Credit Card Fraud: Someone Used Your Existing Card
This is the most common form of financial fraud. Your card number was stolen (through a data breach, skimmer, or phishing) and used to make purchases. Your account exists — someone just used it without permission.
Your legal rights (Fair Credit Billing Act)
- Credit cards: maximum $50 liability for unauthorized charges — and virtually every major issuer has a $0 fraud liability policy that goes further than the law requires.
- Debit cards: more complex. Under the Electronic Fund Transfer Act: report within 2 business days = $50 max liability. Report between 2–60 days = up to $500 liability. After 60 days = potentially unlimited. This is why using credit cards (not debit) for daily purchases meaningfully protects you.
- You have 60 days to dispute a credit card charge in writing from when the statement containing the charge was mailed.
- The card issuer must acknowledge your dispute within 30 days and resolve it within 2 billing cycles (roughly 90 days).
What to do when you find an unauthorized charge
Call the number on the back of your card immediately
Report each unauthorized charge specifically. Your issuer will cancel the card and issue a replacement. Ask for a case or dispute reference number. Dispute charges verbally then follow up in writing — send a certified letter to the billing inquiries address (not the payment address) with a copy of your statement with the charges circled.
Monitor your other accounts
If one card was compromised, check all your accounts. Data breaches often expose multiple accounts simultaneously. Review the past 60–90 days of statements on every card, bank account, and PayPal/Venmo/CashApp.
Check haveibeenpwned.com
Enter your email address at haveibeenpwned.com to see which data breaches have exposed your credentials. This tells you the likely source of the card theft and which other accounts may be compromised. Change passwords on any breached accounts.
Identity Theft: Someone Created New Accounts in Your Name
This is more serious than credit card fraud. Here, someone has enough of your personal information (name, SSN, address, date of birth) to open entirely new credit accounts, file taxes in your name, receive medical care billed to your insurance, or obtain employment. You may not discover it for months.
Warning signs of identity theft (not just card fraud)
Unfamiliar accounts on your credit report
Credit cards, loans, or lines of credit you didn't open — found on your free annual credit report at AnnualCreditReport.com (the official, federally mandated site — not the look-alikes).
Medical bills for care you didn't receive
Receiving Explanation of Benefits (EOB) letters from your health insurer for services you didn't have. Medical identity theft is particularly serious — errors in your medical record can affect future care.
IRS notice about a duplicate tax return
A notice that a return was already filed for your SSN means someone used your identity to claim a refund. The IRS issues a letter; once you receive it, your real return was held pending investigation.
Government benefits denial or SSA earnings discrepancy
Someone working under your Social Security number shows up in SSA records. Check your Social Security Statement at ssa.gov/myaccount to verify your earnings history looks correct.
Identity theft response — in order
File an FTC Identity Theft Report at IdentityTheft.gov
This is your primary action. The FTC's IdentityTheft.gov generates a personalized recovery plan, creates an official FTC Identity Theft Report (which companies and credit bureaus must honor — it's legally equivalent to a police report for most purposes), and walks you through every step. It takes 15–20 minutes. This one action unlocks most of your legal rights in the recovery process.
Freeze your credit at all three bureaus — and two more
A credit freeze (also called a security freeze) is free by federal law since 2018. It prevents anyone — including you — from opening new credit accounts until you temporarily lift it. Contact each separately:
Equifax: equifax.com/personal/credit-report-services/credit-freeze/ or 1-800-349-9960
Experian: experian.com/freeze or 1-888-397-3742
TransUnion: transunion.com/credit-freeze or 1-888-909-8872
Also freeze at: Innovis (innovis.com/personal/securityFreeze, 1-800-540-2505) — a 4th credit bureau many people overlook — and ChexSystems (chexsystems.com, 1-800-428-9623) which governs bank account openings.
Place a fraud alert with one bureau (it notifies all three)
A fraud alert is different from a freeze. It requires businesses to verify your identity before opening new credit — but doesn't block it outright. You only need to contact one bureau — they're legally required to notify the others. An initial alert lasts one year. If you have an FTC Identity Theft Report, you can request a 7-year extended fraud alert. A freeze is stronger protection; use both.
Dispute fraudulent accounts with each credit bureau and each creditor
Your FTC Identity Theft Report gives you the legal right to have fraudulent accounts blocked from your credit report. Send the report plus a dispute letter to each credit bureau for each fraudulent account. Credit bureaus must investigate within 30 days and remove verified fraudulent accounts. Also contact each creditor's fraud department directly — they have separate fraud teams from their general customer service.
Get an IRS Identity Protection PIN (IP PIN)
If your SSN was exposed, get an IRS Identity Protection PIN at irs.gov/identity-theft-fraud-scams/get-an-identity-protection-pin. This 6-digit PIN is required on your federal tax return and prevents anyone else from filing a return using your SSN. It's renewed each year. This is one of the most effective protections against tax identity theft.
File a police report for serious identity theft
For significant identity theft — fraudulent loans, criminal activity in your name, medical identity theft — file a local police report in addition to your FTC report. Some creditors specifically require a police report number. Bring your FTC Identity Theft Report, a government ID, and documentation of the fraud.
Frequently Asked Questions
Can I get money back after identity theft?
It depends on the type of loss. Fraudulent credit accounts: the accounts must be closed and the debt removed from your credit report, but you generally don't receive cash back since credit was extended in your name. Tax refund theft: the IRS will eventually process your legitimate return, but it can take 6–18 months. Bank accounts drained: covered under EFTA if reported promptly. The recovery process restores your credit and closes fraudulent accounts — recovering actual cash losses is harder and varies case by case.
Is a fraud alert or credit freeze better?
A credit freeze is stronger. A fraud alert asks creditors to take extra steps to verify identity before extending credit — but it relies on them following through. A credit freeze actually blocks new credit from being opened, period, until you lift it. Use both: freeze all five bureaus, and place an extended fraud alert using your FTC Identity Theft Report.
My SSN was in a data breach but there's no fraud yet. What should I do?
Act before fraud occurs. Freeze your credit at all five bureaus now. Get an IRS IP PIN. Monitor your credit reports monthly at AnnualCreditReport.com. Set up SSA.gov/myaccount to catch unreported earnings under your SSN. Create a myE-Verify account at e-verify.gov — this lets you lock your SSN from being used in employment verification. Don't wait for fraud to happen before protecting yourself.