A credit card holder whose card number is stolen, while the physical card stays in the wallet, owes nothing for charges they did not authorize. The Federal Trade Commission’s consumer site puts it in one sentence: “You aren’t responsible for any charges you didn’t authorize.”
That rule covers the most common kind of card theft, where a thief gets the number from a data breach, a skimmer or a scam call and spends online. The wording is the FTC’s, and it applies to credit cards. Debit cards follow a different, stricter clock.
What the FTC says about a stolen number
The FTC’s page on lost or stolen credit, ATM and debit cards separates two situations. If only the number is stolen and the card itself is not lost, a credit card holder is not responsible for charges they did not authorize. The amount owed on those charges is zero.
If the card itself is lost or stolen and someone uses it before it is reported, the FTC says “the maximum you might be responsible for is $50.” The FTC page covers both cases for credit cards, and the difference between $0 and $50 is the difference between a stolen number and a stolen card.
Where debit cards are different
The same FTC page lays out stricter timing for ATM and debit cards, because the money leaves a bank account directly. If the card is reported before any unauthorized charges, there is no loss. Reported within 2 business days after learning of the loss or theft, the limit is $50.
Retirement deadlines, in your inbox: Miss an enrollment or claim deadline and the money can be gone. Join the Retirement Money Brief and we’ll send you our Scam & Identity-Theft Action Card as a welcome gift.
Get the Brief + the scam action card →
We may earn a commission from links on this page.
The limit rises to $500 if the report comes more than 2 business days after learning of the loss, but within 60 days after the statement is sent. After 60 days, the FTC says the loss can be “all the money taken from your ATM/debit card account,” and possibly more. The Consumer Financial Protection Bureau’s guide to unauthorized bank transactions repeats the first tier: a bank cannot hold a customer responsible for more than the amount of the unauthorized transactions or $50, whichever is less, when the report comes within 2 days.
What a cardholder does with a charge that is not theirs
The question for most readers is what they owe if a card number was stolen, and for a credit card the FTC’s answer is nothing for charges they did not authorize. That does not happen automatically, because the card issuer has to hear about the charge before it can remove it.
The FTC’s steps are short. Contact the bank or credit union that issued the card as soon as possible, by phone or in its mobile app, using the number on the statement or the online account. Then follow up in writing with the account number, the date the problem was noticed and the date it was first reported, and keep a copy of the letter and notes from each call.
Why statements matter even with a zero-liability rule
The FTC tells cardholders to check statements often and report any charge they do not recognize right away. For a credit card, the zero-liability rule protects the balance. For a debit card, the clock above decides how much of the bank account is at risk, and it runs from the day the statement is sent.
That gap is why a stolen number on a debit card is more urgent than on a credit card. Checking the statement line by line is how an unfamiliar charge gets caught while the 60-day window is still open.
The charge is removed, but the number is still out there
A card issuer that removes the charges will usually close the compromised number and send a replacement card. Any automatic bill that was tied to the old number, such as a utility, a streaming service or a pharmacy, will stop working until it is updated with the new one.
A stolen number can also be a sign of wider identity theft, because the same breach or scam call that exposed it may have exposed a name, address or date of birth. A free credit freeze with each of the credit bureaus is one way to block a thief from opening new accounts, and it does not change the zero-liability rule for the card.
Card number stolen: what happens in the first hour?
The FTC says a stolen credit card number costs nothing for charges that are not the cardholder’s, but the issuer has to be told, and the same theft can lead to a drained debit account or a new account opened in the cardholder’s name. Waiting to report is how a $0 problem turns into a larger one.
The Senior Fraud Defense & First-Hour Recovery Kit contains the first-hour recovery plan, a fraud evidence and report log for the calls and letters the FTC recommends keeping, and the free credit-freeze steps. Part 1 is a first-hour clock that puts the order of calls on one page.
Get the first-hour recovery kit with the fraud report log for a stolen card number →
More Financial Reading
- 21 Ways to Stretch a $2,087 Social Security Check
- 15 Places to Find Your Share of the $4.25 Billion States Give Back
- 15 Steps to Stop the Scams That Took $7.7 Billion From Seniors
This article was produced with AI assistance and edited for accuracy against the sources linked above.
