Credit and debit card fraud in the UK: what to do if your card is stolen — and what you owe

Card fraud rarely needs your actual card. UK Finance's Annual Fraud Report 2026 (June 2026) puts fraud losses on UK-issued cards at £594.9 million in 2025, across 3.78 million cases — each a card, not a person — with remote purchase fraud (online, phone and mail-order spending with stolen details) making up £423.5 million. The ONS estimated about 2.8 million incidents of bank and credit account fraud in England and Wales in the year to March 2026, up 15% (published July 2026). Reassuringly, UK Finance says banks refund almost all unauthorised fraud.

How card details get stolen

• Online, with your details. Anyone with your card number, expiry date and security code can make 'card not present' purchases, Report Fraud explains, and UK Finance names data breaches at retailers as a major source.
• One-time passcodes. Criminals trick people into revealing one, then use it to add the card to their own digital wallet or approve an online payment.
• Skimming. A device on a cash machine's card slot records your card, someone watches for your PIN, and the card is cloned.
• Lost and stolen cards, often taken in distraction thefts, and new cards stolen from communal letterboxes.

Signs your card has been misused

• Your card is declined although you're sure there's money in the account.
• Purchases or withdrawals you don't recognise on your statement.
• A call or text asking for your PIN as a 'security check'. Your bank and the police never ask for it.
• A one-time passcode you didn't request.

If your card or its details are stolen: first steps

1. Call your bank or card provider straight away on the number on the back of the card, or on 159, and ask it to freeze or cancel the card.
2. Ask for a refund of every payment you didn't authorise; the FCA says the bank's questions or forms shouldn't delay it. On a debit card or current account it's due by the end of the next business day, with any charges and interest.
3. Report it to Report Fraud (online or 0300 123 2040) in England, Wales or Northern Ireland for a crime reference number, or to Police Scotland on 101.
4. Keep a record of every call, email and letter.
5. If more than your card details were taken, follow the identity theft steps too.

What the law says you owe

Debit cards and current accounts come under the Payment Services Regulations 2017; regulated credit cards come under the Consumer Credit Act 1974, because the regulations disapply their own liability rules for regulated credit.

If you deny making a payment, the bank must prove it was authenticated, and use of your card or PIN isn't in itself necessarily proof that you authorised it or were grossly negligent — which the Financial Ombudsman Service calls 'much more than not being careful'. On a debit card you also owe nothing if the bank didn't apply strong customer authentication where the rules required it. On a credit card, your agreement may require a phone report to be confirmed in writing within seven days.

If you were tricked into paying

• By card: ask your card provider for a chargeback. It's a voluntary scheme run by the card companies, so there's no guarantee, but on a debit card it works for any amount.
• By credit card, for a single item priced over £100 and up to £30,000 that never arrived or wasn't as described: you can also claim from the card provider under section 75 of the Consumer Credit Act, even if you paid only part by card.
• By bank transfer to another UK account over Faster Payments or CHAPS, on or after 7 October 2024: your bank must normally reimburse you up to £85,000, usually within five business days. It may deduct an excess of up to £100, but not from vulnerable customers. You won't be repaid if you were complicit or grossly negligent, and you must claim within 13 months of the last payment. Card payments aren't covered.

If your bank or card provider says no

Complain to it first: for fraud and payment complaints it must get back to you within 15 days and send a full response within 35. If you're still unhappy, or it misses those limits, go to the Financial Ombudsman Service within six months of the final response. It's free: use the online form or call 0800 023 4567, Monday to Friday, 8am to 5pm. The ombudsman can also help if your card provider won't take a chargeback further.

How to make your card a harder target

• Shield your PIN at cash machines and tills, and don't write it down.
• Keep your card in sight; don't hand it over to pay.
• Never read out a one-time passcode to someone who calls you.
• Type your bank's web address yourself: fake sites can appear in search results.
• Cut old cards through the magnetic strip and the chip.
• Redirect your post when you move. UK Finance says people who don't are vulnerable to cards stolen in the post.

Can security software help?

Only at the edges. No app can spot a skimmer or stop a breach at a shop you've used, and it's your bank that refunds unauthorised payments. Software helps on your own devices: Police Scotland notes that hackers can use card details saved in online accounts, and Citizens Advice says to update your anti-virus software if a scammer has had access to your computer.

Call your bank first, and fast. Once you've told it, the law says you don't pay for what happens next.