened and generates an official FTC Identity Theft Report along with a personalized recovery plan.9Federal Trade Commission. IdentityTheft.gov: Report Identity Theft and Get a Recovery Plan The report is a legal record you can hand to creditors, credit bureaus, and law enforcement, and it’s the documentation you need to place the seven-year extended fraud alert.6Office of the Law Revision Counsel. 15 U.S. Code 1681c-1 – Identity Theft Prevention; Fraud Alerts and Active Duty Alerts
A police report isn’t always necessary, but file one if you know who took your information, if your identity was used during an encounter with police, if you have evidence that could help investigators, or if a creditor or financial institution demands a police report before it will act on your claim. A police report can also stand in for the FTC report when you request an extended fraud alert.
If It Was a Debit Card, the Rules Are Different
Everything above is about a credit card. Debit card fraud is governed by the Electronic Fund Transfer Act, and your liability climbs the longer you wait: $50 if you report within two business days of learning about the theft, up to $500 if you report after two business days but within 60 days of your statement, and potentially the full amount of unauthorized transfers made after the 60-day window.10Office of the Law Revision Counsel. 15 U.S. Code 1693g – Consumer Liability11Consumer Financial Protection Bureau. Liability of Consumer for Unauthorized Transfers Debit fraud also pulls money straight out of your checking account, so even a refund can leave you short on cash for days while the bank investigates.
Keep Watching Your Accounts
Additional fraud usually surfaces in the weeks after the first hit, particularly if your data was part of a broader breach. Read your credit card and bank statements carefully for at least several months, and watch for small test charges that often come before larger ones.
You can pull your credit report from each of the three bureaus for free once a week at AnnualCreditReport.com; the bureaus have made this permanent.12Consumer Advice – FTC. Free Credit Reports Look for accounts or credit inquiries you don’t recognize. Most issuers also let you turn on real-time transaction alerts by text or push notification, so a charge shows up on your phone the moment it posts.