Your bank can see the merchant name, exact dollar amount, timestamp, IP address, and device details for every online card purchase, but it cannot see who was actually holding the phone or sitting at the keyboard. So when someone uses your card online without permission, the question of whether the bank can identify the user is largely the wrong one. What decides how much you owe is how quickly you report the charge, whether the card is credit or debit, and whether the physical card was taken or just the number.
What Your Bank Actually Sees
Every online checkout sends a packet of data through the payment processor to your card issuer. The bank records the merchant’s registered business name, the dollar amount, and the timestamp of authorization. Those three fields are what show up on your statement.
Alongside that receipt, the bank receives technical metadata that works like a digital fingerprint. The most useful piece is the IP address, a numerical label tied to the network used for the purchase. IP-based geolocation is imprecise and generally accurate only to a city or regional level, not a specific address. The bank also sees the device’s operating system and browser version, which its fraud systems compare against your usual patterns.
Many online transactions now run through an extra authentication step called 3D Secure, branded as Visa Secure or Mastercard Identity Check. The newer version of the protocol shares more than 150 data elements with the issuer, including browser language and device characteristics, and can prompt you for a one-time code or biometric confirmation on your phone.1Visa. Visa Secure EMV 3-D Secure for Merchants
Why None of That Identifies a Person
Unlike an ATM camera, an online purchase produces no image of the buyer. The bank treats a transaction as legitimate whenever the correct authentication credentials are presented: a saved password, a texted one-time code, a fingerprint stored on the device. If a family member, roommate, or thief has those credentials, the system cannot tell the difference between them and you. Fraud detection only flags the activity when the digital fingerprint drifts far from your normal profile, such as a purchase from an unusual country or an amount well outside your typical range.
That limitation shapes every dispute. When you report a charge as unauthorized, the bank investigates whether the technical markers match your profile, but it cannot definitively prove or disprove that you were the one who clicked “buy.”
What You Owe for Unauthorized Charges
Federal law caps how much you can be forced to pay when someone uses your card without permission. The credit card and debit card rules are very different, and how fast you report is the single biggest factor.
Credit Cards: $50 Maximum
Your liability for unauthorized credit card charges is capped at $50, no matter how much the thief spent or how long the fraud continued.2Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card If you report the card compromised before any unauthorized charge posts, you owe nothing.
The Fair Credit Billing Act also lets you dispute billing errors, including charges for items never delivered or wrong amounts, by sending written notice to your card issuer within 60 days after the statement containing the error was mailed to you.3Office of the Law Revision Counsel. 15 USC 1666 – Correction of Billing Errors Most banks accept disputes through their app or website, but the statute specifically requires written notice. A follow-up letter, ideally certified mail to the address the issuer designates for billing inquiries, gives you the strongest legal footing.
Debit Cards: A Sliding Scale
Debit card protections under Regulation E are harsher the longer you wait:
- Report within 2 business days of learning of the unauthorized transfer, and your loss is limited to $50 or the amount of unauthorized transfers before you notified the bank, whichever is less.4eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
- Report after 2 business days but within 60 days of your statement, and your liability can rise to $500.4eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
- Wait longer than 60 days, and you face unlimited liability for unauthorized transfers that occur after the 60-day window closes, as long as the bank can show those transfers would not have happened if you had reported sooner.5Consumer Financial Protection Bureau. 1005.6 Liability of Consumer for Unauthorized Transfers
A few days of delay can multiply your exposure from $50 to $500. Waiting past 60 days can leave you responsible for the rest.
When Only the Card Number Was Stolen
Most online card fraud involves a stolen number rather than a stolen physical card, and Regulation E treats that scenario more favorably. When unauthorized transfers happen without the physical access device, the $50 and $500 tiers do not apply. You have no liability for transfers you report within 60 days of your statement. Miss that window, and you become liable for transfers that occur after the deadline.6Consumer Financial Protection Bureau. Comment for 1005.6 Liability of Consumer for Unauthorized Transfers
Network Zero-Liability Policies
In practice, most cardholders end up owing nothing. Visa and Mastercard both offer zero-liability policies that go beyond the federal minimums and cover unauthorized transactions made online, in stores, over the phone, or at ATMs. Mastercard’s policy eliminates your liability for unauthorized charges as long as you used reasonable care to protect your card and promptly reported the loss or theft.7Mastercard. Zero Liability Protection These policies typically exclude certain commercial cards and unregistered prepaid cards like gift cards, and where a network policy conflicts with applicable law, the law controls.
