How Your Credit Card Information Is Stolen and What to Do About It

Photo to accompany story about how your credit card information gets stolen. Getty Images
We want to help you make more informed decisions. Some links on this page — clearly marked — may take you to a partner website and may result in us earning a referral commission. For more information, see How We Make Money.

Credit card fraud is the most frustrating crime you can’t see. 

According to the Federal Trade Commission, in 2019, the agency received more than 271,000 reports of people’s credit card information being misused or used to open new accounts.

It’s not a new crime, but it has dramatically changed over time. “Years ago, [credit card theft] was focused on stealing someone’s wallet. Things have evolved so much since then,” says Kimberly Sutherland, vice president of fraud and identity strategy at LexisNexis Risk Solutions. “Most of the time now, it’s being able to access info electronically through data breaches and direct attacks.”

In 2019, Capital One suffered a massive data breach — one of the world’s largest — that left over 100 million people vulnerable to identity theft. The company said “it immediately fixed the issue.

With cybercriminals becoming more sophisticated, it’s important to understand the types of fraud out there. We spoke to two cybersecurity and identity theft experts to walk you through how to protect yourself and what to do if your credit card (or debit card) information is stolen.

Ways Your Credit Card Information Can Be Stolen

Stolen Information

Stolen information is “when a fraudster has access to your credit card number and can make purchases,” Sutherland says. “Fraudsters are very keen. It may be an email or phone call or fake website. They will go for whatever process will be most effective for their target audience.”

Here are some examples:

Lost or stolen cards: A person physically possesses your credit card and uses it to make purchases.

Phishing: A fraudster uses a text message, phone call, or email to impersonate a legitimate person or institution to get you to hand over sensitive information.

Counterfeit: Credit card or other accounts opened using stolen information from real people. 

Credit card skimming: A device that steals credit or debit card information from card readers such as a gas pump or ATM. It’s not as common as it used to be, due to retailers moving away from the magnetic stripe toward the more secure chip cards, though it still occurs.

Public Wi-Fi networks: A shared internet connection means no privacy. Even if you’re on your own device or on a secure website, you could be vulnerable to hackers if you reveal your credit card or bank information while on a public network.

Spyware and malware: Spyware is a type of malware (malicious software) that collects your personal information in the background of your computer. It silently records your browser history and keystrokes for cybercriminals, allowing them to impersonate you or sell your data.

Data breaches: When a company you’ve entrusted with your confidential information is hacked, your credit card info is vulnerable to fraudsters to collect and misuse.

Familial fraud: Familial fraud occurs when a family member, friend, or someone you know has used your card or opened an account in your name without authorization, says Sutherland. This is one of the more difficult forms of fraud to contend with, as it involves a person you know stealing your identity. It is still possible, though, to clear your name and not be held liable for charges you didn’t make.

How to Check If Your Credit Card Information Has Been Stolen

Credit Reports

Because of the COVID-19 pandemic, the three major U.S. credit bureaus (Equifax, Experian, TransUnion) offer free weekly credit reports to everyone using through April 2020. (Under normal circumstances, the credit reports are free through the three credit bureaus every 12 months.) We recommend checking your credit reports regularly to ensure no fraudulent activity is occurring. Any inaccurate or fraudulent item on your credit report can hurt  your credit score and make it challenging to get credit or apply for an apartment. You can dispute fraudulent activity on your report using these NextAdvisor tools.  

Credit and Identity Theft Monitoring Services

There is no shortage of companies wanting your business to help protect your name. Credit monitoring services review your credit reports, update you on your credit score, and even scan the dark web for your information. You can take advantage of free or paid credit monitoring services through your bank, one of the three credit bureaus, or companies like Identity Guard, LifeLock, and FICO. 

Keep in mind, though, paying for a service like this won’t actually prevent fraud, says Steve Weisman, author of “The Truth About Avoiding Scams” and law professor at Bentley University. It just lets you know quicker than if you were manually checking your credit card statements or reports. 

What to Do If Your Information Is Stolen

Notify Your Credit Card Company ASAP

If you find your information has been compromised (e.g., a fraudulent charge pops up, a person you don’t know is added as a signor), your first step is to notify your credit card company.  From there, your card will be frozen, and a new card will be sent to you, preventing any further fraudulent purchases from occurring. 

File a Police Report

Next, you can escalate by filing a report with your local police department. Credit card fraud is a form of identity theft, so it is a crime like any other. It’s likely they won’t catch the thief, says Weisman. But “the report helps to put it on record in case someone says you tried to buy something,” Weisman says.

Am I Responsible for Fraudulent Charges?

Most of the time, no. It’s important to report fraudulent charges to your credit card company as soon as possible to limit your own liability. Once you report your credit card lost or stolen, then you won’t be legally responsible for any unauthorized charges that happen after, according to federal law. However, if unauthorized charges happen before you report the loss to your credit card company, then you could be responsible for those charges — but only up to $50, 

The law is different for lost debit and ATM cards. If you report a missing card before unauthorized charges occur, you won’t be liable for them. But if you report unauthorized charges within two business days of a charge, you could be liable for up to $50. If you report it between three business days and 60 calendar days after the relevant bank statement, the maximum liability increases to $500. After that point, you may not be able to recover any of the money spent or withdrawn from your account. If unauthorized charges are made with your debit card number (but the actual card isn’t missing), you’re not liable if you report them within 60 calendar days of the bank statement.

How to Protect Yourself

Remove Credit Card Information From E-commerce Sites

“You’re at the mercy of [businesses] who have your personal info and have the weakest security,” Weisman says. “Every company is susceptible to being hacked.”

You can get around this by not saving your credit card information to any non-essential sites or retailers. Keeping your account number with, say, Amazon or Target leaves you more vulnerable to big data breaches, so it’s best to be picky about who you share info with.

Avoid Using Your Debit Card For Purchases

The same information about protecting your credit card information applies doubly so for debit cards. In fact, banks offer less protection than a credit card company if a fraudster gets a hold of your information, says Weisman. With a debit card, you can lose all your savings with one stolen card since it’s connected to your checking account. Those savings are recoverable, but you would have to jump through far more hoops than with a credit card. 

Protect Your Private Information 

Take precautions around your private information, because once it’s been stolen and disseminated, it can be difficult to track down. The Federal Trade Commission offers valuable resources on this topic. 

The key things to remember are:

  • Don’t provide your account number over the phone unless you’re sure they’re reputable.
  • Don’t write your credit card info down and leave it places.
  • Keep a watchful eye when you’re using your card.
  • Save your receipts in case you find something off on your card statement. 

Review Your Statement Regularly 

We recommend checking your credit card statement at least once a week to make sure no unusual charges crop up. You have a right to contest any charge from a retailer that does not seem accurate or did not originate from you. The best time to catch a fraudulent transaction is before pay off your card’s balance. Otherwise, you could have a difficult time contesting a charge with your provider.