When you report credit card fraud, your issuer cancels the compromised card, sends a replacement, and opens an investigation into the charges you flagged. In most cases the disputed amounts come off your statement while the review runs, and federal law caps what you can be made to pay at $50, with network policies from Visa, Mastercard, American Express, and Discover reducing that to $0 for most cardholders.1Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card2Mastercard. Mastercard Zero Liability Protection Policy The catch is a hard 60-day deadline for putting your dispute in writing. Miss it and you can lose the legal protections that force the issuer to investigate and remove the charges.
What the Issuer Does When You Call
Call the fraud number on the back of your physical card or in the issuer’s official app. Don’t rely on a number from a search engine, which can lead to a phishing operation. Walk through every suspicious transaction by date, amount, and merchant name as it appears on your statement. The issuer will close the compromised card number immediately and mail you a replacement with a new number.
The phone call is the right first step because it stops further charges from posting to the old number. It is not, on its own, enough to trigger your full legal protections. Those attach when you send written notice, which is covered below.
After the call, look back through your recent transaction history, including pending charges. Fraud often starts with a small test charge before larger ones follow. Flag anything you don’t recognize, even trivial amounts.
What You Actually Owe
Federal law limits your liability for unauthorized credit card charges to $50, no matter how much a thief spent.1Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card The cap applies as long as you accepted the card (you applied for and received it) and the issuer gave you a way to report unauthorized use, which every issuer does by printing a phone number on the card.
The $50 figure rarely comes into play. Visa, Mastercard, American Express, and Discover all run voluntary zero-liability policies that eliminate cardholder responsibility for unauthorized purchases entirely, provided you used reasonable care with the card and reported the fraud promptly.2Mastercard. Mastercard Zero Liability Protection Policy If your card was lost through no fault of your own and you called as soon as you noticed, expect to owe nothing out of pocket.
Business cards are a partial exception. The $50 federal cap does extend to business cards under the Truth in Lending Act, but the broader consumer protections in the Credit CARD Act don’t always apply, and network zero-liability policies typically exclude commercial cards.3HelpWithMyBank.gov. Does the Truth in Lending Act Apply to Credit Cards Issued for Business Purposes? If you carry a business card, read the fraud terms in your cardholder agreement.
The 60-Day Written Notice Requirement
Under the Fair Credit Billing Act, you have 60 days from the date the issuer sent the statement containing the unauthorized charges to notify the issuer in writing.4Office of the Law Revision Counsel. 15 USC 1666 – Correction of Billing Errors This is the single most consequential deadline in the process. Blow past it and the issuer is no longer legally required to investigate or remove the charges.
The notice has to be written, not verbal. Send it to the billing inquiries address on your statement, which is not the same as the payment address. Include your name, account number, the specific charges you’re disputing, and why they’re unauthorized. Most issuers accept an online dispute form or secure message as written notice, but a certified-mail letter gives you a paper trail with a delivery date. Treat the phone call and the written notice as two separate obligations: the call shuts the card down, and the letter preserves your legal rights.
How the Investigation Works
Once the issuer receives your written dispute, two clocks start. The issuer must acknowledge your notice in writing within 30 days, and it must either correct the error or send you a written explanation of why it believes the charges are valid within two complete billing cycles, capped at 90 days.4Office of the Law Revision Counsel. 15 USC 1666 – Correction of Billing Errors
While the review is pending, the issuer cannot try to collect the disputed amount, report it as delinquent, or charge interest on it. Most issuers go further and pull the charges off your statement entirely during the investigation. That removal isn’t required by the Fair Credit Billing Act, but it’s standard practice. The issuer uses this window to pull transaction data, contact the merchant’s bank, and look at evidence like IP addresses, shipping addresses, or in-store surveillance.
If the investigation confirms the charges were unauthorized, the removal becomes permanent. If the issuer finds the charges were legitimate, which sometimes happens when a family member used the card without permission or the situation is really a merchant dispute rather than fraud, the charges return to your account along with any accrued interest.
What You Still Need to Handle
Update Your Recurring Payments
Canceling a card breaks every subscription and recurring bill tied to the old number. The major networks run automated account-updating services that push new card details to participating merchants, but those systems don’t cover every merchant and can take days to propagate.5Visa. Visa Account Updater for Merchants Go through your recurring charges yourself: utilities, streaming, insurance premiums, gym memberships. A missed insurance payment can cost you far more than a late fee.
