If your credit card has been hacked, call the fraud number on the back of the card right away to shut the account down, then follow up in writing within 60 days to preserve your full protections under federal law. Your maximum legal liability for unauthorized charges is $50, and most major networks reduce that to zero through their own zero-liability policies. The faster you report, the less you owe and the less damage the thief can do.
Call Your Card Issuer First
Start with the phone. The fraud hotline on the back of your card, or inside your issuer’s mobile app, is usually staffed around the clock. Tell the representative which charges you did not make. They will cancel the compromised card number on the spot and mail a replacement with a new number and security code.
Ask for a confirmation or claim number before you hang up, and write down the name of the person you spoke with and the time of the call. You will want that reference if anything gets lost later. Once your issuer has been notified, you owe nothing for charges made after that notification.
Send Written Notice Within 60 Days
A phone call stops the bleeding. Written notice is what triggers the full set of legal protections under the Fair Credit Billing Act. You have 60 days from the date the statement containing the disputed charge was mailed to you to send that written notice.1Office of the Law Revision Counsel. 15 USC 1666 – Correction of Billing Errors Miss the window and your legal footing gets weaker.
Send it to the address your issuer designates for billing inquiries, which is not the same as the payment address. Include your name, account number, the dollar amount and date of each charge you are disputing, the merchant name as it appears on your statement, and a short explanation of why the charge is not yours. Keep a copy of everything. Many issuers also accept disputes through their app or website, and that is fine as an additional channel, but the written notice is what the statute contemplates.
What You Actually Owe
Federal law caps your liability for unauthorized credit card charges at $50, provided your issuer gave you a way to report fraud and a method existed to verify you as the authorized user.2Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card
In practice, even that $50 rarely comes out of your pocket. Visa, Mastercard, and most other networks voluntarily apply zero-liability policies to unauthorized transactions on their cards.3Visa. Visa Zero Liability Policy These policies may not cover certain commercial cards, anonymous prepaid cards, or situations where the issuer determines you were grossly negligent with your card. If you are unsure whether your specific card is covered, ask.
What the Issuer Must Do Next
Once your written dispute arrives, the issuer has to send a written acknowledgment within 30 days.1Office of the Law Revision Counsel. 15 USC 1666 – Correction of Billing Errors It then has two complete billing cycles, and no more than 90 days total, to investigate and either fix your account or explain why it believes the charge was valid.
While that investigation is open, the issuer cannot try to collect the disputed amount, cannot close or restrict your account over that unpaid balance, and cannot report the disputed amount as delinquent to the credit bureaus.4Office of the Law Revision Counsel. 15 U.S. Code 1666 – Correction of Billing Errors You do still have to pay the parts of your bill that are not in dispute, including any finance charges on those undisputed amounts.
Lock Down Your Online Account
Change the password on your card issuer’s website and app right away. Use a password you have not used anywhere else. Password reuse is how one breached login turns into several. Turn on multi-factor authentication so a login requires both your password and a one-time code from your phone or an authenticator app.
Then check the account for tampering. Look at the list of authorized devices and remove anything unfamiliar. Verify that the email address, phone number, and mailing address on file are still yours. Attackers who get in sometimes replace your contact information with theirs so they can intercept password-reset codes and keep coming back after you change the password.5Internet Crime Complaint Center (IC3). Account Takeover Fraud (ATO) Review any linked payment apps or third-party services and disconnect anything you do not recognize.
Deal With Recurring Charges
Getting a new card number does not necessarily stop the charges that were hitting your old one. Visa, Mastercard, American Express, and Discover all run updater services that quietly pass your new number along to merchants who have you set up for recurring billing. That is convenient for the streaming service you meant to keep. It also means a subscription you wanted to cancel, or one a scammer set up in your name, can follow you to the replacement card.
Go through your last few statements and note every recurring charge. For anything you want to stop, cancel it directly with the merchant. A new card number alone will not end a subscription.
Fraud Alert or Credit Freeze
If you think the hacker may have more than just your card number, put the credit bureaus on notice.
A fraud alert is the lighter option. It flags your file so lenders take extra steps to verify your identity before opening new credit in your name. You only need to contact one of the three major bureaus, and federal law requires that bureau to notify the other two.6Office of the Law Revision Counsel. 15 U.S. Code 1681c-1 – Identity Theft Prevention; Fraud Alerts and Active Duty Alerts It is free. An initial alert lasts one year. If you have filed an FTC identity theft report or a police report, you can request an extended alert that lasts seven years and also removes you from prescreened credit and insurance offer lists for five years.7FTC: Consumer Advice. Credit Freezes and Fraud Alerts
A credit freeze is stronger. With a freeze in place, no one, including you, can open new credit in your name until the freeze is lifted, because lenders cannot pull your report.7FTC: Consumer Advice. Credit Freezes and Fraud Alerts Placing and lifting a freeze is free by federal law.8Consumer Advice. Free Credit Freezes and Year-Long Fraud Alerts Are Here You have to contact each of the three bureaus separately. Each will give you a PIN or password to lift the freeze when you want to apply for credit yourself. Freezes do not expire, do not affect your credit score, and do not block existing creditors or debt collectors from seeing your file.
A freeze is especially worth the trouble if your Social Security number, date of birth, or address may have been exposed along with your card, because that combination is what lets a thief open entirely new accounts in your name.
When to File With the FTC or the Police
If the problem is bigger than a stray charge or two, file at IdentityTheft.gov. The FTC’s site walks you through what happened and produces an official Identity Theft Report along with a personalized recovery plan.9Federal Trade Commission. IdentityTheft.gov: Report Identity Theft and Get a Recovery Plan Creditors, bureaus, and law enforcement will accept that report as a legal record of the crime, and you need it if you want the seven-year extended fraud alert.6Office of the Law Revision Counsel. 15 U.S. Code 1681c-1 – Identity Theft Prevention; Fraud Alerts and Active Duty Alerts
A local police report is not always necessary. File one if you know who took your information, if your identity was used during an encounter with police, if you have specific evidence that would help investigators, or if a creditor requires a police report before cooperating with your fraud claim. A police report can also substitute for the FTC report when placing an extended fraud alert.
A Note If It Was Actually a Debit Card
The rules above apply to credit cards. If the compromised card was a debit card, the protections are weaker and the clock is tighter, because debit fraud falls under the Electronic Fund Transfer Act rather than the Fair Credit Billing Act. Report within two business days of learning about the theft and your liability is capped at $50.10Office of the Law Revision Counsel. 15 U.S. Code 1693g – Consumer Liability Report after that but within 60 days of your statement and it can climb to $500.11Consumer Financial Protection Bureau. Liability of Consumer for Unauthorized Transfers Wait longer than 60 days and you can be on the hook for the full amount of unauthorized transfers that happened after the window closed. And the money leaves your checking account first, so even a successful dispute can leave you short on cash while the bank investigates.
Watch Your Accounts for the Next Few Months
The weeks after a card hack are when follow-on fraud tends to appear, especially if your information was part of a larger data breach. Read your credit card and bank statements line by line for several months. Small test charges often come before larger ones.
You can pull your credit report from each of the three bureaus once a week for free at AnnualCreditReport.com, which the bureaus have made a permanent policy.12Consumer Advice – FTC. Free Credit Reports Watch for accounts or hard inquiries you do not recognize. Turn on real-time transaction alerts through your issuer’s app so you see every charge as it posts, not weeks later on a statement.