When a fraudulent charge appears on a credit card, the person named on the account almost never pays for it. Federal law caps a cardholder’s personal liability for unauthorized credit card charges at $50, and the major card networks waive even that amount on personal cards. The cost of credit card fraud instead falls on the issuing bank or the merchant, and which one absorbs it depends on how the transaction was processed and where the security failure occurred.
What the Cardholder Can Owe
The Truth in Lending Act sets a hard ceiling. Under 15 U.S.C. § 1643, your liability for unauthorized use of a credit card cannot exceed $50, and that amount only applies if the issuer met specific conditions: it gave you notice of potential liability, provided a way to report a lost or stolen card, and supplied a method to identify authorized users on the account.1Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card Miss any one of those conditions and you owe nothing under the statute.
The law also cuts off liability once you notify the issuer. Charges made after you report the card lost or stolen are not your responsibility, and if you report before the thief uses the card at all, your statutory liability is zero.1Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card In card-not-present fraud, where a thief has your account number from a data breach or skimmer but never handles the physical card, issuers usually cannot satisfy the statutory identification-method condition. That means zero cardholder liability as a practical matter.
On top of the federal floor, Visa and Mastercard both maintain voluntary zero-liability policies for personal cardholders. Visa’s policy applies whether the card is lost, stolen, or fraudulently used, in store or online.2Visa. Zero Liability Mastercard’s covers in-store, phone, online, mobile, and ATM transactions on personal cards.3Mastercard. Zero Liability Protection These are network rules rather than statutes, so the terms can change. For now, they mean most consumers pay nothing out of pocket for credit card fraud.
When the Issuing Bank Absorbs the Loss
In most fraud scenarios, the issuing bank ends up paying. Once you report an unauthorized charge and the bank cannot shift liability elsewhere, the loss becomes an operating expense on its books. Banks treat fraud losses as a cost of doing business, alongside the expense of investigating claims and reissuing compromised cards.
That exposure is why issuers invest so heavily in fraud detection. Algorithms flag unusual spending patterns, geographic anomalies, and rapid-fire purchases in real time. When the system catches the fraud before the charge posts, no one loses money. When it doesn’t, the bank pays.
Some issuers now offer virtual card numbers as a preventive tool. These are single-use or merchant-specific account numbers that stop working once the intended transaction clears. If a merchant’s database is later breached, the stolen number is already dead, which limits the fallout of a breach and reduces the issuer’s downstream fraud costs.
When the Merchant Pays
Merchants absorb fraud losses more often than most consumers realize, and the main mechanism is the chargeback. When a bank reverses a fraudulent transaction, the merchant loses the sale revenue. If the goods have already shipped, the merchant loses those too. Payment processors also charge a fee for each chargeback, so the merchant pays twice.
The EMV chip liability shift, which the major card networks adopted in 2015, tilted this further against merchants who were slow to upgrade. If a chip-enabled card is swiped at a magnetic-stripe-only terminal and the transaction turns out to be fraudulent, the merchant bears the loss rather than the issuing bank. A retailer with a working chip reader shifts that liability back to the issuer. The financial pressure was strong enough that most brick-and-mortar merchants have upgraded.
Online sellers face a harder problem. Card-not-present transactions put the burden of proof on the merchant. When a purchase is disputed, the merchant needs compelling evidence that the real cardholder made the transaction, such as delivery confirmation with a signature, the IP address and device fingerprint from the order, and timestamps consistent with the cardholder’s usual behavior.4Mastercard. How Can Merchants Dispute Credit Card Chargebacks Without that documentation, the merchant almost always loses the dispute.
High chargeback ratios compound the pain. Payment processors monitor each merchant’s fraud rate, and sellers who exceed network thresholds face higher processing fees or termination of their merchant account. That threat is why address verification and 3D Secure authentication have become standard for online retailers.
Business Cards Are Not Covered the Same Way
The federal $50 cap protects consumer credit transactions. The Truth in Lending Act defines a consumer transaction as credit extended to a natural person primarily for personal, family, or household purposes.5Office of the Law Revision Counsel. 15 US Code 1602 – Definitions and Rules of Construction A corporate card issued for business expenses falls outside that definition, so the statutory cap does not apply.
The networks don’t backstop business cards either. Visa and Mastercard both exclude certain commercial card transactions from their voluntary zero-liability policies.2Visa. Zero Liability3Mastercard. Zero Liability Protection Whether fraud losses on a business card fall on the company, the employee, or the issuer depends on the cardholder agreement. Some business cards do include zero-liability protection contractually, but it isn’t automatic. Read the agreement before assuming the consumer rules apply.
Authorized User Charges Aren’t Fraud
One category of unwanted charges doesn’t shift to anyone else: charges made by someone you added as an authorized user. Adding a person to the account is permission, and federal law will not treat their charges as unauthorized even after a relationship sours. The primary cardholder pays.
The remedy is to contact the issuer and remove the authorized user. Until that removal is complete, every new charge is still yours, and charges made before removal remain yours as well. This trap comes up regularly in divorces and family disputes, and the answer never changes.
Debit Cards Follow Different Rules
If the fraudulent charge came off a debit card rather than a credit card, none of the above applies in the same way. Debit card fraud is governed by the Electronic Fund Transfer Act and Regulation E, which use a tiered liability structure tied to how quickly you report. Cardholder liability caps at $50 if you report within 2 business days of learning of the loss, rises to $500 if you report later but within 60 days of your statement, and becomes potentially unlimited for transfers that occur after that 60-day window has passed.6eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers With a credit card, a missed deadline costs you your dispute rights. With a debit card, it can cost you the account.
Reporting on Time Is What Keeps You at Zero
The consumer protections above depend on reporting the fraud correctly. The Fair Credit Billing Act, at 15 U.S.C. § 1666, requires you to send a written dispute notice to your card issuer within 60 days of the date the statement containing the fraudulent charge was mailed to you.7Office of the Law Revision Counsel. 15 USC 1666 – Correction of Billing Errors Miss the deadline and you can lose your statutory protections against the charge.
The written notice needs your name, account number, and a description of the charge and amount you’re disputing. Send it to the billing inquiries address printed on your statement, which is usually different from the payment address. The FTC recommends certified mail with return receipt so you have proof of delivery.8Federal Trade Commission. Using Credit Cards and Disputing Charges Most issuers also accept disputes by phone or through their app, and calling first often produces a fast provisional credit. Following up in writing preserves your full FCBA rights, and for a large or complicated charge that follow-up matters.
Once you’ve reported, the loss belongs to the bank or the merchant. Your job is to notice the charge and speak up in time.