If someone uses a stolen credit card at your business, you almost always end up paying for it. The cardholder’s bank reverses the sale through a chargeback, you lose the goods or service you already delivered, and your processor adds a fee on top. You aren’t criminally liable for accepting the card in good faith, but the money is gone unless you move quickly to document the transaction and dispute the chargeback.
What the Chargeback Actually Costs You
A chargeback is a forced reversal initiated by the cardholder’s bank after they report the charge as unauthorized. Federal law caps a cardholder’s personal liability for unauthorized credit card use at $50, and most card networks apply zero-liability policies that erase even that.1GovInfo. 15 USC 1643 – Liability of Holder of Credit Card The loss has to land somewhere, and in fraud cases it lands on the merchant.
The sale amount isn’t the whole bill. Processors charge a chargeback fee for each dispute, typically $15 to $100, whether you win or lose. Add the cost of the merchandise that walked out, shipping if it was an online order, and the hours spent responding, and a single fraudulent transaction can cost several times the original ticket.
Why You End Up Liable
The Fair Credit Billing Act protects consumers from unauthorized charges, and card network rules decide which party in the payment chain absorbs the fraud loss.2Federal Trade Commission. Fair Credit Billing Act In nearly every fraud scenario, that’s you. Which rule puts you there depends on how the card was processed.
In-Store Sales and the EMV Liability Shift
Since October 2015, the major networks have enforced the EMV liability shift. Whichever party in the transaction used the weaker technology absorbs a counterfeit fraud loss. If a customer presents a chip card and your terminal swipes the magnetic stripe, you’re liable. If your terminal supports the chip but the issuer never put one on the card, the issuer eats it.3Mastercard. EMV Chip Frequently Asked Questions for Merchants
Online and Phone Orders
For any transaction where the physical card isn’t in front of you, the merchant carries fraud liability by default. No chip reader helps when there’s no card to insert. This is where fraud hits hardest, and where the prevention tools below matter most.
What to Do in the First Hours
If you suspect a transaction was fraudulent, start collecting evidence right away. Documentation is your only ammunition if you have to fight a chargeback later, and much of it degrades fast.
- The transaction receipt, including whether the customer signed and whether the chip was read or the card was swiped.
- The exact date, time, and dollar amount of the sale.
- The last four digits of the card number.
- Any surveillance footage of the person making the purchase. Most systems overwrite on a loop, so pull it before it’s gone.
- A written account from the employee who handled the sale, written while the details are fresh.
The chargeback notice may not arrive for weeks. By then, the video could be recorded over and the employee’s memory hazy.
Fighting the Chargeback
When your processor sends a formal chargeback notice, it carries a reason code. For stolen-card fraud, it will flag an unauthorized transaction. Your response, called representment, is where you submit evidence that contradicts the claim.
Card networks give merchants roughly 20 to 45 days from the notification date to respond, depending on the network.4Mastercard. How Can Merchants Dispute Credit Card Chargebacks Miss the deadline and you lose automatically. The funds are permanently returned to the cardholder with no further recourse.
Most processors provide an online portal. Upload everything you gathered: the signed receipt, video stills or clips, the employee statement, and any communication with the buyer. The issuing bank reviews both sides and rules, which can take several weeks. Winning a fraud chargeback is hard when the real cardholder genuinely didn’t authorize the purchase, but strong documentation gives you a shot and protects you from “friendly fraud” where the buyer is the one lying.
Your Criminal Exposure
Accepting a stolen card in good faith makes you a victim, not a participant. Federal law criminalizes stolen-card use only when someone “knowingly” uses a stolen, counterfeit, or fraudulently obtained card. Processing a transaction without knowing the card is stolen doesn’t meet that bar. The person who used the card faces fines up to $10,000, up to ten years in prison, or both, if the fraudulent charges total $1,000 or more within a year.5Office of the Law Revision Counsel. 15 USC 1644 – Fraudulent Use of Credit Cards Penalties
A merchant who runs a card while suspecting it’s stolen is in a different legal position. If red flags are obvious and you or an employee push the sale through anyway, the business can be exposed to criminal liability.
Reporting the Fraud
Filing a police report is worth doing even though it rarely recovers the money directly. It creates an official record that strengthens your chargeback response and gives investigators a paper trail if the same person is hitting other businesses. Turn over the surveillance footage and transaction details you collected.
For online transactions, or losses over a few thousand dollars, also file a complaint with the FBI’s Internet Crime Complaint Center. IC3 accepts credit card fraud reports and refers cases to federal, state, and local law enforcement.6Internet Crime Complaint Center. IC3 Complaint Form You’ll describe the incident, provide the transaction amount, and share what you know about the buyer.
