What is credit card fraud? Who pays, and how long you have

What the pages mean by credit card fraud

The OCC’s page, Credit Card and Debit Card Fraud, describes it as the unauthorized use of a person’s credit card or debit card to make purchases or withdrawals, and says it can happen through physical theft of the card, by stealing card information online, or through skimming devices. Cornell’s Legal Information Institute, in a Wex entry reviewed in July 2022, calls it a form of identity theft that involves an unauthorized taking of another person’s credit card information, for the purpose of charging purchases to the account or removing funds from it. Regulation Z, the federal rule on credit cards, defines unauthorized use as use by a person who has no actual, implied or apparent authority and from whom the cardholder receives no benefit.

Cornell sorts credit card fraud schemes into two categories. Application fraud is the opening of credit card accounts in another person’s name. Cornell says the victim is not responsible for the fraudulent debt, but may not learn about it until it has damaged the victim’s credit score or until debt payments have already been made. Account takeover is the hijacking of an existing account: Cornell’s example is a person who learns enough about the victim to change the account’s billing address, then reports the card lost or stolen to obtain a new card and make purchases with it. Cornell adds skimming, where a business’s employees illicitly access customers’ card information.

Experian, which says the FTC distinguishes two types of credit card fraud complaint, uses almost the same split: new accounts and existing accounts. Reporting the FTC’s figures, Experian says new account fraud made up 89% of the credit card fraud complaints for 2023, down from 91% in 2022, and existing account fraud 11%, up from 9%. We did not read the FTC’s own count, so those percentages are Experian’s report of it. Experian lists six ways the fraud happens: theft of the physical card, skimmed card information, cloned cards, card-not-present transactions, data breaches, and phishing, smishing or vishing. The OCC’s list has five methods, set out below.

The signs the pages list

The OCC lists four warning signs: unfamiliar card transactions on your bank or credit card statements; small authorizations or transactions used to test an account before much larger activity; a notice from your bank about unauthorized account activity; and calls from your bank about transactions you did not make. Experian describes the same test pattern, saying identity thieves sometimes run test transactions involving very small sums to confirm access to an account.

The CFPB page on watching accounts when card data is hacked, last modified on 17 June 2025, tells you to look for unfamiliar merchant names, especially from merchants outside your area, even when the amounts are small. It says thieves sometimes process a small debit or charge and return to take more if it goes through, and that fraudulent charges or debits might occur months after the theft of your information. It advises opening paper statements and checking them closely, even if you are not sure your information was compromised.

New-account fraud shows up somewhere else. Cornell notes that applying for a credit card requires a credit check, so requesting your annual credit report from one of the three credit bureaus can help a victim of application fraud detect it early. Experian says you can get your credit reports free once each week at AnnualCreditReport.com, and to look for new accounts you do not recognize and for unfamiliar hard inquiries. It also says a letter or call seeking payment of a bill that does not belong to you should not be ignored, because it could indicate that a criminal opened an account in your name. The two pages give different rhythms for the reports: Cornell speaks of regularly requesting your annual credit report, Experian of getting your reports free once each week.

Who pays on a credit card

The CFPB’s Ask CFPB answer, last reviewed on 15 April 2024, gives three cases. If you report a lost or stolen credit card before it is used, you cannot be held responsible for unauthorized charges. If the card is used before you report it missing, the most you will owe is $50, and the page adds that many cardholder agreements say you are not responsible for any charges in that situation. If you have not lost the card but someone steals and uses your account number, the page says you generally have no liability. The CFPB’s page on watching accounts puts the number-only case more firmly, saying you are not responsible if someone stole only your credit card account number. The FTC, in a page dated May 2022, says federal law limits your responsibility for unauthorized charges to $50, and Cornell cites 15 U.S.C. 1643 for the same limit.

The rule underneath is 12 CFR 1026.12(b), Regulation Z, as the CFPB publishes it. It sets the cardholder’s liability at no more than the lesser of $50 or the amount of money, property, labor or services obtained by the unauthorized use before notification to the card issuer. The rule’s comments add several points. Unauthorized use includes a transaction by a person who obtained the card through fraud or robbery. If you hand your card to a family member or coworker who then exceeds the authority you gave, you are liable unless you had told the creditor that person’s use was no longer authorized. The limit applies to transactions that use the credit card, not to checks that access a credit card account, though the billing error provisions of 12 CFR 1026.13 apply to both.