How to Report the Charge
Before you call, pull together the pieces the fraud department will ask for:
- The exact date, dollar amount, and merchant name as they appear on your statement, plus any transaction ID.
- Your card number (or last four digits) and the name on the account.
- A short description of the problem: fully unauthorized, duplicate, item never received, or another billing error.
- Copies of any emails, chat logs, or call notes if you already tried to resolve the issue with the merchant.
You can file through your bank’s app or website (most have a “Dispute a Charge” link inside the transaction detail), by calling the fraud number on the back of the card, or by writing to the billing inquiries address on your statement. For a credit card dispute, sending written notice by certified mail to that billing address is the safest way to preserve your rights under the Fair Credit Billing Act, even if you also file online.3Office of the Law Revision Counsel. 15 USC 1666 – Correction of Billing Errors
What the Bank Does Next
Timelines
On a credit card, your issuer must acknowledge your written complaint within 30 days and resolve the dispute within two full billing cycles, no more than 90 days after receiving your notice.8Consumer Advice – FTC. Using Credit Cards and Disputing Charges
On a debit card, the bank has 10 business days from receiving your error notice to investigate and reach a determination. It can extend the investigation up to 45 days, but only if it provisionally credits your account within those first 10 business days.9Consumer Financial Protection Bureau. 1005.11 Procedures for Resolving Errors For point-of-sale debit card transactions, the extended deadline stretches to 90 days. The provisional credit stays in your account until the bank reaches a final decision; if the bank ultimately finds no error, it can reverse the credit after notifying you.
Your Card and Account During the Review
The bank will typically cancel the compromised card and issue a replacement with a new number. In some cases it may put temporary restrictions on the account while it reviews the situation, which can affect access to your funds until the review is complete. Banks are not always transparent about the specific reasons for a freeze or when it will lift.
Credit Reporting
While a credit card dispute is under investigation, your issuer cannot report the disputed amount as delinquent to the credit bureaus. If the investigation concludes that you owe the amount, you get at least 10 days to pay before any delinquency can be reported. If you keep disputing the charge in writing, the issuer can report you as delinquent, but the report must note that the amount is still in dispute, and the issuer must tell you who received the delinquency report.10Office of the Law Revision Counsel. 15 USC 1666a – Regulation of Credit Reports
If the Dispute Is Denied
A denial is not the end. For a credit card dispute, you can appeal within the time your issuer gives you for payment, or 10 days after receiving the explanation, whichever is later.8Consumer Advice – FTC. Using Credit Cards and Disputing Charges
For a debit card dispute, the bank must send you a written explanation of its findings and tell you that you can request the documents it relied on.9Consumer Financial Protection Bureau. 1005.11 Procedures for Resolving Errors Those documents often reveal what evidence the merchant submitted, such as delivery confirmation, matching IP or shipping addresses, Address Verification Service results, or a successful 3D Secure authentication. If you originally withdrew a dispute and want to reassert it, you can, as long as you are still within the original 60-day reporting window.
If the bank still refuses to move, you can file a complaint with the Consumer Financial Protection Bureau, which oversees both credit and debit dispute rules. Small claims court is an option for recovering funds as a last resort; filing fees vary by jurisdiction and generally run from roughly $30 to $75, though they can be higher depending on the claim amount.
One Warning About Disputing Charges You Made
Disputing a charge you actually authorized, sometimes called friendly fraud or first-party fraud, carries real risk. At a minimum, the bank may close your account and flag you internally, which makes opening accounts elsewhere harder. At worst, a false dispute can trigger federal criminal charges: the bank fraud statute makes it a crime to obtain money from a financial institution through false representations, punishable by a fine of up to $1,000,000, up to 30 years in prison, or both.11Office of the Law Revision Counsel. 18 USC 1344 – Bank Fraud Prosecutions for individual false chargebacks are uncommon, but the same technical evidence the bank cannot use to identify a stranger, such as IP matches, delivery records, and authentication logs, works well for identifying a cardholder who claims a charge was not theirs when it was.