What Happens If Someone Uses Your Credit Card: Disputes and Your Rights

If someone uses your credit card without permission, federal law caps what you can be forced to pay at $50, and if the thief only had your card number rather than the physical card, you owe nothing at all. Most major issuers waive even the $50 through their own zero-liability policies. But those protections depend on what you do next: call the issuer right away, send a written dispute to the correct address within 60 days, and follow up on the collateral damage a stolen number can cause.

How Much You Actually Owe

Under the Fair Credit Billing Act, the maximum personal liability for unauthorized charges on a consumer credit card is $50. Even that ceiling only applies if the issuer met certain conditions first: it must have told you about your potential liability, given you a way to report a lost or stolen card, and provided a means to identify authorized users. If any of those conditions failed, your liability is zero regardless of what the thief charged.¹

If the physical card was never presented, and the thief used only the account number or other information printed on it, the issuer cannot hold you responsible for a cent. That rule covers online purchases, phone orders, and charges that stem from a data breach.²

On top of the federal floor, Visa, Mastercard, Discover, and American Express each offer zero-liability policies that waive the $50 even when the physical card was stolen. These are card-network rules rather than statutes, and specific terms vary, but the practical effect for most cardholders is paying nothing.

One thing to know if you’re comparing this to a debit card: the protections are not the same. Debit fraud falls under the Electronic Fund Transfer Act, and your exposure scales with how fast you report. Notify within two business days and you’re capped at $50; wait longer and you can be liable for up to $500; miss the 60-day window after the statement and there’s no cap at all.³ With a credit card, the disputed amount is the bank’s money until you pay the bill. With a debit card, the money is already gone from your checking account while the bank investigates.

Call the Card Issuer First

The moment you spot a charge you didn’t make, call the customer service number on the back of your card or on your statement. Under federal law, your liability only covers charges made before you notify the issuer, so speed matters. Every hour you delay is another hour of exposure.¹

Identify each transaction you’re disputing. The issuer will cancel the compromised card and send a replacement with a new number. Standard shipping takes several business days; some issuers offer paid expedited delivery, and a few, like American Express, provide free next-day shipping.⁴

Write down the date and time of the call, the representative’s name, and any reference number they give you. That record protects you if there’s ever a question about when you reported the fraud.

Reset Your Recurring Payments

Once the old number is canceled, every automatic payment tied to it will fail. That includes streaming services, gym memberships, insurance premiums, loan payments, and utility bills. Pull the last two or three months of statements, list every recurring charge, and update each one when the new card arrives. Check back a full year for quarterly or annual charges you might otherwise miss. A missed insurance or loan payment can trigger late fees or a lapse in coverage, which becomes a worse problem than the fraud itself.

Send a Written Dispute Within 60 Days

This is the step most people skip, and it’s the one that unlocks the strongest protections you have. Calling the issuer is enough to cap your liability and freeze the card, but the Fair Credit Billing Act’s billing-error rules only kick in when you send a written notice. Without that letter, the bank isn’t on a legal clock to investigate, isn’t required to credit your account, and isn’t barred from trying to collect on the disputed amount.⁵

Your notice must reach the issuer’s billing dispute address within 60 days after the statement containing the fraudulent charge was sent to you. Don’t use the general mailing address, and don’t tuck it in with a payment stub. The correct address for billing disputes is disclosed separately, usually on your statement or the issuer’s website. Include your name, account number, the amount you’re disputing, and a short explanation of why the charge is unauthorized.⁵

Send it by certified mail with return receipt so you can prove the delivery date. Once the issuer has your written notice, they cannot try to collect the disputed amount or report it as delinquent until the investigation ends.

