I Gave a Scammer My Credit Card Number: What to Do Now

Gave your credit card number to someone who turned out to be a scammer? Call your card issuer now, using the number on the back of your card or its app, and ask it to cancel the card and send you a new one. The FTC says federal law protects you from unauthorized use of your credit card, and there’s a set process for disputing charges you were tricked into paying, if you meet the deadlines below.

What can a scammer do with my credit card number?

Use it to buy things. IdentityTheft.gov warns that a thief could try to use your card number to make purchases. The CFPB describes two patterns to watch for (CFPB):

• Test charges. Thieves sometimes run a small charge first, then come back for more if it goes through.
• Late charges. Fraudulent charges can show up months after your information was stolen.

Scammers can also sell your information to other scammers, the FTC says.

What to do if you get credit card scammed

1. Call your card issuer and ask for a new card

The FTC says to report it to the card issuer immediately, whether someone used your card without permission or tricked you into paying them.

• Ask to cancel and replace the card. The CFPB says to do it before more transactions come through.
• Say exactly what you shared: the number, expiration date, security code, billing ZIP code, a texted code or a login. When a bank investigates, it may ask what you know about the person who used the card, for a signed statement, or for a police report if you filed one, according to the Office of the Comptroller of the Currency.
• Keep notes: who you spoke with and when, as the FTC suggests, and any claim number.

2. Go through every recent charge

Flag each charge you didn’t make and each one the scammer talked you into, including small ones. If you find fraudulent charges, IdentityTheft.gov says to call the fraud department and get them removed.

3. Follow up in writing

Even if you disputed by phone or online, the FTC says to follow up with a letter, and it offers a sample you can adapt. The letter must reach the issuer within 60 days after the first bill with the error was sent to you.

• Send it to the address for billing disputes or inquiries, not the payment address.
• Include your name, account number, the date and amount of each charge, and why it’s wrong.
• Use certified mail with a return receipt if you can. Enclose copies of your proof, not originals.

4. Update automatic payments and turn on alerts

• Move automatic payments to your new card, as IdentityTheft.gov suggests.
• Sign up for text or email alerts for every new transaction to help you spot fraud, the FTC says.
• Keep checking your statements and report fraudulent charges ASAP.

5. Save the evidence

Keep screenshots of texts, emails, chats, ads and websites, plus receipts, order confirmations and messages, as the FTC suggests. Then stop replying to the scammer.

What happens if your credit card is scammed?

It depends on which of these two situations you’re in. You can be in both.

Charges you didn’t make: unauthorized use

Federal law limits your responsibility for unauthorized charges to $50. And when your account number is used but your card isn’t lost or stolen, the FTC says you aren’t responsible for any charges you didn’t authorize. The CFPB agrees that you generally have no liability in that case. The $50 limit is for when the card itself is lost or stolen and used before you report it.

Giving your number to a scammer doesn’t automatically make their charges yours. The official interpretation of Regulation Z, the federal rule behind these limits, says unauthorized use includes a transaction by someone who got the card from you, or otherwise started the transaction, “through fraud or robbery.” It also gives this example: when someone without permission orders by phone or online using your card number, alone or with the expiration date and security code, no liability may be imposed on you.

Charges you agreed to: a billing dispute

Maybe you paid a fake store, a fake “tech support” company or a seller who vanished. The FTC’s advice is the same: report it to the issuer and ask for a refund.

Under the Fair Credit Billing Act, some charges you agreed to count as billing errors you can dispute, such as charges for goods or services you didn’t accept or that weren’t delivered as agreed, or for the wrong amount. Disputes about quality are not billing errors, the FTC notes. When the issuer reverses a charge, that’s sometimes called a chargeback, the CFPB says.

Paid a scammer with a credit card: can I get my money back?

Maybe. The FTC says credit cards have stronger legal protections than debit cards, but the result depends on your issuer’s investigation. Here’s how a billing dispute works (FTC, FTC):

• Deadline: Dispute in writing within 60 days of the date the first statement with the error was sent to you. Otherwise, “you may get stuck with the bill.”
• Acknowledgment: The issuer must confirm your dispute in writing within 30 days, unless it’s already resolved.
• Decision: It must resolve the dispute within two billing cycles, and no more than 90 days.
• Your bill: During the investigation, you don’t have to pay the disputed amount or related charges, but you must pay the rest. The issuer can’t report you as delinquent meanwhile.
• If the issuer says you owe it: It must explain in writing. You can appeal, and you can file a complaint with the CFPB.

Don’t wait on promises. If a “seller” keeps saying your order is coming, the 60 days keep running. After that, you’re likely outside the law’s protection, though some issuers may extend the period when a shipment is delayed.

