A credit card is the best-protected way most people pay for anything, which is exactly why scammers work so hard to get you off it. The caller who says your account is under attack never wants to fix the card. They want you to read out a code, approve a prompt, or move your savings somewhere “safe.” This guide separates the three very different problems that hide under the phrase “credit card scam”: someone using your card, someone becoming you, and someone talking you out of the protection you already have.
Most credit card advice assumes one crime: a thief gets your number and goes shopping. That still happens, and the law handles it well. But the cases people struggle with now look different. A “fraud specialist” calls to protect you and persuades you to authorize the loss yourself. A card you never applied for shows up in your name. A text with a real, correct code arrives just before a stranger adds your card to their phone.
We organized this guide around those moments, not around card types. For each one we explain what is happening, what your rights are, and what to do in the first ten minutes. The rules below come from the FTC’s consumer pages, the FCC’s July bank-impersonation alert, the Secret Service’s anti-skimming warnings, and the credit bureaus’ own freeze procedures.
Key Answers If You Only Have a Minute
At most $50 under federal law if the card was lost or stolen and used before you reported it, and nothing if you report it before it is used. Many issuers also waive the $50. The key is reporting quickly and disputing within 60 days of the statement.
No. With a debit card the money leaves your own account, and your liability depends on how fast you report: nothing before use, $50 within two business days, up to $500 after that, and potentially unlimited after 60 days. A credit card keeps the dispute separate from your cash.
The FTC says to contact the card issuer immediately, say you were scammed, and ask them to reverse the charge. It is not a guaranteed win, but a card payment gives you far better odds than a wire, crypto or gift card.
Someone opening a new account in your name. Roughly nine in ten credit card identity-theft reports to the FTC involve new accounts, not stolen cards. The best defense is a free credit freeze at all three bureaus.
Never. The FCC says banks will not call or text and ask you to move your money to protect it. Hang up and call the number on the back of your card or on your statement.
A caller or text gets your card details, adds your card to a wallet on their own phone, and your bank sends you a genuine one-time code. If you read that code out, they can tap and pay without your card. Never share a code, even with someone who says they are the fraud team.
Look before you insert. The Secret Service says to check the reader for loose parts, tape or glue residue, to skip a pump that looks different from its neighbors, and to be extra careful in tourist areas. Paying inside or with a phone wallet reduces the risk further.
No. The FTC says it is illegal for a debt relief company to charge you before it helps, and that an unexpected offer to cut your rate is probably a scam. You can call the number on your card and ask for a lower rate yourself.
Call the number on the back of your card and lock or replace it, send a written dispute for any bad charge within 60 days, and freeze your credit if any personal data was shared. Then report to the FTC at ReportFraud.ftc.gov.
Who Pays When a Card Is Misused
The two federal laws involved, one for credit cards and one for debit and ATM cards, were written for different risks. Understanding the gap is the best reason to keep your debit card out of risky places.
| Situation | Credit card | Debit or ATM card | What to do |
|---|---|---|---|
| Lost or stolen card, reported before anyone uses it | $0 | $0 | Call the number on the back; ask for a replacement |
| Used before you reported it, reported within 2 business days | Up to $50 | Up to $50 | Report at once and ask the issuer to waive the $50 |
| Used before you reported it, reported later but within 60 days of the statement | Up to $50 | Up to $500 | Put the dispute in writing |
| Not reported within 60 days of the statement showing the charge | Cap stays $50, but your formal dispute window has closed | Potentially unlimited | Check statements the day they arrive |
| Only the card number was used online; the card was never lost | Not responsible for charges you did not authorize | Not responsible if reported within 60 days of the statement | Dispute in writing; ask for a new account number |
| You were tricked into paying a scammer | Report to the issuer and ask them to reverse the charge; not guaranteed | Report to your bank and ask them to reverse it; not guaranteed | Do it in the first hour; keep screenshots and receipts |
| An online order never arrived or was not as described | Billing-error dispute; notice must reach the issuer within 60 days of the first bill with the error | Handled under the error rules for debit; less protection for the merchant dispute itself | Try the seller first, then dispute in writing |
In our review of the FTC’s liability tables, the pattern that matters most is not the dollar amounts. It is the shape. Credit card exposure is flat, with a $50 ceiling at every stage. Debit card exposure rises with the clock, and at the end of the ladder the cap disappears. That is why advice about “monitoring your accounts” lands very differently for the two cards: with a credit card, a late discovery is annoying, and with a debit card it can empty the account you pay your rent from.
