Consumer fraud · Updated September 2026
Credit card fraud
If a charge on your statement is not yours, you are almost certainly getting the money back — but only if you move in the right order. Freeze, dispute, then secure the account that leaked. Here is exactly how, and how to see it coming next time.
The 60-second version
Lock the card in your banking app, then call the number on the back of the card and use the words “unauthorised transaction”. Ask for a dispute reference in writing. Do not call any number from a text or email about the charge. FTC
Your liability for an unauthorised credit card charge is capped at $50 under the Fair Credit Billing Act, and you have 60 days from the statement date to dispute it in writing. CFPB
Six signs your card is compromised
- A small test charge you do not recognise, often under $5.
- A card decline on a purchase you know is within your limit.
- A 'verify your card' text or email with a link — banks never send those.
- A new device or address added to a shopping account.
- A charge from a merchant in a country you have never bought from.
- A replacement card or PIN arriving that you never requested.
Card and payment fraud is consistently the most-reported identity-theft category in the FTC’s national complaint data, and unauthorised charges should also be reported to the FBI’s Internet Crime Complaint Center. FTC data FBI IC3
Check it before you pay
Not sure whether the merchant that charged you is real? Run the site through the free scam checker, look up a suspicious caller with the phone check, or learn how fraud teams do it in the free GACS Academy.
What to do, in order
- Freeze the card first. Freeze or lock the card in your banking app before you call anyone. It takes one tap, stops further charges immediately, and can be undone if the charge turns out to be yours.
- Report the unauthorised charge. Call the number printed on the back of the card — never a number from an email, text or caller. Say the words 'unauthorised transaction' and ask for a written dispute reference.
- Ask for a chargeback, not a refund. A chargeback reverses the payment through the card network. In the US, Regulation Z caps your liability at $50 and most issuers apply zero liability; in the UK and EU, unauthorised card payments must be refunded unless the bank proves gross negligence.
- Change the password on the account that leaked. Most card fraud starts with a compromised shop account or a phishing page, not the card itself. Change that password and turn on two-factor sign-in.
- Check your statement line by line for 90 days. Card thieves test a stolen number with a tiny charge — $0.50 to $5 — before spending. A small unrecognised amount is the earliest warning you will get.
- Report it so others are warned. File with the FTC at reportfraud.ftc.gov (US), Action Fraud (UK), or your national body, then add the merchant or site to the GACS registry so the next person searching it sees the report.
Never do these
- Never call a phone number supplied by the message warning you about the charge — that is the scam itself in most cases.
- Never read a one-time code to anyone, including someone claiming to be your bank’s fraud team. Banks never ask for it.
- Never move money to a “safe account”. No real bank has ever asked a customer to do that.
- Never pay a company that promises to recover your loss for an upfront fee — that is a second scam aimed at fraud victims.
Questions people ask
What is credit card fraud?
Credit card fraud is any use of your card number, PIN or card details to make a payment you did not authorise. It covers stolen physical cards, card numbers harvested from a hacked shop, skimming devices on ATMs and fuel pumps, phishing pages that copy your bank's login, and 'card not present' fraud where only the number is used online.
Am I liable for fraudulent charges on my credit card?
In the US, the Fair Credit Billing Act caps your liability at $50 for a credit card, and almost all major issuers apply a zero-liability policy if you report promptly. In the UK and EU, the bank must refund an unauthorised payment and can only refuse if it can prove you acted fraudulently or with gross negligence. Debit cards have weaker protection than credit cards in most countries — report within two business days.
How long do I have to report credit card fraud?
Report it the day you notice. US rules give you 60 days from the statement date to dispute in writing; UK and EU rules give up to 13 months for an unauthorised transaction, but banks resist late claims and evidence gets harder to gather. There is no advantage to waiting.
Will I get my money back after credit card fraud?
Usually yes, if the charge was genuinely unauthorised and you report it. The card network reverses the payment through a chargeback and the merchant, not you, bears the loss. You will not get money back if you authorised the payment yourself after being tricked — that is an authorised push payment scam, which follows different and much weaker rules.
How do criminals get credit card numbers?
Four main routes: a data breach at a shop or hotel you bought from, a skimmer or shimmer fitted to an ATM or fuel pump, a phishing page or fake checkout that you typed the number into, and malware or a malicious browser extension reading forms as you fill them. Physical card theft is now the smallest category.
Does freezing my card stop existing subscriptions?
Yes — a freeze blocks recurring charges too, so a legitimate subscription may fail while the card is locked. That is a small price to pay for a few hours, and issuers reissue a new number for genuine fraud anyway, which cancels the subscriptions regardless.
Should I file a police report for credit card fraud?
For a card charge alone, the bank dispute is what recovers your money and a police report rarely changes the outcome. File one when there is identity theft attached — new accounts opened in your name, a loan you did not take out — because credit bureaus and lenders will ask for the report number.
Get My Free Scam Alerts
Protecting yourself is good. Protecting your family is better. We email you the card, bank and payment scams spreading right now — free, no credit card, unsubscribe anytime.
Get My Free Scam AlertsPrefer email only? Get the weekly scam digest
New card, bank and payment scams the week they start spreading. Free, unsubscribe any time.
Free · No spam · Unsubscribe anytime · Protected by hCaptcha.
Related
Authoritative sources
Independent primary sources used to check and corroborate the guidance on this page.
- FBI Internet Crime Complaint Center (IC3)
Official US channel for reporting internet-enabled fraud and cybercrime.
- US Federal Trade Commission — ReportFraud
Consumer fraud reporting and published enforcement data.
- UK Action Fraud
UK national reporting centre for fraud and cybercrime.
- Canadian Anti-Fraud Centre
Canada's central repository for fraud reports and scam alerts.
