When someone steals your credit card and runs up charges, you almost never pay for stolen credit card purchases. Federal law caps your personal liability at $50, and the major card networks waive even that in most cases. The actual cost lands on either the card issuer or the merchant, and which one absorbs it depends on how the fraudulent transaction was processed.
What You Owe as the Cardholder
The Truth in Lending Act sets your maximum liability for unauthorized credit card charges at $50, no matter how much the thief spends. Under 15 U.S.C. ยง 1643, that cap only applies when the issuer gave you notice of potential liability, provided a way to report the loss, and the unauthorized charges happened before you notified the issuer.1Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card Report the card lost or stolen before any fraudulent charges hit, and your liability is zero.
If your physical card never left your wallet and a thief only used the number, you owe nothing under federal law. The statute limits liability to “unauthorized use,” which the implementing regulation defines as use by someone without actual, implied, or apparent authority from which you receive no benefit.2eCFR. 12 CFR 1026.12 – Special Credit Card Provisions The $50 cap applies the same way to purchases and cash advances; the statute makes no distinction.
The major payment networks go further. Visa, Mastercard, American Express, and Discover all maintain zero liability policies that eliminate even the $50 exposure for most cardholders. Visa states that “you won’t be held responsible for unauthorized transactions made with your Visa card” whether the card was lost, stolen, or used fraudulently.3Visa. Zero Liability Mastercard extends the same protection to purchases made in stores, over the phone, online, through mobile devices, and at ATMs.4Mastercard. Zero Liability Protection
These policies come with two conditions. You must use reasonable care in protecting your card, and you must notify the issuer promptly once you spot unauthorized activity. Writing your PIN on the card or sharing your login credentials can disqualify you. Visa and Mastercard also exclude certain commercial cards and unregistered prepaid cards, like gift cards, from zero liability coverage.3Visa. Zero Liability Because these are contractual policies rather than statutes, the networks can modify them, but competitive pressure has kept the terms consistently consumer-friendly.
How the Loss Splits Between the Bank and the Merchant
Once you’re cleared of a fraudulent charge, someone still has to eat the cost. That someone is either the merchant that accepted the charge or the bank that issued your card, and the rules that decide between them center on payment security technology.
The EMV chip liability shift took effect in October 2015 across all major payment brands. It assigns the cost of counterfeit-card fraud to whichever party has the weaker technology. If a merchant runs a chip card through a non-chip terminal and the transaction turns out to be fraudulent, the merchant absorbs the loss. If the merchant’s terminal is chip-compliant but the bank issued a card without a chip, the bank pays.5Mastercard. EMV/Chip Frequently Asked Questions for Merchants
Online and phone purchases follow a different pattern. Because no physical card is present, the merchant generally absorbs the fraud loss unless it verified the buyer’s identity through a secure authentication method such as 3D Secure. When a transaction runs through a fully compliant chip terminal in person and still turns out to be fraudulent, the bank typically takes the hit.
The structure gives both sides a financial reason to invest in fraud prevention. Merchants upgrade their terminals, banks issue chip cards, and each is trying to push the risk onto the other. You benefit either way: the loss lands somewhere in that fight, not on your statement.
The Gap: Authorized Users and People You Handed the Card To
One situation flips the analysis. Under Regulation Z, “unauthorized use” means use by someone without actual, implied, or apparent authority from which the cardholder receives no benefit.2eCFR. 12 CFR 1026.12 – Special Credit Card Provisions Hand your card to a family member to pick up groceries, and if they go on a shopping spree instead, those charges are generally yours. The issuer treats it as a spending dispute between you and the person you trusted, not as fraud.
To cut off liability for someone you previously authorized, you have to tell the issuer that person no longer has permission to use the card. Until you do, the issuer can hold you responsible for charges that person makes, even if they blow past limits you set verbally.6Consumer Financial Protection Bureau. Regulation Z – 1026.12 Special Credit Card Provisions If the issuer sent additional cards to authorized users at your request, it can also impose up to $50 in liability on you for unauthorized use of those cards.
What to Do the Moment You Notice Fraud
Speed decides whether you have any exposure at all. Once you notify the issuer, your liability for anything that happens afterward is zero. Work in this order:
- Call the fraud number on the back of your card. Most issuers run 24/7 fraud lines.
- Lock the card in your banking app while you wait to speak with a representative.
- Go through recent statements and flag every charge you don’t recognize. Note the merchant, date, and amount for each.
- File a police report through your local non-emergency line. Many issuers ask for a report number to process the claim.7Office of the Comptroller of the Currency (OCC). Credit Card and Debit Card Fraud
- Report the theft at IdentityTheft.gov, which generates a personalized recovery plan with pre-filled dispute letters.8IdentityTheft.gov. IdentityTheft.gov
- Place a fraud alert with any one of the three major credit bureaus. Under the Fair Credit Reporting Act, that bureau must notify the other two, and the alert lasts one year for free. If you file an identity theft report, you can request an extended alert lasting seven years.9Office of the Law Revision Counsel. 15 USC 1681c-1 – Identity Theft Prevention; Fraud Alerts and Active Duty Alerts
Keep copies of everything: the police report, your written dispute, confirmation numbers from the issuer, and the FTC recovery plan. If the investigation drags on, that paper trail is what carries you.
The 60-Day Deadline That Protects Your Right to Dispute
The Fair Credit Billing Act gives you 60 days from the date the issuer sends the statement containing the error to submit a written dispute. Miss it and the issuer has no legal duty to investigate.10Office of the Law Revision Counsel. 15 USC 1666 – Correction of Billing Errors This is the single most important date in the entire process. Read every monthly statement. People miss fraud not because it hides well but because they don’t look.
Your written notice has to go to the address the issuer designates for billing inquiries, which is usually different from the payment address on the statement. Look for it in your cardholder agreement or on the statement. Certified mail with a return receipt creates proof that the issuer got your dispute in time. While the investigation is open, the issuer cannot try to collect the disputed amount or related finance charges, and it cannot report the disputed amount as delinquent to the credit bureaus.11Federal Trade Commission. Fair Credit Billing Act
Debit Cards Are Not the Same
If the stolen card was a debit card, none of the above rules apply. Debit card fraud is governed by the Electronic Fund Transfer Act, and the protections are weaker. Report within two business days of learning about the loss and your liability is capped at $50. Between two and 60 days after your statement is sent, it can reach $500. After 60 days, your liability for unauthorized transfers is unlimited.12GovInfo. 15 USC 1693g – Consumer Liability There’s also a practical hit: fraudulent debit charges pull money straight out of your bank account, so you’re short on rent or bills while the bank investigates.13FDIC.gov. VI-2 Electronic Fund Transfer Act Many banks voluntarily extend zero liability policies to debit cards, but they aren’t required to, and those policies often have shorter reporting windows.