What payment fraud is and how to spot it

Payment fraud happens when someone uses your payment information — your card number, bank account details, or login credentials — without your permission to move money or make purchases. It can occur online, over the phone, in person at a store, or through a compromised ATM. The fraudster's goal is to take money from your account or use your credit in your name.

Fraud looks different depending on how it happens. If someone steals your debit card and uses it at a gas station, that's card-present fraud. If they use your card number to buy something online without having the physical card, that's card-not-present fraud. If they hack into your online banking login and transfer money directly from your account, that's account takeover. Each type leaves different traces and requires different steps to stop.

You might notice fraud when you see a charge you don't recognize on your statement, when a payment you made doesn't go through but money leaves your account anyway, or when a company tells you they received a payment from you that you never sent. Sometimes you won't notice until a creditor calls about a bill you never opened, or until you try to log into your account and can't because the password has changed.

Key Takeaways

  • Fraud happens when someone uses your payment information without permission, and it can occur online, by phone, in person, or through a compromised ATM.
  • Check your statements regularly — at least weekly for debit accounts and monthly for credit cards — because catching fraud early limits your liability.
  • Contact your bank or card issuer when ready if you spot an unauthorized charge; federal law limits your liability if you report within 60 days.
  • Debit card fraud can drain your account when ready, while credit card fraud is usually easier to dispute because the card issuer absorbs the loss.
  • Prevent fraud by using strong passwords, enabling two-factor authentication, not sharing your card details over email or phone, and monitoring your credit report.

How fraud affects debit cards versus credit cards

The type of card matters because the rules and your protection are different. With a debit card, the money comes directly from your bank account. If a fraudster uses your debit card number, the money is gone when ready. You have to dispute the charge and wait for your bank to investigate and return the funds — a process that can take weeks. During that time, you may not have access to that money, and if your account goes negative, you could face overdraft fees.

With a credit card, you are borrowing money from the card issuer, not spending your own. If fraud occurs, the card issuer is the one who loses money, not you. Federal law limits your liability to $50 if you report the fraud, and most card issuers waive that $50 entirely. The card issuer has stronger incentive to investigate quickly because it's their money at stake. Disputes on credit cards also move faster than disputes on debit cards.

This is why many banking experts recommend using a credit card for online purchases and keeping your debit card for ATMs and in-person transactions only. If your debit card is compromised, your actual bank account is at risk. If your credit card is compromised, the card issuer's money is at risk.

Steps to take when ready if you notice fraud

The moment you spot a charge you didn't make, contact your bank or card issuer by phone — not email, not through the app. Find the number on the back of your card or on your statement; do not use a number from a text message or email, because scammers sometimes send fake alerts with fake phone numbers. Tell them which charge is fraudulent and ask them to freeze or cancel the card right away.

Your bank will likely issue you a new card with a new number within 5 to 10 business days. In the meantime, ask whether they can block the fraudulent charge from posting to your account. For debit cards, ask if they can provide emergency cash or a temporary card so you can access money while you wait. For credit cards, ask if they can waive any late fees or interest charges that result from the fraud.

After you hang up, send a written dispute letter to your bank or card issuer. Include the date of the fraudulent charge, the amount, and a statement that you did not authorize it. Keep a copy for your records. Federal law requires them to acknowledge your dispute within 30 days and complete their investigation within 60 days. If you report the fraud within 60 days of the charge appearing on your statement, your liability is limited by law.

Check your account daily for the next week to make sure no additional fraudulent charges appear. If they do, report those when ready as well. Fraudsters sometimes test a stolen card with small charges first, then make larger purchases once they know the card works.

How to check if your information was compromised

If you've been a victim of fraud, your information may have been stolen in a data breach — a hack of a company's computer system that exposed customer payment details. You can search for breaches involving your email address at haveibeenpwned.com, a free database maintained by security researcher Troy Hunt. This site shows which companies' breaches included your email, when the breach happened, and what information was exposed.

You can also place a fraud alert with the three major credit bureaus — Equifax, Experian, and TransUnion. A fraud alert tells creditors to verify your identity before opening new accounts in your name. You only need to contact one bureau; they are required to notify the other two. The alert lasts one year and is free. You can renew it if fraud happens again.

For stronger protection, you can place a credit freeze, which locks your credit report so no one can open new accounts without unfreezing it first. A freeze is free and lasts until you remove it. It's more restrictive than a fraud alert — you won't be able to open new credit yourself without unfreezing — but it stops most identity theft cold. You place a freeze with each of the three bureaus separately through their websites.

Check your credit report for accounts you don't recognize. You can get a free report from each bureau once per year at annualcreditreport.com, the official government site. If you see accounts opened in your name that you didn't open, report them to the bureau when ready and to the creditor that opened them.

Common ways fraudsters get your payment information

Fraudsters obtain payment information through several routes. Phishing is when they send you an email or text that looks like it's from your bank, asking you to "verify your account" or "confirm your information." The link takes you to a fake website that looks real but captures whatever you type. Never click links in unsolicited emails or texts; instead, go directly to your bank's website or call the number on the back of your card.