On a number used without the card, the comments give an example: when merchandise is ordered by telephone or the Internet by a person without authority, using the account number alone or with the expiration date and the three- or four-digit code printed on the card, liability may not be imposed on the cardholder. The rule lets an issuer impose liability only if the card is an accepted card, the issuer gave adequate notice of the maximum liability and of how to report a loss, and the issuer provided a way to identify the cardholder. An issuer that chooses to impose no liability does not have to meet those conditions. Notification can be given in person, by telephone or in writing, and the comments say it need not be started by the cardholder.

If an issuer does want to impose liability, the comments require a reasonable investigation. The issuer may ask for your cooperation, a written and signed statement, documents or a copy of a police report, but it may not automatically deny a claim only because you refused a request such as an affidavit or a police report. It may not require an affidavit or a signed statement under penalty of perjury as part of the investigation. Cornell, whose entry is from 2022, says that “most banks will waive this amount if the cardholder signs an affidavit explaining the theft”; Regulation Z, for its part, says an issuer may not require an affidavit or signed statement under penalty of perjury as part of its investigation, and the pages we read do not say how the two fit together. One of the pages we read, Experian’s, ties the $50 limit to reporting the theft within 60 days. The CFPB answer and the section of Regulation Z we read state no 60-day condition on the $50 limit, and the comments say the liability protections do not depend on following the written error-resolution procedure. Experian also says zero liability protection is a feature of many (but not all) credit cards.

Who pays on a debit card

For debit cards the rule is Regulation E, 12 CFR 1005.6, and it works in tiers. Its comments say a consumer may be liable for up to $50, up to $500, or an unlimited amount, depending on when the unauthorized transfer occurs, and that more than one tier can apply to the same situation. If you notify the bank within two business days after learning of the loss or theft of the card, your liability is the lesser of $50 or the unauthorized transfers made before notice. The two days do not include the day you learn of the loss or any day that is not a business day, and they are counted as two 24-hour periods whatever the bank’s business hours. The regulation’s own example: a card lost on Monday, learned of on Wednesday, must be reported by midnight Friday.

After two business days the ceiling is $500. The regulation sets it at the lesser of $500 or the sum of $50 (or the lesser amount taken in the first two days) and the later transfers made before notice, provided the bank establishes that they would not have occurred had you notified it in time. The regulation’s worked example has a card stolen on Monday and reported on Friday by a consumer who learned of the theft on Monday. With $100 taken on Tuesday and $600 on Thursday, the total liability is $500, which is $50 of the first transfer and $450 of the second. With $600 on Tuesday and $100 on Thursday, it is $150.

The third tier is tied to your statement. An unauthorized transfer that appears on a periodic statement has to be reported within 60 days of the bank’s sending the statement. If not, liability can extend to transfers after the 60 days that the bank shows would not have happened with a timely report, and the comments call this unlimited liability. For transfers made without the card, the first two tiers do not apply. The comments’ example is a $200 transfer reported within 60 days, which leaves no liability, and a further $400 on the 61st day that is reported on the 62nd day, for which the consumer may be liable.

Three more points come from the same section. Negligence cannot be the basis for greater liability, and the comments give writing the PIN on a debit card as an example that does not change the amount. No agreement between the consumer and the institution can impose more than the limits in Regulation E, and the extent of liability is determined solely by how promptly the loss or theft is reported. If a delay was due to extenuating circumstances, such as extended travel or hospitalization, the institution has to extend the time limits to a reasonable period. The CFPB page on watching accounts gives a shorter version, with two business days to limit liability to $50 for a lost or stolen card and 60 days after the statement is available for a transaction that appears on a statement without the card being missing. It also says that for the protections to apply you need to register your card, and that this includes payroll, benefits and prepaid cards. The pages we read do not explain what registering involves.

The written dispute, and the clocks that are not the same

The FTC’s page, Using Credit Cards and Disputing Charges (May 2022), says the Fair Credit Billing Act sets a dispute process for credit cards and revolving charge accounts, not for personal loans or loans to buy cars or major appliances. Unauthorized charges can be disputed through it, and the FTC adds that they might be a sign of identity theft and points to IdentityTheft.gov. To use the process, write to the issuer at the address given for billing inquiries and not the address for payments, with your name, address, account number and a description of the mistake. The letter has to reach the issuer within 60 days after the first bill with the error was sent. The FTC says certified mail with a return receipt gives you proof, and that you should send copies and not originals, and keep a copy of the letter.