Can You Take the Loss Out of the Employee’s Paycheck?
When an employee runs a fraudulent card, the instinct is to dock their pay. Federal law limits this sharply. Under the Fair Labor Standards Act, an employer cannot deduct losses caused by customer theft or fraud if the deduction would push the employee’s pay below minimum wage or cut into required overtime.7U.S. Department of Labor. Fact Sheet 16 – Deductions From Wages for Uniforms and Other Facilities Under the FLSA That restriction applies even if the employee was negligent. Many states go further, and some prohibit these deductions altogether.
Asking the employee to reimburse you in cash instead of on the paycheck doesn’t get around it. The Department of Labor treats cash reimbursement the same as a wage deduction for compliance purposes.7U.S. Department of Labor. Fact Sheet 16 – Deductions From Wages for Uniforms and Other Facilities Under the FLSA Training employees to spot fraud before it happens is a better use of the effort.
Writing the Loss Off on Your Taxes
A credit card fraud loss on business property is a theft loss you can deduct on your federal return. You deduct it in the tax year you discovered the theft, not the year the sale occurred.8Internal Revenue Service. Publication 547, Casualties, Disasters, and Thefts The deductible amount is your adjusted basis in the lost property, usually what you paid for the merchandise, minus any insurance reimbursement or chargeback reversal you recover.
Business theft losses aren’t subject to the $100-per-event reduction or the 10%-of-adjusted-gross-income threshold that applies to individual taxpayers.9Internal Revenue Service. Topic No. 515, Casualty, Disaster, and Theft Losses If you still have a reasonable prospect of recovery through a chargeback dispute or insurance claim, you can’t deduct the loss until that question is settled. Once you’ve exhausted your options, the full unreimbursed amount is deductible as a business expense.
Preventing the Next One
No prevention system catches everything, but a handful of measures close off the most common attack routes.
At the Register
The single most important step is making sure your terminal reads chip cards. An EMV-compliant terminal protects you from the liability shift on counterfeit card fraud and makes cloned cards much harder to use.3Mastercard. EMV Chip Frequently Asked Questions for Merchants If your terminal still leans on the magnetic stripe, replacing it should be the first thing you do after reading this.
Train staff to watch for common signals: a customer who seems nervous or rushed, someone buying high-value items without any price sensitivity, a card name that doesn’t match the name given, or a chip that keeps “failing” so the customer asks to swipe. That last one is a classic move with cloned cards. Employees should feel free to ask for ID on large purchases and to call a manager when something feels off.
Online and Over the Phone
Card-not-present fraud needs a different toolkit. Address Verification Service checks whether the billing address the customer enters matches the one the issuer has on file, returning a match or mismatch code for each transaction.10Visa. How to Use Payment Account Validation It won’t stop every attempt, but it screens out the ones where the thief doesn’t have the cardholder’s address.
Requiring the CVV, the three- or four-digit code printed on the physical card, adds another layer. A thief who pulled only the card number from a data breach won’t have the CVV unless they also have the card itself. AVS and CVV together catch a meaningful share of card-not-present fraud before it costs you anything.
For businesses with significant online sales, 3D Secure authentication is the strongest option available. At checkout, the customer is redirected to their card issuer for an additional verification step. When a 3D Secure transaction is successfully authenticated, fraud liability shifts from the merchant to the issuer. If a thief somehow clears the authentication and the real cardholder later disputes the charge, the issuer absorbs the loss instead of you. Most major processors offer a 3D Secure integration.
When Repeat Fraud Threatens Your Merchant Account
One fraudulent transaction is a financial headache. A pattern of them can end your ability to accept cards at all. Networks run monitoring programs that flag merchants with elevated fraud or chargeback rates.
Visa’s Acquirer Monitoring Program tracks dispute-to-sales ratios. As of April 2026, a merchant with a dispute ratio at or above 1.5% is classified as “excessive” and faces direct penalties from Visa.11Visa. Visa Acquirer Monitoring Program Fact Sheet Mastercard uses similar thresholds. If your chargeback count exceeds 1% of Mastercard transactions in a single month and totals $5,000 or more, your processor may be required to terminate the merchant account.
When an account is terminated for excessive chargebacks or fraud, the business goes on the MATCH list (Member Alert to Control High-Risk Merchants), a database maintained by Mastercard and used by virtually every processor. A MATCH listing stays for five years, and most processors will decline your application during that window. For a business that runs on card payments, that outcome is close to fatal, which is why prevention is worth more than any single dispute you might win.