Someone can use your credit card without having it because online and phone purchases only require three pieces of data: the card number, the expiration date, and the security code. If a thief obtains those digits through a data breach, malware, a phishing message, a skimming device, or even a quick glance over your shoulder, they can charge your account from anywhere in the world. The physical card never has to leave your wallet.
Here is how that theft actually happens, how to catch it, and what federal law says you owe when it does.
Data Breaches Sold on the Dark Web
Large-scale breaches at retailers, hotel chains, and service providers remain one of the biggest sources of stolen card data. Hackers can walk away with millions of card numbers in a single intrusion, then sell them in bulk on dark web marketplaces. A single card’s details might go for anywhere from a few dollars to roughly fifty, depending on the credit limit and issuing bank. The person who eventually charges your account is often not the one who stole the data in the first place.
Malware, Keyloggers, and Public Wi-Fi
Malicious software installed on your phone or computer can silently record every keystroke. When you type your card number at checkout, a keylogger captures it and sends it to an attacker’s server. This software often arrives through infected email attachments, sketchy app downloads, or compromised websites, and it can run undetected for months.
Unencrypted public Wi-Fi creates a similar exposure. Packet-sniffing tools let an attacker intercept data traveling between your device and the router. If the site you’re shopping on doesn’t use a secure connection, your card details can be read in plain text as they pass through the network.
BIN Attacks: When Thieves Guess Your Number
Sometimes a thief doesn’t steal your specific number — they generate it. Every card starts with a bank identification number, or BIN, which is the first four to six digits identifying the issuing bank. BINs are publicly known. Automated software rapidly produces and tests combinations of the remaining digits along with expiration dates and security codes, verifying each guess by running small transactions through online merchants. Once a combination clears, the fraudster stores it and moves on to larger purchases before the account is closed.
Phishing, Smishing, and Vishing
Social engineering gets you to hand over the details yourself. Phishing emails mimic the branding of banks and major retailers, usually warning about a locked account or suspicious activity and pushing you to click a link. The link opens a fake site built to look identical to a real login page. Anything you type goes straight to the attacker.
The same tactic runs through text messages (smishing) and phone calls (vishing). A caller posing as a fraud investigator might ask you to “confirm” your card number to protect the account. Automated dialers let scammers reach thousands of people at once, and the manufactured urgency makes targets respond before thinking it through.
Skimmers, Shimmers, and Shoulder Surfing
Physical proximity still creates openings even when the card stays in your pocket. Shoulder surfing — watching someone type card details in a store or coffee shop — needs nothing more than a decent angle. A dishonest employee at a restaurant or retail counter can photograph both sides of a card with a phone in seconds.
Skimming devices are small hardware attachments placed over legitimate card readers at gas pumps and ATMs. A related device called a shimmer sits inside the card slot itself, between the chip and the reader, and copies data from chip transactions. The stolen information is then used to build a digital profile of the card for online fraud, no plastic required.
How to Spot Unauthorized Charges Early
Fraudsters often test stolen data with tiny purchases, sometimes under a dollar, to confirm the card is active and has available credit. If those small charges go unnoticed, larger ones follow. Reviewing your transaction history regularly, instead of waiting for the monthly statement, is the most reliable way to catch fraud early. Most banking apps let you turn on real-time push notifications for every transaction, so an unauthorized charge shows up on your phone within minutes.
When you review your statement, look for unfamiliar merchant names, charges in cities you haven’t visited, and duplicate transactions. Write down the exact date, the merchant name as it appears, and the dollar amount of anything suspicious. You’ll need those details when you contact your issuer.
What You Actually Owe for Unauthorized Charges
Federal law limits your personal exposure. Under Regulation Z, your liability for unauthorized use of a credit card cannot exceed the lesser of $50 or the amount charged before you notify the issuer. Once you report the fraud, you owe nothing for anything charged after that.1eCFR. 12 CFR 1026.12 – Special Credit Card Provisions If the issuer failed to give you adequate notice of your potential liability or a way to report loss, even that $50 cap may not apply.2Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card
In practice, you’ll likely owe nothing. Visa and Mastercard both maintain zero-liability policies covering unauthorized transactions made in stores, online, by phone, or at ATMs, which go past the federal $50 floor.3Visa. Visa Zero Liability Policy4Mastercard. Mastercard Zero Liability Protection Policy These policies generally require that you used reasonable care in protecting the card and reported the fraud promptly. Anonymous prepaid cards and certain commercial cards are typically excluded.
The 60-Day Dispute Window
The Fair Credit Billing Act gives you 60 days after the issuer sends a billing statement to submit a written dispute of any charge on it. Miss that window and the issuer is no longer required to investigate or correct the error. Written notice goes to the issuer’s billing inquiries address, which is different from the payment address; both appear on your statement. Include your name, account number, the amount you believe is wrong, and a brief explanation.
A Boundary Worth Knowing: Debit Cards Are Different
If a thief uses a debit card number instead, a different federal law applies and the stakes are higher because the money leaves your checking account directly. Under Regulation E, liability depends on how quickly you report:
- Within two business days, liability is capped at $50.
- Between two and 60 days, liability rises to as much as $500.
- After 60 days, you could face unlimited liability for unauthorized transfers that occur past the 60-day window.
Report suspicious debit activity immediately, even the small stuff.5Consumer Financial Protection Bureau. Regulation E 1005.6 – Liability of Consumer for Unauthorized Transfers
How to Dispute a Fraudulent Charge
Call your issuer as soon as you notice an unauthorized transaction. You can report fraud by phone, in person, or in writing; any method that gets the information to the issuer counts as notification.1eCFR. 12 CFR 1026.12 – Special Credit Card Provisions The issuer will typically freeze or cancel the compromised number and send a replacement. If the card is tied to automatic payments, update those accounts with the new number. Some card networks push updated details to merchants with recurring billing relationships, but not all merchants participate.
Once you formally dispute a charge, the issuer has two complete billing cycles, and no more than 90 days, to investigate and resolve the claim.6eCFR. 12 CFR 1026.13 – Billing Error Resolution During that period the issuer cannot try to collect the disputed amount from you, charge interest on it, or report it as delinquent.7Consumer Financial Protection Bureau. Regulation Z 1026.13 – Billing Error Resolution Some issuers voluntarily issue a temporary credit while investigating, though they aren’t required to. If the investigation confirms fraud, the credit becomes permanent and the charge comes off the statement.
One boundary: a single fraudulent charge on one card is a dispute matter. If your information is being used across multiple accounts, or someone has opened new accounts in your name, that’s identity theft, and filing a report at IdentityTheft.gov unlocks additional rights, including extended fraud alerts and the ability to block fraudulent debts from your credit file.8Federal Trade Commission. IdentityTheft.gov
Reducing the Chances It Happens Again
A few practical habits cut your exposure:
- Turn on real-time transaction alerts in your banking app. Catching a fraudulent charge within minutes instead of days keeps you inside the tightest liability windows.
- Use virtual card numbers when your issuer offers them. Single-use or merchant-locked numbers limit the damage if the number is stolen.
- Avoid public Wi-Fi for purchases, or use a VPN to encrypt your connection if you must.
- Treat tiny unfamiliar charges as a warning sign, not a rounding error. They’re often verification tests before a larger purchase.
- After replacing a compromised card, review every subscription and automatic bill tied to the old number so nothing lapses.
Credit freezes and fraud alerts also exist, but they address a different problem: preventing new accounts from being opened in your name. They won’t stop someone from using an existing card number that has already been stolen.9Federal Trade Commission. Credit Freezes and Fraud Alerts