The issuer then has two deadlines. It must acknowledge the complaint in writing within 30 days of getting it, unless the problem has been resolved, and must resolve the dispute within 90 days. While it investigates you can withhold payment on the disputed amount and related finance charges, but you are expected to pay the part of the bill that is not in question. The FTC lists what the issuer cannot do in the meantime: take legal action to collect the disputed amount, close or restrict your account (though it can apply the amount against your credit limit), threaten your credit rating or report you as delinquent, or require you to pay your full balance at once. An issuer that does not follow the procedure forfeits up to $50 of what it could otherwise collect; the FTC’s example is an acknowledgment sent in 45 days, which is 15 days late.

If the issuer decides the bill is correct, the FTC says it must tell you promptly and in writing how much you owe and why. You can appeal within the time period the issuer gives you for payment or within 10 days of getting the explanation, whichever is later, and you can file a complaint with the CFPB. The FTC notes that at that point the issuer can begin collection, and that if it reports you as delinquent the report must say you still dispute the billing error. The CFPB page on watching accounts describes the investigation times in its own terms: generally within 10 business days of an error notice for debit card disputes and within two billing cycles for credit card disputes, with debit card companies having 45 days, and sometimes 90 days, as long as they provisionally credit the disputed amount first. That page, not the regulation, is where we read the debit timings; we did not read 12 CFR 1005.11.

The two 60-day periods in these pages are separate. For a credit card, 60 days is how long the written dispute letter has to arrive after the first bill with the error. For a debit card, 60 days is how long after the bank sends a statement you have to report an unauthorized transfer on it before liability for later transfers can grow. The credit card $50 limit in Regulation Z is a third matter, tied to when the issuer is notified, which the regulation allows to be done by telephone.

What the pages say to do first, and what they leave out

The OCC’s page puts the card issuer first: call the customer service number on the back of the card or on the bank’s website, or report through online banking or the bank’s app, and ask for the card to be blocked or replaced. It also suggests considering a new account. The CFPB says to call the card provider’s toll-free number right away and ask how to follow up in writing, to keep copies of your letters and to write down the dates of follow-up calls. It says to cancel the card and have it replaced before more transactions come through, to consider changing a debit card PIN, and, if the replacement has a new number, to update any automatic payments linked to the card.

The OCC then lists four more places. A fraud alert on your credit reports, placed by contacting one of the three major credit bureaus, which will inform the other two; the OCC says an alert lasts one year and can be extended. The Internet Crime Complaint Center, a division of the FBI, which the OCC calls especially useful for internet-related crimes. The FTC, at IdentityTheft.gov, to report the theft and create a recovery plan. The U.S. Postal Inspection Service for mail-related scams. The OCC also says to report to local law enforcement and to obtain a copy of the report to give to your financial institutions and credit bureaus. The page prints telephone numbers for the bureaus and agencies; we did not copy them, so use the number on your card or the agency’s own site. Experian’s list adds the card lock feature that many credit cards offer, a fraud alert, security freeze or credit lock, and credit monitoring, and its page promotes its own free monitoring service.

Our identity theft page sets out the order of operations when somebody is using your details, and our page on identity theft protection services looks at what the paid subscriptions do and which parts you can do yourself for nothing. Experian lists data breaches among the ways card fraud happens, and our data breach page covers what to do when a company says your details have leaked.

One more FTC page is worth a date. Credit Card Loss Protection, dated October 2000, warns about telephone callers who sell credit card loss protection insurance, some of whom say that the $50 law has changed and that you are liable for all unauthorized charges. The FTC calls the offers worthless and says that if you did not authorize a charge, you should not pay it and should follow your issuer’s procedures for disputing it. The $50 limit it states matches the 2022 FTC page.

The OCC’s prevention list is short: set up alerts on all transactions and review statements often, check that a shopping site is secure and avoid saving payment information on websites, cover the keypad when you enter a PIN, check whether any part of a terminal is loose, keep card details to yourself, and use long, different passwords with two-factor authentication where possible. The pages we read do not say what amount makes a charge fraud or how fraud is proven in court. The OCC page does not say who carries the loss. The pages we read do not say how long a replacement card takes, and they do not count how many cards carry zero liability beyond Experian’s “many (but not all)”. Business cards and payment apps get little more than the CFPB’s notes above. We tested nothing on a card.