What to Do Immediately After Your Credit Card Is Stolen or Used Fraudulently

Fact-checked by the The Credit Scout editorial team

Learning what to do after credit card stolen fraudulent charges hit your account starts with speed and a phone call. In 2024, 17% of U.S. adults reported experiencing credit card fraud, according to Federal Reserve data. That’s nearly one in six consumers, and it means the process of shutting down fraud and recovering your money has been tested millions of times.

You don’t need to be a financial expert to lock down your accounts and get reimbursed. This guide walks you through the exact sequence: what to say when you call the issuer, how to keep subscriptions and digital wallets from leaking your replacement card, and when a credit freeze beats a fraud alert. By the time you finish, you’ll know the steps that limit damage, protect your credit, and satisfy every requirement the Fair Credit Billing Act puts on consumers.

How Do I Know If My Credit Card Was Stolen or Just Misplaced?

Check for unauthorized charges first. If you see a transaction you didn’t make, even a $1 test charge from a merchant you don’t recognize, assume it’s fraud. The plastic being absent from your wallet is only one signal; number-only theft is far more common. Card-not-present fraud dwarfs physical theft, and the Federal Reserve estimates that $84 billion in non-credit-card fraud flowed through U.S. households in 2024, much of it tied to compromised account numbers.

If your physical card is still in your possession but your statement shows strange activity, your number was skimmed, leaked in a data breach, or captured through a phishing scheme. Treat it exactly the same as a stolen card. Don’t wait for the physical plastic to vanish before you act.

Check for “Test” Transactions

Fraudsters often run a small pending charge, sometimes under $2, to verify the card works before the real spending begins. Scan your transaction history for tiny, unfamiliar amounts. If you see one, call your issuer immediately. These small charges are a smoke signal; the actual blaze follows within hours.

Lock the Card, Then Call

Major issuers like Chase, Capital One, and Citi let you lock a card instantly through their mobile apps. Freezing the plastic via the app takes seconds and stops any new authorization before you even pick up the phone. That’s your first lever. Then dial the number on the back of your statement, or use the issuer’s in-app fraud tool, to begin the formal dispute.

What to Say When You Report a Stolen Credit Card

Tell the issuer three things: the card was compromised, the exact charges you dispute, and that you want a new account number, not just a replacement card. Requesting a fresh account number severs the tie between the old account and any stored payment profiles the fraudster may have captured. This is a critical step that separates a full cleanup from a partial fix.

Federal law and card-network policy both work in your favor here. The Fair Credit Billing Act caps your responsibility at $50, and all four major U.S. card networks, Visa, Mastercard, American Express, and Discover, maintain zero-liability guarantees. According to the FTC’s consumer guidance on lost or stolen cards, if you report before any unauthorized charge posts, your liability is $0. Even if you delay, the maximum exposure is $50, and most issuers waive that as a routine customer-service practice.

During the call, confirm the card is blocked and ask for a timeline. Most major banks ship a new card with a new number within 3–5 business days, and many credit accounts for fraudulent charges by the next business day after you file a formal dispute. Get a case or reference number. That number becomes your paper trail.

How to Lock Down Digital Wallets and Recurring Payments

Your stolen card leaves ghost fingerprints across every service you’ve linked it to. Auto-pay bills, subscription boxes, ride-share apps, and digital wallets all retain the old card credentials. If you only replace the plastic without auditing these connections, bills bounce, late fees pile up, and the new card may still be exposed if the fraudster accessed your online account.

Remove the compromised card from Apple Pay, Google Pay, Samsung Pay, and PayPal immediately. Then log into every merchant where you store the card on file, Netflix, Amazon, utilities, insurance portals, and either delete the saved payment method or replace it with the new number once it arrives. This step echoes what experts call the full account-scrub tactic after identity theft, because a single missed subscription can trigger a collections account that harms your credit.

Update Non-Obvious Payment Profiles

Look beyond streaming services. Gym memberships, cloud storage, children’s app stores, toll-tag accounts, and even charitable recurring donations often store card details. One overlooked payment failure can generate a 30-day delinquency on your credit report if the merchant reports it. If you’re unsure where your card lives, scan your last three monthly statements and create a checklist of every recurring charge.

Fraud Alert vs. Credit Freeze: Which One Blocks More Damage?

A fraud alert flags your file for 90 days and tells creditors to take extra verification steps; a credit freeze locks your report until you specifically lift it. A freeze is stronger. It blocks access entirely, making it impossible for anyone, including you, to open new credit without first thawing the report.

If your card was stolen but you’re not seeing signs of broader identity theft, a fraud alert might be enough. But if you’ve lost your wallet, a data breach exposed your Social Security number, or the fraud extends beyond a single card, a freeze is the right move. As the FTC explains, freezes and alerts are both free, and contacting one bureau, Equifax, Experian, or TransUnion, automatically notifies the other two for fraud alerts. For freezes, you must contact each bureau individually.