For a billing error on a credit card, the issuer must receive your written notice within 60 days of the date it mailed the first statement that contained the error. The FTC’s guidance is to send a letter to the address your issuer designates for billing disputes, not just to call. A phone call starts the fraud process, but a written dispute preserves your formal rights. Do both on the same day.
The Credit Card Scam Scripts Behind Most Losses
The cover stories look different, but in each of these the scammer needs something from you: a code, a prompt, a payment, or a bit of information. If you know what they need, you can refuse to supply it.
A text asks whether you recognize a charge, and when you reply no, a “fraud specialist” calls, or the order is reversed and you get a call first. The FCC’s alert, released in July, describes the pattern: phony fraud alerts that ask you to authenticate your account by confirming details or sharing personal information, followed by instructions to move your money to another account to keep it safe. The FCC adds that, according to the FTC, bank impersonation scams account for the highest losses of any impersonation category. The advice is simple: if you get a call claiming to be from a bank or credit card company, hang up and call the customer service number on your statement or the back of your card. If it is a text, do not click anything.
This one starts quietly. A fake page or caller collects your card number, expiry date and security code. The thief then tries to add your card to a mobile wallet on their own device. The issuer, doing its job, sends you a genuine one-time code to confirm. A second script then reaches you, often a call from a “fraud team,” saying a code is about to arrive and that you should read it back to “cancel” the fraud. Reading it back completes the thief’s setup. Apple’s model requires the card issuer to approve a card for Apple Pay, which is why criminals need your verification code. Security researchers have noted that a wallet-registration code is not an ordinary purchase code, so reading the full text of the message matters more than trusting autofill. Red flags include a code you never requested, a new-device alert, and a caller who wants your one-time passcode.
The practical rule that stops this scam: a one-time code is a key, and nobody who is helping you will ever ask for it. Banks tell customers to treat the code as secret even from the bank’s own staff. If you receive a “card added to a wallet” alert you did not trigger, call your issuer at once, keep the message, and check your account for transactions.
In April the FTC repeated its warning about unexpected offers to cut credit card interest rates: say no, thanks. These companies charge you before they do anything, which is illegal for debt relief services, and the FTC notes that some scammers sound credible because they already know the last four digits of your Social Security number, your ZIP code or even your exact balance. Others say the rate is available only for a limited time. The alternative costs nothing: call the number on the back of your card and ask how to qualify for a lower rate. There is no guarantee, but there is also no fee and no risk.
This is not really a “scam” in which you do anything. A criminal with your name, birth date and Social Security number applies for credit as you. The FTC’s identity-theft reports show credit card fraud as the largest category, at roughly 449,000 reports for 2024, and about nine in ten of those involved new accounts. The FTC’s 2025 numbers, as tallied by Experian, show more than 1.3 million identity-theft reports overall, again led by credit card abuse. The thief maxes out the line and walks away, and you find out when a collector calls or a loan is denied. We found that this is the one scam in the guide where nothing you did or failed to do causes the loss. Because the account is new, neither you nor an issuer’s alert system is likely to notice early.
Skimmers still work. In February, the Secret Service said criminals keep planting devices at ATMs and gas pumps, and that its anti-skimming operations inspected nearly 60,000 terminals, pumps and ATMs in 2025 and stopped hundreds of millions of dollars in potential losses. The agency says devices are typically placed both inside the card slot and on the outside, to read the stripe and capture the number. Its advice: check the reader before you insert or swipe, look for loose parts, tape or glue residue, and avoid a pump that looks different from the others at the same station. Tourist areas are popular targets. If you think a card was compromised, tell your issuer and report it to law enforcement.
A shop you have never heard of advertises a designer bag at half price. In August the FTC reminded consumers that social media platforms do not always thoroughly vet the ads you see or the advertisers behind them. In the FTC’s 2024 data, social media was the contact method behind the largest share of reported fraud losses, at about $1.86 billion. A card is the best way to buy from an unknown seller, because a card dispute is an actual legal right, but it only helps if you act within the dispute window and the seller did not deliver. If you never receive the goods, treat it as a billing error.
