Skip to main content

Watch accounts closely when card data is hacked

Keep a close eye on your account activity and report suspicious transactions quickly if you believe someone stole your credit or debit card information.

From data breaches to Wi-Fi network hacking, thieves are finding new ways to steal and use your credit or debit card information, even if your cards are still in your wallet. But if you take the right steps, you will not be responsible for unauthorized debits to your checking account, or charges to your credit card.

Check your account for unauthorized charges or debits

Make a habit of monitoring your accounts. Online or mobile access to your accounts can make it easier to check your transactions frequently. If you receive paper statements, be sure to open them and review them closely. You should do this even if you’re not sure your information was compromised.

Look for any suspicious activity like unfamiliar merchant names, especially from merchants outside your area, even if the transaction amounts are small. Sometimes thieves process a small debit or charge against your account and return to take more if the small debit or charge goes through.

Fraudulent charges or debits to your accounts might occur months after the theft of your information.

Immediately alert your provider if you spot suspicious activity

Contact your bank or card provider immediately if you suspect an unauthorized debit or charge. If a thief takes money from your bank account by debit, or charges items to your credit card, you should cancel the card and have it replaced before more transactions come through. You should also consider changing your debit card PIN just to be on the safe side.

For credit cards

You are not responsible for unauthorized charges if someone stole only your credit card account number. If the card is lost or stolen too, you could be responsible for up to $50.

For debit cards

For protections to apply, you need to register your card. This includes payroll, benefits, and prepaid cards.

If an unauthorized transaction appears on your statement (but your card has not been lost or stolen) you should report it within 60 days after your account statement is available. If you wait longer, you could have to pay the full amount of any transactions that occurred after the 60-day period and before you notify your bank or credit union. The bank or credit union then investigates and may credit the money back to your account.

The time for you to report is much shorter if your card has been lost or stolen — just two business days after you see that your card has been lost or stolen — to limit your liability to no more than $50 of unauthorized charges. Make the report as soon as you can, after you learn your card is missing or stolen.

For mobile phones with money apps

Most mobile payment apps allow you to set up a passcode, PIN, or fingerprint that you can use to authenticate yourself before making a payment. Setting up this feature helps to prevent anyone else who gets access to your mobile phone from making mobile payments from your account. If your mobile phone with a payment app is lost or stolen, notify your bank or payment provider.

If a mobile app tells you there has been a data breach that exposed your financial data, also notify your financial institution right away.

How to report a suspicious charge or debit

If you spot a fraudulent transaction, call the card provider’s toll-free customer service number immediately. Ask how you can follow up with a written communication. Your monthly statement or error resolution notice also likely includes instructions on how and where to report fraudulent charges or billing disputes.

Be sure to keep copies of your letters for your records. Write down the dates you make follow-up calls and keep this information together in a file.

Tip: If you get a replacement card with a new number, remember to update any automatic payments linked to the card.

Expect a prompt investigation

Card providers should investigate the charges quickly — generally within 10 business days of receiving an error notice for debit card disputes or within two billing cycles for credit card disputes. You have a right to know the results of the investigation. Debit card companies have 45 days (and sometimes 90 days) to investigate, as long as they provisionally credit the disputed amount to your card first.


Page last modified @

View older versions of this page at our public archive.