If someone used your credit card without permission, federal law caps what you can be forced to pay at $50, and in most cases you will owe nothing at all. The two things that lock in that protection are speed and paperwork: call your card issuer as soon as you spot the charge, then send a written dispute to the address on your statement within 60 days. Everything below explains what you owe, how to report the charges, what the issuer must do next, and what to try if the claim is denied.
What You Actually Owe
The Truth in Lending Act limits a cardholder’s liability for unauthorized credit card use to a maximum of $50. Even that cap only applies if the issuer first met three conditions: it gave you notice of potential liability, gave you a way to report loss or theft, and included a method to identify who is authorized to use the card. If the issuer can’t prove it did all three, you owe nothing. The burden of proof sits with the issuer.1Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card
The $50 ceiling also only covers charges that happen before you tell the issuer. Once you have reported the problem, your liability for anything that posts afterward is zero. And if your physical card was never lost or stolen and only the card number was compromised, you generally owe nothing under the statute at all, because the $50 cap is tied to loss or theft of the card itself.1Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card
On top of federal law, Visa and Mastercard both require their issuing banks to offer zero-liability policies, meaning you will not be held responsible for unauthorized charges regardless of the statutory $50 figure. Visa’s policy covers credit and debit cards and requires issuers to replace stolen funds within five business days of notification.2Visa. Visa Zero Liability Policy Mastercard offers similar protection for purchases made in stores, online, by phone, or through mobile devices.3Mastercard. Mastercard Zero Liability Protection Policy Neither network’s zero-liability policy applies to commercial cards or unregistered prepaid cards like gift cards.
Call Your Card Issuer First
Start with the number on the back of your card. Tell the representative exactly which transactions are fraudulent, ask them to cancel the compromised card, and request a replacement. This call is what stops the clock on any further unauthorized charges, and it triggers the practical protections the issuer applies while it investigates.
Before calling, put together a list of every charge you can identify as fraudulent. Note the date each one posted, the merchant name, and the dollar amount. Check whether your physical card is still with you, because that changes both your liability and how the issuer categorizes the fraud.
Send a Written Dispute Within 60 Days
This is the step that protects your legal rights, and it is the one people most often skip. The Fair Credit Billing Act requires a written notice of billing errors sent to the creditor’s billing inquiry address. A phone call alone is not enough. The written notice must arrive within 60 days after the issuer mailed or transmitted the statement showing the unauthorized charge, and it needs to include your name and account number, identify the charge you believe is wrong, and explain why you think it’s an error.4Office of the Law Revision Counsel. 15 U.S. Code 1666 – Correction of Billing Errors
Many issuers now accept electronic disputes through their website or app. Under Regulation Z, an electronic submission counts as written notice if the creditor says it accepts them and explains how to submit one.5Consumer Financial Protection Bureau. Regulation Z 1026.13 – Billing Error Resolution If you’re unsure whether your issuer treats an electronic form as a formal billing error notice, send a letter to the billing inquiry address on your statement and use certified mail so you have proof it arrived.
The phone call is what stops further charges. The written notice is what secures your legal protections. Do both.
What the Issuer Must Do Next
Once your written dispute arrives, federal law puts the issuer on a clock. It must send you a written acknowledgment within 30 days of receiving your notice, unless it resolves the dispute entirely within that same 30-day window. It then has to complete the investigation and either correct your account or explain in writing why it believes the charges were valid within two full billing cycles, and no later than 90 days from when it received your notice.4Office of the Law Revision Counsel. 15 U.S. Code 1666 – Correction of Billing Errors
While the investigation is open, you are not required to pay the disputed amount or any interest that accrues on it. Most issuers go further and post a provisional credit within a few days so the fraudulent charges don’t eat into your available credit. If the charges are confirmed as fraudulent, that provisional credit becomes permanent and any related finance charges are removed.
Your Credit Score During the Dispute
If a business continues reporting a disputed amount to the credit bureaus, it must tell the bureau the amount is in dispute, and the bureau must include that notation in your file. If the investigation results in a correction, the credit bureau must send notice of the correction to anyone who received your report in the past six months, if you ask them to.6Consumer Advice – FTC. Disputing Errors on Your Credit Reports
When the Person Who Used It Is Someone You Know
Fraud by a stranger is straightforward. Fraud by a family member or friend is legally messier. Federal regulations define “unauthorized use” as use by someone who lacks actual, implied, or apparent authority and from which the cardholder receives no benefit. If you handed your card to a relative to pick up groceries and they went on a shopping spree instead, that person had some authority from you, even though they exceeded it.7Consumer Financial Protection Bureau. Regulation Z 1026.12 – Special Credit Card Provisions
The regulatory commentary spells out how this plays out. When a cardholder gives a card to someone who then exceeds the authority granted, the cardholder is liable for those transactions unless they’ve notified the creditor that the person is no longer authorized to use the card. Liability for that series of unauthorized charges still can’t exceed $50 or the value obtained before you notified the issuer, whichever is less.8Consumer Financial Protection Bureau. Comment for Regulation Z 1026.12 – Special Credit Card Provisions
If someone you trusted misuses your card, call the issuer immediately and revoke that person’s authorization. Until you do, you may be on the hook for what they charge. And if you added them as a formal authorized user on your account, their spending is generally your responsibility whether or not you approved each purchase.
If the Issuer Denies Your Claim
Issuers do deny fraud claims, usually because they believe the evidence doesn’t support the dispute. Ask for a written explanation of the denial. Often the problem is thin documentation rather than any real belief that you authorized the charges.
Gather anything that backs up your case: a police report, an FTC Identity Theft Report from IdentityTheft.gov, receipts or location records showing you were somewhere else when the charge posted, and records of your calls and letters with the issuer. The FTC’s report is generally accepted in place of a police report for credit card fraud and can be created online through a guided process.9IdentityTheft.gov. IdentityTheft.gov – Report Identity Theft Submit everything as a formal appeal.
If the appeal goes nowhere, file a complaint with the Consumer Financial Protection Bureau at consumerfinance.gov/complaint or by calling (855) 411-2372. The CFPB forwards your complaint to the issuer, which must respond, and the agency publishes response data that companies pay attention to.10Consumer Financial Protection Bureau. So, How Do I Submit a Complaint? If neither the appeal nor the complaint resolves it, a consumer protection attorney is a reasonable next step. Many offer free initial consultations, and some federal consumer statutes allow recovery of attorney’s fees, so the cost may not fall entirely on you.
Reducing the Chance It Happens Again
Two federal tools are available at no cost after fraud: credit freezes and fraud alerts. A credit freeze blocks anyone, including you, from opening new credit accounts in your name and stays in place until you lift it. You would temporarily unfreeze your file when you actually need to apply for credit. A freeze is the stronger option if you’re worried about entirely new accounts being opened with your stolen information.11Consumer Advice – FTC. Credit Freezes and Fraud Alerts
A fraud alert is lighter. Instead of blocking access to your file, it tells lenders to verify your identity before granting new credit. An initial fraud alert lasts one year and can be renewed. If you filed an FTC Identity Theft Report or a police report, you can place an extended fraud alert that lasts seven years. You only need to contact one of the three major credit bureaus to place either type of alert; that bureau is required to notify the other two.12Office of the Law Revision Counsel. 15 U.S. Code 1681c-1 – Identity Theft Prevention; Fraud Alerts and Active Duty Alerts
Reviewing your statements every month, turning on transaction alerts in your issuer’s app, and keeping your card number off websites you rarely use won’t guarantee you’re never targeted again. But catching an unauthorized charge early is what keeps every one of the protections above at full strength.