Credit unions and banks regularly warn about texts or emails claiming your card will be disabled unless you verify it, and about calls from a “fraud department” asking for a one-time login code. A real institution will not pressure you to share your password, PIN, full card number or one-time code through an unexpected call or text. The test is the same one used throughout this guide: close the message, open your issuer’s app or type its address, and see whether any alert exists.
The scripts, side by side
| Scam | What the criminal needs from you | Your fastest test | If you gave it |
|---|---|---|---|
| Fake fraud-department call | Your confirmation, a code, or a transfer | Hang up; call the number on the back of the card | Call the issuer now; freeze or replace the card |
| Phone-wallet provisioning | Your card details and a one-time code | Did you request this code? If not, do not read it out | Report a “card added” alert; ask for a new account number |
| Interest-rate reduction offer | An upfront fee and your card details | Call the number on your card and ask yourself | Dispute the fee; replace the card |
| New account in your name | Nothing from you; your stolen data is enough | Freeze your credit; read your reports | Freeze, then IdentityTheft.gov |
| Skimmer at a pump or ATM | You to insert or swipe your card | Check the reader for tape, loose parts, glue | Replace the card; dispute charges |
| Fake online shop | Your card details and a purchase | Search the seller; check what you are paying for | Dispute within 60 days; replace the card |
| “Card locked” text | Your login, card number or one-time code | Open the issuer’s app yourself | Change passwords; call the issuer |
Why Scammers Steer You Off the Card
Notice what the bank-impersonation script actually asks for. It almost never asks for a card payment. It asks you to move money.
That is a business decision on the scammer’s part, and the FTC’s payment-method data shows why. In 2024, bank transfers and payments accounted for $2.09 billion in reported losses and cryptocurrency for $1.42 billion, according to the agency’s data. Credit cards accounted for $275 million and debit cards for $180 million. When we added the ten payment categories ourselves, bank transfers and crypto together came to roughly 65% of the reported dollars, while credit cards were about 5% and debit cards about 3%. In our reading of the FTC’s testimony, credit cards were still the payment method named most often in fraud reports, which the FTC told Congress in its 2025 data, so cards are far from immune. They simply produce smaller losses per report, because the victim has a path to reversal.
If a stranger has to get you off your card to take your money, then the single most useful instruction you can follow is: never move money because someone told you to. The FTC puts it as flatly as the FCC does. Your money is fine where it is. Anyone who says you must transfer it to protect it, buy gold, withdraw cash, or deposit it into a machine is a scammer, regardless of what badge number they quote.
Pick the Situation That Sounds Like Yours
What you do first depends on what actually happened. Find the closest match, and follow the steps in order.
Treat it as an active theft, and move fast. Hang up. From a different phone if you can, call the number on the back of your card and tell them you gave a one-time code to a caller. Ask them to block the card, review any recent wallet or device additions, and issue a new account number. Check your account and wallet for transactions or a “card added” alert. If you also gave a login or installed anything the caller told you to, change your passwords from a clean device and run a security scan.
Then report. File at ReportFraud.ftc.gov and, if money moved, at ic3.gov. Keep the alert texts, the code message and the call details, since your issuer’s fraud team will ask for them.
First, check whether it is truly unknown: merchant names on statements often differ from the store name, and a free trial may have converted. If you still do not recognize it, call your issuer, say the charge is unauthorized, and ask to replace the card. Then put the dispute in writing and send it within 60 days of the statement date, as the FTC advises, keeping a copy. Under the federal billing-dispute rules, you generally do not have to pay the disputed amount while the issuer investigates, but you should keep paying everything else on the bill.
Do not ignore it, and do not assume it is a glitch. Security researchers describe an unexpected “card added to Apple Pay or Google Pay” alert as a possible sign of provisioning fraud. Call your issuer using the number on your card, tell them the card was added without your approval, and ask them to remove the wallet token and issue a new number. Keep the alert, the one-time code message, screenshots and any case number the bank gives you. Do not respond to a text that offers to help with the alert, since scam texts sometimes invent these warnings to steer you to a fake fraud department.
This is the situation the FTC’s step-by-step page was written for. Contact the company that issued the card as soon as you realize it, explain that you were scammed, and ask them to reverse the transaction and return your money. The FTC says federal law protects you from unauthorized use of your credit card, and it also directs people who were tricked into paying with a card to ask for a reversal. Be honest and specific about what happened. Provide the merchant name, date, amount and any messages. The issuer may treat a payment you willingly made differently from one a thief made, so there is no guarantee, but a card payment gives you a real chance, which a wire or a gift card never does.
