Someone is using my credit card

A charge landed that you did not make, or the card is missing and you assume the next one is coming. Call the issuer now, on the number printed on the card or on a statement you already have. Do not use a number from a text or from the person who “noticed” the fraud for you.

Say whether you authorised the payment. A stolen number is a different case from a payment you approved because someone pressured you. The playbook that holds both, plus the steps that change by country, is Scammed or fraudulent bank charge.

The dollar limits below are United States federal rules, from the Federal Trade Commission and the Consumer Financial Protection Bureau. Other countries set their own deadlines and refund rights. If you are not in the US, make the call anyway, then use the country block in that playbook rather than these numbers.

Credit cards, in the United States

The CFPB’s answer is short. If you report a lost or stolen credit card before anyone uses it, you are not responsible for unauthorised charges. If there is unauthorised use before you report it, the most you owe on that card is $50. Many agreements say you owe nothing even then. Read yours, or look it up in the CFPB’s card-agreement database, which is what they suggest.

If you still have the card and someone used the account number, the CFPB says you generally have no liability for that unauthorised use.

The FTC’s page Lost or stolen credit, ATM, and debit cards matches that split, and adds a habit: follow the call with a letter. Include the account number, when you noticed the problem, and when you first reported it. Keep a copy, and keep notes from the call. Charges that happen after you report the loss are not yours to pay. That is why the call is the whole first hour.

Ask them to replace the number. Then update automatic payments, or the next rent payment fails on a dead card and you will think the thief is still spending.

Debit cards, in the United States

Debit is tighter, because the money leaves your account. The FTC’s table, and the CFPB’s explanation of getting money back after an unauthorised transfer, work like this:

• You report the card lost before any unauthorised charge. You owe nothing.
• You report within two business days of learning about the loss or theft. The cap is $50.
• You report more than two business days later, but within 60 calendar days of the statement being sent. The cap can be $500.
• You wait more than 60 calendar days after the statement is sent. You can be liable for transfers after that window, including money in linked accounts, if the bank can show those transfers would not have happened had you reported in time.

If the card itself was not lost and only the number was used, the FTC says you are not liable for unauthorised transfers as long as you report them within 60 calendar days after the statement is sent.

Write it down the same way as a credit card. The two-day clock is why “I’ll look at it tomorrow” is expensive on a debit card and mostly irrelevant on a credit card.

If the charge is Amazon, PayPal, or a new account in your name

A charge from Amazon can be the Amazon account, the card, or both. Sign in to Amazon by typing the address, review orders, and change that password if an order is not yours. The account steps are Amazon account hacked. Still call the card issuer. Amazon Pay tells buyers that an unauthorised charge they cannot find in their activity is a matter for the bank’s chargeback process, and that the issuer may ask for documents.

PayPal is the same shape. Report the payment in PayPal’s Resolution Center, and call the bank if the payment pulled from a linked account. US click-path and the 10-day email they mention are in PayPal account hacked. Those labels are from PayPal’s US help. Other countries use the same idea and different screens.

If the problem is a card or a loan you never opened, you are past a stolen number. That is Someone is using your identity. In the US, IdentityTheft.gov is the place that builds the report lenders ask for. Disputing one charge on your real card does not close an account someone else opened.

What you say on the call

You did not authorise these charges. Here are the dates and amounts. Please freeze or replace the card, and attempt a recall if a transfer just left. You will follow up in writing.

If you were talked into sending the money, say that. “I approved it because I thought you were the bank” is a different case from “I never approved it.” The protections are weaker when you authorised the payment, and they vary by country. Speed still matters, because a recent transfer is easier to chase than one that has already hopped accounts.

Do not call the merchant from a number on a suspicious text. Do not pay a “recovery agent.” Do not move the remaining balance to a “safe account” while you are on the phone with a stranger. That second move is you authorising a new payment.

After the issuer answers

You want a replacement number, a case or dispute reference, and a clear statement of what they will reverse. Keep the letter you send. Check the next statement. A second small charge is a common test before a larger one, so a $1 you do not recognise is still this incident.

Then spend twenty minutes on the prepare list in Scammed or fraudulent bank charge. The fraud number saved outside the banking app is the part that makes the next call faster than this one.

Related playbooks

• Scammed or fraudulent bank charge. Money left your account that you did not authorise, or you were talked into sending it and have just realised.
• Someone is using your identity. Accounts, loans, tax filings, or bills are appearing in your name, and you did not open them.
• Amazon account hacked. Orders, a new address, or a payment method showed up on your Amazon account, or Amazon has put the account on hold.
• PayPal account hacked. A PayPal payment, a new email, or a linked bank showed up that you did not authorise, or you cannot sign in.