Secure Related Accounts
If the card’s online account shared a password with any other financial account, change those passwords now and turn on two-factor authentication where you can. The fraud on the card may be a symptom of a broader data breach, and reused passwords are the easiest way for a thief to move from one account to another.
If the Issuer Denies Your Dispute
A denial isn’t the end. You can request copies of the documents the issuer used to conclude the charges were valid.6Consumer Advice. Using Credit Cards and Disputing Charges Read them carefully. The evidence is sometimes thin, or it applies to a different transaction than the one you disputed.
To appeal, write to the issuer within the payment period it gives you or 10 days after receiving the explanation, whichever is later, stating that you still dispute the charge and refuse to pay.6Consumer Advice. Using Credit Cards and Disputing Charges The issuer can begin collection at that point, but it must report the amount to the credit bureaus as disputed rather than simply delinquent. If you believe the issuer violated the Fair Credit Billing Act’s procedures during the investigation, you can file a complaint with the Consumer Financial Protection Bureau.
When Fraud Goes Beyond One Card
A single compromised card sometimes signals something bigger. Once the immediate fraud is handled, check whether someone has used your personal information to open new accounts or change existing ones.
Check Your Credit Reports
You can pull your report from Equifax, Experian, and TransUnion once a week for free at AnnualCreditReport.com. The three bureaus have made this weekly access permanent.7Federal Trade Commission. Free Credit Reports Look for accounts you didn’t open, addresses you don’t recognize, and hard inquiries you didn’t authorize. Any of these suggests the fraud extends past your one card.
Place a Fraud Alert or Freeze
An initial fraud alert stays on your credit file for one year and requires lenders to take extra steps to verify your identity before approving new credit.8Office of the Law Revision Counsel. 15 USC 1681c-1 – Identity Theft Prevention; Fraud Alerts You only need to contact one bureau; it’s required to notify the other two. Alerts are fast to place and create a speed bump for anyone trying to open accounts in your name.
A credit freeze is stronger. It blocks access to your credit file entirely, so no one can open a new account until you lift it. Freezes are free by federal law, and you can lift them temporarily when you need to apply for credit yourself.9Federal Trade Commission. New Federal Law Allows Consumers to Place Free Credit Freezes and Yearlong Fraud Alerts Unlike an alert, you have to contact each bureau separately to place and lift a freeze.
If you’ve confirmed actual identity theft rather than a single card compromise, you’re eligible for an extended fraud alert lasting seven years, which requires an FTC Identity Theft Report or a police report.10Consumer Advice. Credit Freezes and Fraud Alerts
File an FTC Identity Theft Report
If the fraud has gone beyond one card, meaning new accounts in your name, unfamiliar debts on your credit report, or collection calls for accounts you never had, file at IdentityTheft.gov. The FTC’s report carries specific legal weight under the Fair Credit Reporting Act.11Federal Trade Commission. Steps for Identity Theft With that report you can permanently block fraudulent accounts from your credit reports, stop creditors from continuing to collect debts that resulted from the theft, and qualify for the seven-year extended alert.12Federal Trade Commission. FTC Memo to Law Enforcement on Identity Theft Reports If you create an account on the site, the FTC generates a personalized recovery plan with pre-filled letters you can send to creditors, collectors, and the bureaus.
File a Police Report if It Applies
You don’t need a police report for a straightforward card dispute. It becomes useful when the fraud is large enough that the issuer asks for one, when you’re dealing with identity theft across multiple accounts, or when you need official documentation for an extended fraud alert or insurance claim.11Federal Trade Commission. Steps for Identity Theft File with your local department and bring your FTC Identity Theft Report, a government-issued photo ID, proof of your address, and copies of the fraudulent transactions and any correspondence with your issuer. Ask for a copy of the report before you leave; some creditors and bureaus will ask for the report number.
Debit Cards Are Not the Same
Everything above applies to credit cards. Debit card fraud sits under a different federal law, the Electronic Fund Transfer Act, with far less favorable terms. Your maximum liability depends on how fast you report: up to $50 if you notify the bank within two business days of learning about the loss or theft, up to $500 if you report after that but within 60 days of your statement, and potentially the entire stolen amount with no cap if you wait longer than 60 days.13Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability Debit disputes also work through a provisional-credit process under Regulation E rather than the credit-card investigation rules.14Consumer Financial Protection Bureau. Regulation E 1005.11 – Procedures for Resolving Errors If a compromised card in your wallet is a debit card, don’t assume any of the credit card timelines or protections carry over.