This is new-account identity theft. Call the issuer’s fraud department and tell them you did not open the account. Place a free credit freeze at all three bureaus, since a freeze stops new accounts from being opened in your name. An online or phone request must be placed within one business day, and it is free to place and lift. File a report at IdentityTheft.gov to get a recovery plan and an official identity-theft report. Pull your free credit reports at AnnualCreditReport.com and look for other accounts you do not recognize. Consider an extended fraud alert, which lasts seven years for identity-theft victims.
If something looked off, such as a loose card reader or a different pump, tell the station and your issuer before the charges start. If charges have already appeared, call the issuer, ask for a new card with a new number, and dispute the bad charges in writing. The Secret Service says anyone who believes a card was compromised should report it to law enforcement as well as the card issuer. If it was a debit card, move faster, because the liability ladder in Figure 1 starts counting immediately.
Call your bank within minutes and ask for a temporary hold on the account, not just the card. Report the unauthorized transfers within two business days if you can, since that is the point where your liability is lowest. Ask the bank to credit the account while it investigates, put the dispute in writing, and monitor any linked accounts. Going forward, consider using a credit card for gas, online shopping and travel, and keep the debit card for ATM withdrawals at your own bank.
Contact the seller first and keep the messages. If they do not resolve it, put a billing-error dispute in writing to your issuer, so that it reaches them within 60 days of the first statement showing the charge. Include your order confirmation, any messages, and the date you expected delivery. If the seller turned out to be a scam shop built from a social media ad, say so, and report it to the FTC. The sooner you act, the stronger the paper trail.
Say no and hang up. The FTC says it is illegal for a debt relief company to charge before it helps, and that unexpected calls offering rate cuts are probably scams. If you already paid, ask your issuer to dispute the charge, and consider replacing the card if you shared the number. Then call the number on the back of your card and ask for a lower rate yourself. Mention a good payment history if you have one. There is no fee and nothing to lose.
A breach notice does not mean you are a victim yet, but it means your details are out there. Ask your issuer to replace the card, since this takes a phone call. Review your statements monthly, set up transaction alerts, and consider a credit freeze if the breach included your Social Security number. Be especially alert for follow-up phishing: criminals often send fake “breach remediation” emails and texts within days of a real breach announcement.
Ask what they were told, what they shared and whether any money moved, without blame. Then work through this guide’s steps together. Call the card issuer from the number on the card, set up transaction alerts, and discuss placing a credit freeze. The free AARP Fraud Watch Network Helpline at 877-908-3360 offers trained specialists, and the Justice Department’s National Elder Fraud Hotline at 833-372-8311 helps when the victim is 60 or older. Agree on one rule they can remember: a real bank never asks for a code, and never asks them to move money.
Do not stop at the first no. Ask the issuer for the reason in writing, and make sure your dispute is in writing too. Escalate within the company, and file a complaint with your state attorney general’s consumer protection office. You can also file a complaint with the Consumer Financial Protection Bureau at consumerfinance.gov/complaint, though the agency changed its complaint portal this year, and it says it does not guarantee investigation or resolution. Keep copies of everything. Also file with the FTC, which uses reports to build cases against scammers.
Lock It Down Before the Next Call
These steps take an afternoon and cost nothing. Most of them stop whole categories of the scams above.
A credit freeze restricts access to your credit file, which makes it harder for anyone to open a new account in your name. It is free, you can freeze and unfreeze as often as you like, and when you request it online or by phone the bureau must place it within one business day. You contact each of the three bureaus separately: Equifax, Experian and TransUnion. It is a bigger shield against the most common credit card crime, new-account fraud, than any card setting. A fraud alert is a lighter, free option: an initial alert lasts one year, and identity-theft victims can request an extended alert lasting seven years.
Set up transaction alerts for every card, with a low threshold for online and card-not-present charges. Open each monthly statement as soon as it arrives, because the 60-day dispute clock starts when it is mailed. The FTC’s own checklist for protecting cards says to open credit card statements promptly and to cut up old cards you no longer use.
Nobody who is helping you needs your code, and nobody who is stopping fraud will ask for it. Banks and Apple both say never to share a verification code, and Apple adds that it will never ask you to tap Accept on a two-factor prompt to solve a problem. Agree with your family on this one rule, and you remove the key step from the wallet scam, the account-takeover scam and several others.
