Credit Card Fraud: What It Is, How It Happens, and How It Shows Up

Last updated October 7, 2026 · 1,313 words · Identity Theft

Credit card fraud is the unauthorized use of a credit card, card number, or card account to obtain money, goods, or services. It can happen through lost or stolen cards, data breaches, skimming devices, phishing messages, or an account opened in your name with information someone else obtained.

This guide is general educational information for U.S. readers. It is not financial advice and does not describe your individual credit file. Figures such as score ranges and timeline estimates are typical examples, not promises.

Key takeaways

• Credit card fraud covers both unauthorized transactions on an existing account and accounts opened in someone else's name.
• Most cases begin with card data rather than a physical card, including breaches, skimming, phishing, and account takeover.
• Credit scores are calculated from credit report contents, so fraud reaches a score only through the accounts and payment records it creates.
• The FCRA gives consumers the right to a free credit report from each nationwide agency every 12 months, and the agencies currently provide free reports weekly through AnnualCreditReport.com.
• An initial fraud alert lasts 1 year, an extended fraud alert lasts 7 years, and a security freeze is free to place, temporarily lift, or remove under federal law.
• Identity theft can be reported at IdentityTheft.gov and to the IRS using Form 14039.

Credit card fraud is any unauthorized use of a card, a card number, or a card account. Two broad forms exist: misuse of an account the holder already has, and misuse that creates an account in someone else's name. Both can leave entries in a credit file even when the account holder did nothing wrong.

What is credit card fraud?

Credit card fraud is the use of a credit card, card number, or card account to obtain money, goods, or services without the account holder's authorization. When someone else's personal information is involved rather than a card number alone, the same event is handled as identity theft. The two overlap constantly, and one incident can involve a card issuer, a merchant, a payment processor, and a credit reporting agency at the same time.

Two features separate fraud from an ordinary billing dispute. First, no authorization was given by the account holder. Second, the transaction or account was created to obtain value — merchandise, cash, a service, or credit that was never intended to be repaid. A duplicated charge or a forgotten subscription is a dispute, not fraud.

Types of credit card fraud

These categories overlap. A breach at one company can supply the numbers used for card-not-present fraud weeks later, and a number that survives a small test charge may be used for a larger purchase. The distinction matters mainly because the reporting path is different: transactions on an existing account are handled by the card issuer, while an account the consumer never opened is handled as identity theft.

How does credit card fraud happen?

Most credit card fraud begins with data rather than with a missing wallet. A card number becomes usable once someone has the account number, the expiration date, and often the security code or the billing address. The most common paths are:

1. Data breaches. A merchant, payment processor, or account provider is compromised and stored payment records are exposed.
2. Skimming and shimming. A device placed on a card reader or inside a terminal copies magnetic-stripe or chip data.
3. Phishing and smishing. Email, text, or phone messages imitate a bank, delivery company, or retailer and request card details or one-time codes.
4. Mail theft. A new or replacement card is intercepted before it reaches the account holder.
5. Credential reuse. A password used on several sites is used to sign in to an issuer's website or app, which is the opening step of many account takeovers.
6. Application fraud. Someone applies for credit using another person's name, date of birth, and Social Security number.
7. Insider misuse. An employee with access to payment records copies them.

Issuers and payment networks screen transactions for patterns that do not match an account's usual activity, and they can decline or flag a purchase. Detection generally follows the first unauthorized charge rather than preventing it, which is why the timing of an account review matters as much as the amount charged.

What happens after fraud is reported

Once unauthorized use is reported, the card issuer typically closes or reissues the account and opens an investigation. Under the Fair Credit Reporting Act (FCRA, 15 U.S.C. section 1681), a credit reporting agency generally must investigate a dispute within 30 days; the period can extend to 45 days if the consumer provides additional information during the initial 30-day period.

The FCRA also provides two standing controls. Section 605A (15 U.S.C. section 1681c-1) covers fraud alerts, which direct lenders to take reasonable steps to verify a consumer's identity before extending credit; an initial fraud alert lasts 1 year and an extended fraud alert lasts 7 years. Section 605B (15 U.S.C. section 1681c-2) covers blocking information that resulted from identity theft. A security freeze, which restricts access to a credit file, is free to place, temporarily lift, or remove under federal law.

The FCRA was enacted in 1970 and amended by the Fair and Accurate Credit Transactions Act in 2003. The Consumer Financial Protection Bureau, created by the Dodd-Frank Act in 2010 and operating since 2011, publishes consumer guidance on fraud and scams.

If a Social Security number or other identifying information is misused, the event can be reported at IdentityTheft.gov and to the IRS using Form 14039. The FTC maintains a central identity theft resource, and the CFPB explains how fraud and scams are reported and tracked.

How fraud reaches a credit report and a credit score

Credit scores are calculated from the contents of a credit report, not from a fraud flag on an account. Most credit scores, including FICO and VantageScore, use a range of 300 to 850. FICO publishes approximate factor weights: payment history 35%, amounts owed 30%, length of credit history 15%, new credit 10%, and credit mix 10%. VantageScore uses its own factor weighting and does not publish fixed percentages. The guide to how credit scores are calculated covers each factor in more detail.

Fraud therefore reaches a score indirectly. An unauthorized account that goes unpaid can produce late payments, and a fraudulent account carried near its limit can affect the amounts-owed factor, which is the same measurement described in the guide to credit utilization. Most negative information, including late payments, stays on a credit report for 7 years. A Chapter 7 bankruptcy stays for 10 years and a Chapter 13 bankruptcy for 7 years. Hard inquiries typically remain for 2 years.

Reviewing a credit report from each of the three nationwide credit reporting agencies — Equifax, Experian, and TransUnion — is how unfamiliar accounts and inquiries surface. The FCRA gives consumers the right to a free report from each agency every 12 months, and the three agencies currently provide free reports weekly through AnnualCreditReport.com.

Detection and account controls

Three controls are commonly discussed together, and they do different jobs. A fraud alert signals to lenders that identity verification is required before credit is extended. A security freeze blocks access to a credit file until it is lifted. Credit monitoring is a commercial service that reports changes in a credit file, such as a new account, a new inquiry, or an address change, after those changes appear; it does not prevent fraud and it does not block access to the file. A credit lock is a similar control offered directly by a credit reporting agency, generally through a mobile app and governed by the agency's own terms rather than by statute.

Because a fraudulent application often shows up only as a new inquiry or a new account, and because hard inquiries typically remain on a report for 2 years, records of credit checks the consumer did not initiate are worth reviewing alongside the accounts themselves. The same records feed the credit profile that lenders and scoring models evaluate.

Fraud that involves a stolen identity rather than a stolen card number is covered in more depth in the identity theft section, including how alerts, freezes, and dispute rights work together after a report is filed.

This page is published for education only and is not financial advice.

Frequently asked questions

Related guides

• How Credit Scores Are Calculated
• Credit Utilization Explained
• Credit Score Ranges Explained
• Fico Vs Vantagescore
• Payment History And Credit Scores
• Length Of Credit History Explained

Related terms

• Credit Card Fraud
• Identity Theft
• Account Takeover
• Fraud Alert
• Security Freeze
• Card Not Present Fraud
• Credit Monitoring
• Data Breach

Sources

• FTC
• CFPB