In the U.S., credit cards are used almost everywhere. From in-store purchases to online shopping, from buying groceries to paying school tuition, basically 99% of everyday spending can be done with a credit card. But when you use a credit card, you usually do not need to enter a PIN, and sometimes you do not even need to sign. Naturally, many people worry: if I lose a credit card with a credit limit of several thousand or even tens of thousands of dollars, and someone picks it up and starts using it, wouldn’t I be the one stuck with the bill? Today, let’s talk about what causes credit card fraud, what to do after it happens, and how to prevent it.
Contents [Hide]
Why Unauthorized Charges Happen
Unauthorized charges can happen for many reasons, especially in the information age. Sometimes your card is still in your wallet, or it has been sitting unused at home, yet you still get a call from the bank asking about suspicious transactions. Here are some common reasons a credit card may be used fraudulently:
- The credit card was lost
- A merchant database was hacked or card data was sold
- Your personal information was stolen (Identity Theft)
The Credit Card Was Lost
This one is easy to understand. If someone finds your lost credit card, they may be able to use it at physical stores. Although merchants may ask to check your ID or signature after swiping the card, large merchants or small-dollar purchases usually do not involve carefully checking ID to confirm the name, and comparing the signature on the receipt with the signature on the back of the card is even less common. I have only had it happen twice: once at Toy R Us, where my card was declined because I had not signed the back, and once at Office Max, where the cashier carefully checked whether the signature I wrote matched the one on the back of the card. In both cases I was buying Visa gift cards, so that may have been why the clerks were more cautious.
If you only lose the credit card itself, fraudulent use will usually be limited to in-store purchases. That is because using a credit card online usually requires not only the card number, expiration date, and security code, but also your billing address. That information is obviously not printed on the card. Of course, if you lose your wallet and it contains your driver’s license or ID, then someone may be able to use that information on certain shopping websites, especially to buy digitally delivered products.
A Merchant Database Was Hacked or the Data Was Sold
In recent years, several merchants such as Target and Kmart have experienced database breaches. Hackers mainly target the credit card information merchants store. When we use a card at a merchant, the transaction data remains with that merchant. Even though the data is encrypted, once it is cracked, criminals may be able to recreate the magnetic stripe data and place it onto a blank card for in-store use. Of course, this method may not give them your full card number and security code, so this type of fraud is still more commonly used for in-person transactions.
There is another situation that also happens from time to time: some small merchants collude with card-theft rings and sell batches of customer card data after a transaction. For Chinese immigrants in the U.S., this is said to be especially common at some restaurants in Chinatown. Sometimes people discover that a card sitting untouched at home gets hit with fraudulent charges months after they used it there. A quick online search shows that many others have run into the same problem.
Personal Information Was Stolen
This situation is often more complicated. Maybe you lost your wallet. Maybe a bank database was breached. Maybe an institution that stores a large amount of your personal information was hacked. This is the most serious scenario, because all of your credit card information could be compromised. Worse, someone may even apply for credit cards in your name, and your information could potentially be used for criminal activity. So while credit card fraud may sound like a minor issue, it can sometimes turn into something much more serious.
What to Do After Fraud Happens
Contact the Bank and Report It Immediately
Whether you lost your credit card or wallet, or the fraud was caused by leaked data, the first thing you should do is contact the bank and tell them what happened. In most cases, the bank will immediately shut down the old card and issue you a new one. If you do not have the card number handy, you can still find the bank’s phone number on its official website. Call and report the card as lost, and you will usually be routed to the correct department. Be prepared to verify your identity with information such as your SSN, date of birth, billing address, verbal password, and so on.
Review Your Statements, Figure Out the Likely Cause, and Watch Other Cards
If you did not lose the physical card but still got hit with fraudulent charges, think about where you have used that card recently. For example, did you use it at a remote small shop, a Chinese restaurant, an unfamiliar online store, or a gift shop at a tourist attraction? If so, it is a good idea to monitor any other cards you used at that same merchant and see whether there are any unfamiliar transactions. Keep in mind that fraudsters often start with a small test charge so they do not attract attention, so check every transaction carefully.