Because a credit card dispute does not touch your bank balance while the issuer investigates, and because the liability ladder is flat, use a credit card for online shopping, travel, gas stations and anywhere you cannot verify the terminal. Keep the debit card for ATM withdrawals and for stores you know well. This does not make you immune, but it changes what a mistake costs.
Let unknown numbers go to voicemail and check messages before calling back. Ask your phone company about call-blocking tools, as the FCC advises. Never call a number from a text or voicemail. Look up your issuer’s number on the back of your card. If you are at all unsure whether a call is genuine, hang up and dial it yourself.
Questions Nobody Asks Until After It Happens
Because they are not secret. The last four digits appear on receipts and statements, and the rest of the profile, such as your name and address, comes from earlier breaches. A caller who recites them is performing credibility. The FTC makes the same point about interest-rate scams: scammers use details they already have to earn your trust and then ask for more.
You can withhold the disputed amount while the issuer investigates, but you should keep paying every undisputed charge and any minimum due on the rest. Check your issuer’s dispute instructions and ask for confirmation of what is paused. If anything about interest or late fees looks wrong while a dispute is open, ask for it to be corrected in writing.
A freeze does not change your score. It simply stops new lenders from seeing your file unless you lift it. You will need to lift it temporarily when you apply for credit yourself, which is free, and you can place it again afterwards.
If you shared the number, security code or a one-time code with someone who should not have it, replace the card. It is free and quick, and it changes the account number, which is what the criminal holds. Watching a compromised card is only worth it if the number was never exposed.
No. These scripts are built by people who do this full time, and they succeed against careful people. What matters now is speed and documentation. Report quickly, put your dispute in writing, and keep every message.
Who to Call and What Each One Does
Put these in your phone today. A list assembled on a calm afternoon is much easier to use than one you hunt for in a panic.
| Who | Use it for | How to reach them | Notes |
|---|---|---|---|
| Your card issuer | Blocking a card, disputing a charge, a new account number | Number on the back of your card | Call first; follow with a written dispute |
| Federal Trade Commission | Reporting any scam; identity-theft recovery plans | ReportFraud.ftc.gov · IdentityTheft.gov · 1-877-438-4338 | Reports help build cases against scammers |
| Equifax | Credit freeze or fraud alert | 1-800-685-1111 | Contact each bureau separately |
| Experian | Credit freeze or fraud alert | 1-888-397-3742 | Online or phone freezes take effect within a business day |
| TransUnion | Credit freeze or fraud alert | 1-888-909-8872 | Freezes and alerts are free |
| Free credit reports | Checking for accounts you do not recognize | AnnualCreditReport.com · 1-877-322-8228 | The official free-report site |
| FBI Internet Crime Complaint Center | Online fraud where money moved | ic3.gov | Report quickly |
| FCC consumer complaints | Scam calls and texts, including bank impersonators | consumercomplaints.fcc.gov · 1-888-225-5322 | Also ask your carrier about call blocking |
| National Elder Fraud Hotline | Help when the victim is 60 or older | 833-372-8311 | Weekdays, 10 a.m. to 6 p.m. Eastern |
| AARP Fraud Watch Network | Talking to a trained specialist | 877-908-3360 | Free; open to anyone |
Liability limits and dispute windows reflect federal consumer-protection rules as described by the FTC and may differ if your issuer’s policy is more generous. Statistics are reported complaints and losses to the FTC and may understate total losses. Percentages and share figures labeled as our own are calculations from published totals; the FTC’s 2024 payment-method figures are the most recent complete breakdown we found by dollars. Phone numbers, portals and procedures can change, so confirm contact details on the official sites before relying on them.
This page is independent educational information, not legal or financial advice, and it is not affiliated with or endorsed by any card issuer, the FTC, the FCC, the Secret Service, the credit bureaus or any other agency named. If you believe a crime is in progress, call 911 or your local police.
Key sources: FTC consumer guidance on lost or stolen cards, credit freezes and what to do if you were scammed, and Consumer Sentinel data · FCC bank-impersonation consumer alert · U.S. Secret Service anti-skimming guidance · Apple Support security guidance · credit bureau freeze procedures · AARP Fraud Watch Network and the Justice Department’s National Elder Fraud Hotline