What the Bank Has to Do Next

After receiving your written notice, the issuer has 30 days to send a written acknowledgment. It then has two full billing cycles, but no more than 90 days total, to finish the investigation and either correct your account or explain in writing why it believes the charges are valid.⁶

You are not required to pay the disputed amount during the investigation. Many issuers post a provisional credit so the charges don’t affect your available balance or accrue interest. If the investigation confirms fraud, that credit becomes permanent and any related finance charges must come off.⁵

The burden of proof sits with the bank, not you. If the issuer wants to hold you liable, it has to prove either that the use was authorized or that all the statutory conditions for imposing liability were met. You are not required to prove you didn’t make the purchase.¹

Should You File a Police Report

Most issuers don’t require a police report for a straightforward fraud dispute, but filing one creates an official record that becomes important if the stolen card turns out to be part of a broader identity theft problem. Before going to the police, file an identity theft report at IdentityTheft.gov. The FTC site walks you through the questions and generates an Identity Theft Affidavit, which combines with your police report to form a formal Identity Theft Report. That combined document carries legal weight with creditors and credit bureaus, and some won’t act without it.⁷⁸

Check Your Credit Reports

One stolen card number can be a signal that more of your information is out. Pull your reports from Equifax, Experian, and TransUnion and look for accounts you didn’t open, addresses you don’t recognize, and hard inquiries you didn’t authorize. All three reports are free every week at AnnualCreditReport.com, and the bureaus have made that weekly access permanent.⁹

If you find something fraudulent, dispute it directly with the credit bureau by online form, phone, or mail, and include your police report or Identity Theft Report. The bureau must investigate within 30 days and delete anything it cannot verify. If you send additional relevant information during that window, the bureau can extend the investigation by up to 15 more days, but no longer.¹⁰

Pull your reports again once the dispute is resolved to confirm the corrections stuck. Equifax offers an additional six free reports per year through 2026 on top of the weekly access.¹¹

Fraud Alert or Credit Freeze

If you’re worried the fraud might extend to someone opening new accounts in your name, you have two free tools, and you can use them together.

A fraud alert tells lenders to verify your identity, usually by phone, before approving new credit. Contact just one of the three bureaus and that bureau notifies the other two. An initial alert lasts one year. With an Identity Theft Report, you can request an extended alert that stays on file for seven years.¹²

A credit freeze goes further and blocks access to your credit report entirely, which effectively prevents new accounts from being opened in your name. You must contact each bureau separately to place or lift a freeze. It stays on until you remove it, and you’ll get a PIN or password to temporarily lift it for a legitimate application.¹³

A freeze is the stronger choice if you’re not planning to apply for new credit soon. A fraud alert is less disruptive if you’re in the middle of shopping for a mortgage, auto loan, or other product where a lender needs to pull your report.

If the Bank Denies Your Claim

Denials happen. The usual reasons are that the charges look consistent with your normal spending, or the merchant produced evidence like a delivery confirmation or IP address suggesting the purchase was legitimate. Start by asking for a written explanation of the denial. Under the Fair Credit Billing Act, the creditor must provide one on request. Read it carefully, because sometimes the denial rests on incomplete information you can correct by submitting additional documentation.⁵

If the issuer won’t move, file a complaint with the Consumer Financial Protection Bureau at consumerfinance.gov/complaint or by calling (855) 411-2372. The CFPB forwards the complaint to the company, which is required to respond, and you get a chance to review the response. It doesn’t guarantee reversal, but companies handle these differently when a federal regulator is on the file.¹⁴

1
Office of the Law Revision Counsel. 15 USC 1643 Liability of Holder of Credit Card
2
Consumer Financial Protection Bureau. Section 1026.12 Special Credit Card Provisions
3
Office of the Law Revision Counsel. 15 US Code 1693g – Consumer Liability
4
Office of the Comptroller of the Currency (OCC). Credit Card and Debit Card Fraud
5
Office of the Law Revision Counsel. 15 USC 1666 Correction of Billing Errors
6
Consumer Financial Protection Bureau. Billing Error Resolution
7
Federal Trade Commission. Identity Theft Recovery Steps
8
Federal Trade Commission. IdentityTheft.gov Recovery Checklist
9
Federal Trade Commission. You Now Have Permanent Access to Free Weekly Credit Reports
10
Office of the Law Revision Counsel. 15 USC 1681i Procedure in Case of Disputed Accuracy
11
Federal Trade Commission. Free Credit Reports
12
Office of the Law Revision Counsel. 15 USC 1681c-1 Identity Theft Prevention Fraud Alerts and Active Duty Alerts
13
Federal Trade Commission. Fraud Alert and Credit Freeze Whats the Difference
14
Consumer Financial Protection Bureau. So How Do I Submit a Complaint