Credit card fraud: how to prevent it — and what to do if your card is stolen

Card fraud rarely needs your physical card. A skimmer at a gas pump, a fake "redelivery fee" text or a data breach at a store is enough to put your number in someone else's hands. The FBI's IC3 logged 18,774 credit card and check fraud complaints in 2025, with $282,670,235 in reported losses — up from 12,876 complaints and $199,889,841 in 2024.

How card numbers get stolen

• Skimmers — illegal card readers attached to gas pumps and other payment terminals that grab the data from your card's magnetic stripe without your knowledge.
• Scam texts. Fake package-delivery texts were the most reported text scam of 2024, and the FTC says the small "redelivery fee" they ask for is a trick to get your card number. Fake unpaid-toll texts are after the same thing.
• Data breaches. If a company you shop with is breached, a thief may try to use your card number for purchases.
• Lost or stolen cards.
• Card-not-present fraud — online and phone purchases with a stolen number. It made up 54.3% of debit card fraud at large issuers in 2023, the Federal Reserve found, as chip cards pushed fraud away from in-person payments.

Signs your card has been misused

• Charges on your statement you don't recognize.
• Withdrawals from your bank account that you can't explain.
• Unfamiliar accounts or charges on your credit report.
• Bills or statements that stop arriving.

If your card or number is stolen: first steps

1. Call the card issuer right away using the number on the back of the card or your statement — or use its mobile app. Federal law says you're not responsible for charges or withdrawals made without your permission after you report the loss.
2. Follow up in writing, and go through your recent statements.
3. Dispute charges you didn't make. Write to the issuer's billing-inquiries address so the letter reaches it within 60 days after the first bill with the error was sent. The issuer must acknowledge your dispute within 30 days and resolve it within 90, and you can withhold payment on the disputed amount meanwhile.
4. If your number was exposed in a data breach, cancel the card and ask for a new one.
5. Check your credit reports. Unauthorized charges can be a sign of wider identity theft — if you find accounts you didn't open, go to IdentityTheft.gov for a recovery plan.
6. Report scams to the FTC at ReportFraud.ftc.gov.

What you owe: credit cards vs debit cards

Two details make the credit card column better than it looks. If only your credit card number was stolen and you still have the card, you generally have no liability at all, the CFPB says, and many cardholder agreements promise zero liability on top of the federal limit. With a credit card you can also withhold payment on a disputed charge while it's investigated.

With a debit card the money has already left your account. Your bank generally has 10 business days to investigate (20 for new accounts); if it needs longer, it must give you a provisional credit, minus at most $50, while it finishes. Deadlines must be extended for good reasons such as lengthy travel or a hospital stay.

How to make your card a harder target

• At the pump, check whether the security seal on the payment panel is broken and give the card reader a wiggle. Run a debit card as credit rather than typing your PIN, or pay inside.
• Don't tap links in texts about a missed delivery or an unpaid toll. Forward them to 7726 (SPAM).
• Turn on multi-factor authentication for your card and bank accounts, and check your statements promptly.
• Don't carry your PIN with the card.
• When a card expires, cut through the number, the magnetic stripe and the security code, and damage the chip.
• Look at what your card issuer's app offers — many banks provide transaction alerts, card locks and virtual card numbers. These are issuer features, so check your own bank's app.

Can security software help?

No app can spot a skimmer on a gas pump. Security suites help with the online side: warnings on scam texts and fake shops that fish for card numbers, such as Norton's Safe SMS and Safe Web or McAfee's Scam Detector. In the US, McAfee+ Advanced and Ultimate also monitor bank and credit card transactions.

Call first, write second, check your statements third. Speed matters most with a debit card — the money is yours until it's gone.