Skimming happens at ATMs, gas pumps, or card readers at checkout. A fraudster installs a hidden device that reads your card number and PIN as you use it. Some skimmers also have a hidden camera pointed at the keypad. To protect yourself, inspect the card slot before you use it — does it look loose or like it doesn't belong? Cover the keypad with your hand when you enter your PIN. Use ATMs in well-lit, monitored locations inside banks rather than standalone machines on the street.

Data breaches occur when hackers break into a company's computer system and steal customer payment information. You have no control over this; it happens to the company, not to you. If a company you do business with suffers a breach, they are required to notify you. If you hear about a breach through the news before the company contacts you, call the company directly to confirm and ask what information was exposed.

Social engineering is when a fraudster calls you pretending to be from your bank, a store, or a government agency and tricks you into giving them information. They might say your account is locked and ask you to confirm your card number, or say there's suspicious activity and ask you to verify your PIN. Your bank will never call you asking for your full card number, PIN, or password. If you get such a call, hang up and call your bank directly using the number on your card.

How to prevent fraud before it happens

The strongest defense is a strong, unique password for each account. Use at least 12 characters mixing uppercase, lowercase, numbers, and symbols. Do not use your birthday, address, or pet's name. Do not reuse the same password across multiple sites. If one site is breached, a fraudster can try that password on your bank, email, and other accounts. A password manager like Bitwarden, 1Password, or Dashlane stores complex passwords securely so you only have to remember one master password.

Enable two-factor authentication (2FA) on your bank account and email. Two-factor means you need two things to log in: your password and a second proof, usually a code sent to your phone via text or generated by an app like Google Authenticator. Even if a fraudster steals your password, they can't log in without that second code. This is the single most effective fraud prevention tool available to you.

Never share your card number, expiration date, or CVV (the three-digit code on the back) over email, text, or phone unless you initiated the contact and you are certain you're talking to the real company. Legitimate companies never ask for this information unsolicited. When you shop online, use a credit card rather than a debit card, and only enter payment information on websites that start with "https://" (the "s" means the connection is encrypted).

Monitor your statements regularly — at least weekly for debit accounts, monthly for credit cards. Set up account alerts through your bank's app or website so you get notified when ready when a charge over a certain amount posts. Many banks let you set alerts for any transaction, or for transactions in specific categories. The faster you catch fraud, the faster you can stop it.

What happens during a fraud investigation

Once you report fraud, your bank or card issuer opens an investigation. They will review the transaction, check whether it matches your normal spending patterns, and contact the merchant to see if they have additional information like an IP address or shipping address. They may also check whether you were in the geographic location where the charge occurred at the time it was made.

The investigation typically takes 30 to 60 days. During this time, the charge may still appear on your statement, but it should be marked as "disputed" or "under investigation." For credit cards, you usually don't have to pay the disputed amount while the investigation is ongoing. For debit cards, the situation is less clear — some banks will credit the money back to your account when ready while they investigate, others will not. Ask your bank what their policy is.

Once the investigation concludes, the bank will either confirm the charge was fraudulent and remove it, or determine it was legitimate and ask you to pay it. If you disagree with their decision, you can escalate the dispute, though this is rare when the evidence is clear. Keep all documentation — emails, receipts, your written dispute letter, and notes from phone calls — in case you need to escalate.

Frequently Asked Questions

How much money am I responsible for if my debit card is stolen?

Federal law limits your liability to $50 if you report the fraud within two business days of discovering it. If you report it after two business days but within 60 days, your liability increases to $500. If you wait more than 60 days, you could be liable for the entire amount stolen. Report fraud when ready to minimize your risk.

Can I get my money back if I was tricked into sending it to a scammer?

This depends on whether you sent the money yourself or whether someone stole your information. If you voluntarily sent money to someone who lied to you, that's not fraud — it's a scam — and the bank usually cannot recover it because you authorized the payment. If someone stole your login information and transferred money without your permission, that is fraud and you have stronger protections. Report it when ready either way.

What if the fraudster opened a credit card account in my name?

This is identity theft, which is more serious than payment fraud. Contact the credit card company when ready and tell them the account is fraudulent. Place a fraud alert with the credit bureaus and check your credit report for other accounts you didn't open. You may need to file a report with the Federal Trade Commission at identitytheft.gov and potentially with local police, depending on the amount involved.

Do I need to cancel my account if it's been hacked?

You do not need to close the account, though you can if you want to. Closing an account can actually hurt your credit score because it reduces your available credit and shortens your credit history. Instead, change your password to something strong and unique, enable two-factor authentication, and monitor the account closely for 60 to 90 days. If no new fraud appears, you can consider the incident resolved.

How long does it take to get a replacement card?

Most banks mail a replacement card within 5 to 10 business days. Some offer expedited shipping for an additional fee, usually $10 to $25, which can get the card to you in 2 to 3 business days. Ask your bank whether they can issue a temporary card number you can use when ready for online purchases, or whether they can provide emergency cash while you wait for the physical card.