Credit card vs. debit card

Debit cards fall under a different federal rule, Regulation E, and the protections are weaker. The FTC compares them (FTC, FTC):

If…	Credit card	Debit card
A scammer used your number, but you still have the card	You aren’t responsible for charges you didn’t authorize	You aren’t responsible for transactions you didn’t authorize if you report within 60 calendar days after your statement is sent
The card itself was lost or stolen and used before you reported it	Up to $50	Up to $50 within 2 business days of learning about it, up to $500 within 60 days of your statement, then all of it and possibly more
You paid for something that never arrived	You can dispute it as a billing error	You may not get a refund, though some issuers may offer more protection
During the dispute	You can hold off paying the disputed amount	The money has already left your account

Once you report an unauthorized debit card transaction, your bank generally has 10 business days to investigate. If you gave out a debit card or bank account number, see I gave a scammer my bank account number.

If you also shared a code, your login or your Social Security number

• A one-time code. The FTC says anyone who asks for one is a scammer who can use it to log in. If you shared one, tell your issuer right away; the FTC gives the same advice for bank accounts.
• Your online login. Create a new, strong password, change it anywhere else you used it, and turn on two-factor authentication (FTC). Then check for charges you don’t recognize and account changes, like a new address. Clicked a link in a text or email? See what to do after clicking a phishing link.
• Access to your computer or phone. See I let a scammer into my computer.
• Your Social Security number. The FTC says to report it at IdentityTheft.gov if the scammer used it, or to follow its protection steps if you aren’t sure. See I gave a scammer my Social Security number and how to freeze your credit. Other details exposed? See a scammer has my personal information.

Shared only the card number? IdentityTheft.gov lists checking, freezing and monitoring your credit as steps you can also take.

“Your card has been compromised”: the call that asks for your number

Some scammers call, text or email claiming to be from your card company’s “security department,” then ask you to confirm your account number. No matter the story, it’s a scam, the FTC says.

• Scammers fake caller ID to look like a business you know.
• Don’t give your account number over the phone unless you made the call.
• No real fraud department caller will ever ask for your verification code.
• Hang up and call the number on your card, statement or app. Never use the number the caller gave you.

More: Is this call really from my bank? Typed your card number into a site after a text about a package? See the USPS text scam guide.

How to report it

After you call your issuer:

1. FTC: Report it at ReportFraud.ftc.gov. The FTC can’t resolve individual reports, but it uses them to investigate and bring cases.
2. FBI’s Internet Crime Complaint Center: If a website, email, text, social media or an app was involved, file at IC3.gov, even if you’re unsure your complaint qualifies. Its examples of cyber-enabled crime include non-delivery of goods or services. You won’t hear back from IC3 itself.
3. IdentityTheft.gov: If the scammer used your Social Security number or opened accounts in your name, report it at IdentityTheft.gov for a recovery plan. Found a card you never opened? See someone opened a credit card in my name.
4. CFPB: If your issuer won’t fix the problem, submit a complaint. The CFPB says most companies respond within 15 days.
5. If you’re 60 or older, or helping someone who is: Call the National Elder Fraud Hotline at 833-FRAUD-11 (833-372-8311), Monday through Friday, 10 a.m. to 6 p.m. Eastern (Office for Victims of Crime, IC3).

The report-a-scam tool lists official channels, and the scam recovery checklist tracks your steps. Paid another way too? See Zelle or gift cards.

Watch for the follow-up scam

The FTC calls refund and recovery scams “the worst of the worst”. Scammers trade lists of people who have already lost money. Be on guard if someone:

• wants an upfront “retainer fee,” “processing fee” or “tax” to recover your money (legitimate organizations never ask for money to help you get a refund);
• says they’re with a government agency, a law firm or even the company that took your money;
• asks for your card, bank account or Social Security number to deposit a refund (the FTC says never give payment information to get a refund);
• sends a refund check for more than you lost and asks for the difference back (always a scam, the FTC says);
• claims to be from the FBI’s IC3, which says it never contacts people directly or asks for payment to recover money.

What varies

• Your issuer. Many cardholder agreements say you aren’t responsible for any unauthorized charges, even where federal law would allow up to $50, the CFPB notes.
• The investigation. Your issuer decides each claim, and a refund for a scam purchase isn’t guaranteed.
• Card type. Debit cards have weaker legal protections than credit cards, but some debit card issuers voluntarily offer more, the FTC says.
• Where you live. Whether someone had permission to use your card is decided under state or other applicable law, and quality claims depend on your state.