Payment fraud is when someone uses your payment information or account without your permission to take money or make unauthorized charges.

Payment fraud covers a wide range of theft. It can mean a criminal using your stolen credit card number to buy things online. It can mean someone hacking into your bank account and transferring money out. It can mean a scammer convincing you to send money to them by pretending to be someone else. It can mean a merchant charging your card twice for one purchase, or charging you for something you never ordered. The common thread is that money leaves your account or gets charged to you without your actual consent.

Fraud differs from a simple billing error or a legitimate charge you forgot about. When fraud happens, the person taking the money either does not have the right to take it, or they obtained that right through deception. You are not responsible for most fraudulent charges if you report them quickly, but the process of getting your money back takes time and requires you to act.

Key Takeaways

  • Payment fraud means someone uses your payment information or account without permission to take money or make charges you did not authorize.
  • Fraud can happen through stolen card numbers, hacked bank accounts, social engineering scams, or merchant errors designed to overcharge you.
  • You have legal protection against most fraudulent charges if you report them to your bank or card issuer within the timeframe they specify, usually 60 days.
  • The faster you report fraud, the faster your money can be returned and the easier it is to prove you did not make the charge.
  • Preventing fraud requires monitoring your accounts regularly, protecting your passwords and card numbers, and being cautious about who you send money to.

How fraudsters get your payment information

Criminals obtain your payment details through several common routes. They may steal a physical credit or debit card, or they may intercept the card number when you swipe it at a compromised payment terminal or gas pump. They may hack into a merchant's database and steal thousands of card numbers at once—this is how large data breaches happen. They may send you a fake email or text that looks like it comes from your bank, asking you to "verify" your account by clicking a link and entering your login credentials; when you do, they now have access to your account.

Phishing is one of the most common entry points. A scammer sends you a message that appears to come from your bank, PayPal, Amazon, or another service you use. The message says your account has been compromised, or a charge looks suspicious, or you need to update your payment method. The link in the message takes you to a fake website that looks identical to the real one. You enter your username, password, or card details, and the scammer now has them. By the time you realize the website was fake, they have already moved money or made charges.

Social engineering is another route. A scammer calls you pretending to be from your bank's fraud department, saying they noticed suspicious activity on your account. They ask you to confirm your card number, expiration date, or CVV to "verify" it is really you. A legitimate bank will never ask you for this information over the phone. But the scammer sounds professional and creates urgency, so you comply. They now have your card details and can use them immediately.

Types of payment fraud you may encounter

Card-present fraud happens when someone physically steals your credit or debit card and uses it in a store or at an ATM. This is why you should check your statements regularly and report a lost or stolen card immediately. Most card issuers will cancel the card and send you a replacement within 5 to 10 business days.

Card-not-present fraud occurs when someone uses your card number online or over the phone without having the physical card. They may have obtained the number through a data breach, phishing, or by watching you enter it. Online merchants cannot see your face or verify your ID, so this type of fraud is common in e-commerce.

Account takeover is when a scammer gains access to your bank account, payment app, or email and changes the password so you cannot log in. Once inside, they can transfer money out, change your contact information, or lock you out entirely. This is more serious than card fraud because the attacker has control of your entire account, not just one card number.

Check fraud involves forging your signature on a check, altering the amount on a check you wrote, or creating a fake check with your account number. The money is withdrawn from your account without your knowledge. Reporting check fraud to your bank usually requires a written statement and can take longer to resolve than card fraud.

Wire transfer fraud happens when a scammer convinces you to send money via wire transfer, ACH, or another irreversible payment method. Once the money is sent, it is extremely difficult to recover. This often involves impersonation—a scammer pretends to be your boss, a contractor, a family member in crisis, or a government agency demanding payment.

Merchant fraud is when a business intentionally overcharges you, charges you twice for one purchase, or charges you for something you never ordered. This is less common than criminal fraud, but it does happen and you have the same dispute rights.

What happens when fraud is reported

When you report a fraudulent charge to your bank or card issuer, they open an investigation. They will ask you to describe the charge, when you first noticed it, and whether you recognize the merchant. They may ask for documentation like receipts or correspondence. For card fraud, the investigation usually takes 10 business days. For bank account fraud or wire transfers, it can take 30 to 45 days or longer.

During the investigation, the bank contacts the merchant or the bank that received the money and asks them to provide evidence that the charge was legitimate. If the merchant cannot prove you authorized the charge, the bank will reverse it and credit your account. If the merchant provides evidence that you did authorize it—such as a signed receipt or a delivery confirmation—the bank may deny your dispute.