Also, if there has recently been news about a merchant data breach, pay close attention to whether your compromised card was used there. In general, large merchants affected by breaches often offer some form of compensation. For example, after their breaches, Target and Kmart offered customers free identity monitor services to help watch for suspicious activity on their credit cards and credit reports.
Replace Other Cards That May Also Be Compromised
If, based on the previous step, you think your other credit cards may also have been compromised, you can call each card issuer and have those cards replaced as well. Keep in mind that issuing you a new card costs the issuer very little, but if fraudulent charges actually occur, the issuer may have to absorb losses and investigate the matter, which is far more expensive. So do not be afraid to ask for a replacement. A new card will usually have different magnetic stripe data, a different security code, a different card number, and a different expiration date. If the issue is not full-blown identity theft, replacing the card is often enough to stop further fraud.
Check Your Credit Reports and Monitor Your Personal Information
If you lost your wallet, or if an organization holding a lot of your personal information suffered a data breach, and then your credit card was fraudulently used or your credit history shows suspicious damage, you should immediately obtain reports from all three major credit bureaus and monitor your personal information. If your personal information was stolen, you may be able to get your credit reports for free. There are also many identity monitor products on the market now, so just choose one with a good reputation and a reasonable price. If you find that stolen information has caused serious harm, you should consider filing a police report.
Do You Have to Pay the Fraudulent Charges? No!
This is one of the main reasons I feel comfortable using credit cards in the U.S., and even recommend that people without an SSN apply for and use a debit card rather than rely on cash. Most U.S. banks offer a Zero Liability policy on credit cards, debit cards, prepaid cards, and gift cards (such as Master&Visa gift cards). The definition is as follows (source here):
- Zero liability policy: Major credit card issuers, concerned about public reactions to identity theft and fraud, have voluntarily adopted zero liability policies to product consumers. Zero liability policies go beyond the requirements of federal law, which limit individuals' out-of-pocket expenses to $50 if a credit card is lost or stolen and then used fraudulently. As the name implies, zero liability policies mean that consumers pay nothing if their cards or account information are stolen and used fraudulently.
In short, federal law says consumers are responsible for no more than $50 in fraudulent credit card charges, but banks waive even that $50. As long as the charge is unauthorized, the customer is not liable. So feel free to use credit cards with confidence: the bank is responsible for the fraud loss, and any fraudulent charges or related interest are not your responsibility.
How to Prevent Credit Card Fraud
Credit card fraud is hard to avoid completely. In most cases, we do not have to bear any responsibility for fraudulent charges, and replacing the card solves the problem. However, sometimes neither the bank nor we notice the fraud right away. If you never review your monthly statement and just keep paying the bill, you may end up unknowingly paying for a thief’s purchases. Below, we will look first at how merchants and banks try to prevent fraud, and then at what we can do ourselves.
How Merchants and Banks Prevent Fraud
For merchants and banks, the responsibility for fraud losses and the burden of investigating them usually fall on their side. Naturally, they do not want to eat those losses. That is why both merchants and banks have their own anti-fraud measures.
Merchants generally use the following methods:
- Check your ID against the name on the credit card
- Compare the signature on the back of the card with the signature you provide after swiping
- Ask for the last four digits of the card number (someone cloning magnetic stripe data may not have access to the last four digits)
Banks generally use methods such as:
- Checking whether a purchase happened far away from the city where you usually use the card
- Checking whether the activity differs from your normal spending habits, such as one large purchase or many small transactions
- Verifying transactions at merchants that are commonly associated with card fraud
So if you are asked to show ID, verify a signature, or confirm a transaction with your bank during a normal purchase, do not feel offended. These are simply standard anti-fraud procedures.
What We Can Do to Prevent Fraud
- Try to avoid using credit cards at very small merchants; use cash when appropriate. Before shopping online, check merchant reviews to make sure the site is trustworthy.
- Sign your name on the back of the card
- Set up text or email alerts for large credit card purchases
- If anything seems suspicious, call and request a replacement card
- If you see an unfamiliar charge, search online for that charge and see what others are saying about it