You’ll also want to pull your credit reports. Everyone is entitled to free weekly reports from all three bureaus via AnnualCreditReport.com. After you place an alert or freeze, monitor for hard inquiries and new accounts you didn’t authorize, those are the first signs that the fraud went beyond your credit card. The CFPB collects 523,659 credit-reporting complaints in a single month alone, many of them about accounts opened with stolen identities, so checking weekly for a few months is not overkill.

Why You Must Follow Up in Writing, and How to Do It

Phone calls stop the bleeding, but only a written dispute triggers your full legal protections under the Fair Credit Billing Act. Send a letter to your card issuer’s billing inquiries address, not the payment address, within 60 days of the statement date that first showed the fraudulent charge. The letter must list your name, account number, each disputed transaction with date and amount, and a clear statement that you did not authorize the charges.

The reasoning is practical: verbal disputes close out in a bank’s system, but a certified letter creates a timestamped, trackable record. If the issuer later claims you missed a deadline, your certified mail receipt becomes incontrovertible proof. It’s a small administrative cost that protects you against the kind of he-said-she-said that kills disputes.

Create a Fraud File

Keep a simple folder, digital or paper, with the date and time of every call, the representative’s name, the case number, the written dispute letter, and a screenshot of the confirmation that your issuer received it. If the fraud escalates into an identity-theft situation that requires an IdentityTheft.gov recovery plan, this file becomes the backbone of your documentation. You’re building evidence that’s accepted by law enforcement, creditors, and the credit bureaus.

Even if you don’t file a police report now, having a clean log will make that step trivial later. Some issuers require a police report for large fraud rings or international charges that the bank’s algorithms flag as “customer dispute”, meaning they suspect you made the purchase. Documenting every interaction turns your word into a verifiable sequence.

What Happens to Your Money and Credit Score After Fraud

Most major U.S. issuers credit disputed amounts to your account by the end of the next business day. By law, they must investigate and resolve the dispute within two billing cycles, but in practice, provisional credits land fast. You won’t be out the cash for long. The exact timeline depends on whether the charge was presented as a “card present” transaction, which is harder to dispute without a police report, but for unauthorized online purchases, the process is straightforward.

Credit score impact is typically minimal if you catch the fraud early. The account closure and reissuance of a new number can temporarily affect your average age of accounts, shaving a few points off your score. But the bigger danger is an unrecognized missed payment on a subscription tied to the old number. That’s why the account audit in the linked-payments step matters so much. If you want a deeper look at how credit scoring models treat closed accounts, understanding which credit-building mistakes drag scores down helps you avoid self-inflicted damage while you recover.

When to Escalate with a Police Report or FTC Filing

File a police report if your issuer requires it, if the fraud involved a large dollar amount, say over $5,000, or if the thief used your identity to open accounts beyond the credit card. Otherwise, an Identity Theft Report from IdentityTheft.gov usually suffices. That report generates a personalized recovery plan and serves as an official document recognized by creditors and the FTC.

Let’s do the arithmetic: if a fraudster racks up $3,000 in charges, you get provisional credit of $3,000 within one business day, and the final credit typically posts within 30 days. That’s $3,000 back in your pocket before your next statement cycle closes. Meanwhile, you’ve spent maybe two hours on the phone and in paperwork, a return on time measured in thousands of dollars per hour. The system works if you work it in the right order.

Frequently Asked Questions

What should I do first if my credit card is stolen?

Lock the card through your issuer’s mobile app, then call the bank immediately to report the theft. Request a new account number, not just a replacement card, and follow up in writing within 60 days of the statement showing fraud.

Do I have to pay for fraudulent credit card charges?

No. Under federal law, your maximum liability is $50, but every major card network enforces a zero-liability policy. You won’t pay a cent for unauthorized charges reported promptly.

How long does it take to get money back after credit card fraud?

Most issuers credit the disputed amount by the next business day. Formal investigation must finish within two billing cycles, but provisional credits appear almost instantly once you file a written dispute.

Should I place a fraud alert or a credit freeze after a stolen card?

A credit freeze is stronger. It locks your credit report until you lift it. Use a 90-day fraud alert if the fraud is limited to a single card; switch to a freeze if your wallet was lost or your Social Security number was exposed.

Do I need to file a police report for credit card fraud?

Not always. File one if your issuer demands it, the fraud exceeds a few thousand dollars, or identity theft created new accounts. Otherwise, an Identity Theft Report from IdentityTheft.gov typically meets all documentation needs.

Can fraud on my credit card hurt my credit score?

It can dip a few points if the closed account reduces your average credit age, but the larger risk is a missed payment on a subscription tied to the old card. Audit all linked accounts to prevent that damage.

What if I only see a small test charge from an unknown merchant?

Treat it as fraud. Small charges are often criminals testing the card before making large purchases. Call your issuer, lock the card, and get a new account number immediately.