For credit cards, you are protected by federal law: your liability for fraudulent charges is capped at $50, and many card issuers waive even that if you report the fraud promptly. For debit cards, your liability depends on how quickly you report the fraud. If you report it within two business days of discovering it, your liability is capped at $50. If you report it after two business days but within 60 days, your liability can be up to $500. If you wait more than 60 days, you may lose all protection and be liable for the full amount.

For bank accounts and wire transfers, the rules are stricter. You typically have 60 days to report unauthorized transactions. After that, the bank is not required to refund you. Wire transfers are especially difficult to recover because the money is usually moved to another bank or country within hours, and reversing a wire requires cooperation from multiple financial institutions.

Steps to take if you discover fraud

First, stop using the compromised card or account immediately. If it is a credit card, call the card issuer's fraud line—the number is on the back of your card or on your statement. If it is a debit card or bank account, call your bank. Have your account number and a recent statement ready. Tell them which charges are fraudulent and when you first noticed them.

Ask the bank or card issuer to cancel the card or account and send you a replacement. They will usually do this over the phone and can have a new card to you within 5 to 10 business days. For bank accounts, ask them to freeze the account or change your password immediately so the fraudster cannot make more charges.

Request a written confirmation of the fraud report. The bank will send you a dispute form to sign and return. Fill it out completely and return it within the timeframe they specify—usually 10 to 30 days. Keep copies of everything you send.

Monitor your account closely while the investigation is underway. Check your statements weekly for any new unauthorized charges. If you see more fraud, report it immediately—each charge may need its own dispute.

If the fraud involved your email or password, change your password for that account and for any other accounts that use the same password. Consider using a password manager to create unique, strong passwords for each account. If the fraud involved your Social Security number or personal information, you may want to place a fraud alert or credit freeze with the credit bureaus to prevent identity theft.

How to reduce your fraud risk

Check your bank and credit card statements at least once a month, ideally more often. Many banks and card issuers offer free alerts that notify you by email or text when a charge is made. Set up these alerts for any charge over a certain amount—say, $25 or $50—so you catch fraud quickly.

Never share your card number, expiration date, CVV, or PIN with anyone, even if they claim to be from your bank. A legitimate bank will never ask for this information via email, text, or phone. If you receive a message asking for it, do not click any links or call any numbers in the message. Instead, call the bank using the number on your statement or card.

Use strong, unique passwords for your bank and payment accounts. A strong password is at least 12 characters long and includes uppercase letters, lowercase letters, numbers, and symbols. Do not use the same password for multiple accounts, because if one is breached, all of them are at risk.

Enable two-factor authentication on your bank and payment accounts if it is available. This means that even if someone has your password, they cannot log in without a second form of verification, such as a code sent to your phone or generated by an app.

Be cautious about unsolicited calls, emails, and texts. If someone contacts you claiming to be from your bank or a government agency and asks for personal information or payment, hang up or delete the message. Call the organization directly using a number you know is legitimate.

Use a credit card instead of a debit card for online purchases and in unfamiliar places. Credit cards offer stronger fraud protection than debit cards, and fraudulent charges do not come directly out of your bank account.

Frequently Asked Questions

How long do I have to report fraud before I lose protection?

For credit cards, you have up to 60 days from when you receive your statement to report a fraudulent charge. For debit cards, you have two business days to limit your liability to $50, and 60 days to limit it to $500. After 60 days, you may lose all protection. For bank accounts and wire transfers, the window is also 60 days. Report fraud as soon as you notice it to maximize your protection.

Will I get my money back if I report fraud?

Most fraudulent charges on credit cards are reversed within 10 business days. For debit cards and bank accounts, it can take 30 to 45 days or longer. Wire transfers are the hardest to recover because the money moves quickly and may cross international borders. The bank will credit your account once the investigation concludes, but you may not see the money immediately if the merchant disputes the claim.

What if the fraudster used my information to open a new account in my name?

This is identity theft, which is more serious than payment fraud. Contact the credit bureaus (Equifax, Experian, and TransUnion) and place a fraud alert on your credit report. You can also request a credit freeze, which prevents anyone from opening new accounts in your name. File a report with the Federal Trade Commission at IdentityTheft.gov and keep documentation of all fraudulent accounts.

Can I dispute a charge if I authorized it but changed my mind?

No. A dispute is for charges you did not authorize. If you authorized a charge but later regretted it, you need to contact the merchant directly and ask for a refund. If the merchant refuses, you can try disputing it with your card issuer, but they will likely side with the merchant because you did authorize the charge.

What should I do if I gave my card number to a scammer?

Call your card issuer immediately and report that your card number may have been compromised. They will cancel the card and send you a replacement. Monitor your account closely for the next few months for any unauthorized charges. If charges appear, report them right away. Most card issuers will not hold you liable for fraudulent charges if you report the compromise promptly.