CyberCall the number on the back of the card — or open the issuer’s official app — and report the unauthorized charges in the first hour. Ask fraud to cancel the card, block new charges, and open a dispute. Federal rules reward speed: the CFPB says you cannot be held responsible for unauthorized credit-card charges if you report a lost or stolen card before it is used, and the most you can owe for unauthorized use before you report it is $50 (many issuers waive that). Do not pay the fake charges, do not click a verify-your-card text, and do not buy software to “stop the charges.” Follow up in writing, watch linked bank accounts, and use IdentityTheft.gov only if this looks like identity theft. A credit freeze is a later step — see our credit freeze vs identity monitoring guide.
Call the issuer before you do anything else
The first-hour job is to stop new charges, not to freeze your credit or shop for antivirus.
- Use the phone number on the physical card, the latest statement, or the issuer’s official app. Do not call a number from a text, email, or pop-up.
- Say you have unauthorized charges and ask for the fraud department.
- Ask them to close or freeze the card so nobody can add new charges, then issue a replacement.
- Read every recent charge you do not recognize. Ask them to dispute those line items.
- Change the online-banking password and PIN from a device you trust. Turn on transaction alerts.
- Write down the time, the agent’s name or reference number, and which charges they marked as fraud.
The FTC’s lost-or-stolen card guidance is the same move: report the loss or theft to the bank or credit union as soon as possible, because you are not responsible for charges that happen after you report it.
Credit cards and debit cards are not protected the same way
A credit-card dispute is usually safer in the first hour than a debit-card hit, because debit pulls cash from your checking account.
| Situation | Credit card (CFPB / FDIC) | ATM or debit card (FTC) |
|---|---|---|
| You report the card before anyone uses it | You are not responsible for unauthorized charges | You are not responsible for unauthorized transactions |
| Someone already used the card | Federal cap is $50; many issuers waive it if you report promptly | What you owe depends on how fast you report |
| Only the account number was stolen, not the plastic | You generally have no liability for unauthorized use | Report within 60 calendar days after the statement is sent |
| Debit timing if the plastic was used | Not the debit rule | $0 before any unauthorized use; $50 within 2 business days; up to $500 after that but within 60 days of the statement; after 60 days you can lose the money taken, and possibly more from linked accounts |
If the fraudulent charge hit a debit card, call the bank in the same hour and ask them to restore the withdrawn funds and watch linked accounts. Do not wait for the next statement.
Follow up in writing and watch for a second hit
A phone report starts the clock; a short letter or secure-message confirms what you already told fraud.
- Send a written notice to the billing-inquiry address on the statement, not the payment address. The FDIC says a TILA billing-error notice should identify your name and account, say why you believe there is an error, and include the type, date, and amount.
- Keep a copy of the letter and your call notes.
- You can withhold payment on the disputed amount while the issuer investigates. Pay the rest of the bill that you do recognize.
- The OCC’s HelpWithMyBank page says the bank must tell you the investigation result within two complete billing cycles or 90 days, whichever is less.
- Check the new card’s automatic payments (utilities, pharmacy, streaming) so a real bill does not bounce.
- Pull free reports at AnnualCreditReport.com and look for accounts you did not open.
Skip any “credit card loss protection” upsell that claims you must buy extra insurance to cap fraud. The FTC treats that pitch as a scam; federal law already limits unauthorized credit-card use.
Treat a one-card swipe differently from identity theft
Unauthorized charges on one card you still have are usually card fraud. New loans, tax refunds, or accounts you never opened are identity theft. If it is only the card, stay with the issuer and the written dispute. If someone used your name to open credit, the FTC’s recovery alert is: call the companies where fraud happened, place a fraud alert (and a freeze if you have not already), then report at IdentityTheft.gov for a personal plan. That freeze-vs-monitoring decision is a separate article: Credit freeze vs identity monitoring. Ignore phishing that pretends to be the bank — how to spot a phishing email.
FAQ
What should I do in the first hour after credit card fraud?
Call the issuer from the number on the card or in the official app, cancel the card, dispute the charges, and change the online password. Do not send money, gift cards, or remote-access codes to anyone who called you about the fraud.
Am I responsible for unauthorized charges on my credit card?
The CFPB says if you report a lost or stolen credit card before it is used, you cannot be held responsible. If it was used before you reported it, federal law caps unauthorized credit-card charges at $50, and many cardholder agreements waive that.
Should I freeze my credit in the first hour?
Not as the first move. Stop the card first. Freeze later if you see new accounts or a broader identity-theft pattern. Compare freeze and monitoring in credit freeze vs identity monitoring.
Do I need new antivirus because my card was charged?
No. A stolen card number is a billing problem, not a reason to install a new antivirus. Buying software from a pop-up or a caller who “saw the charges” is a common second scam.
If you later want paid identity monitoring
You do not need to buy anything to dispute a card. If, after the first hour, you want a paid monitoring product, use the on-site Norton page only — Norton — and read how to compare Norton LifeLock identity theft protection. Skip TotalAV, Bitdefender, McAfee, and Avast for this incident.