Card-Not-Present Fraud: When Your Card Is Used Online
Your card is in your wallet, but someone is spending with it online. Where card numbers leak, how card-not-present fraud works, and how to spot it and limit the damage.
Card-not-present fraud happens when someone uses your card details online or by phone, without ever holding the card. You may not notice until an alert or statement shows purchases you did not make.
Where card details leak
- Phishing: fake payment pages for deliveries, subscriptions or fines. See fake login pages.
- Fake shops that take your card and send nothing. See checking a website.
- Data breaches at retailers. See data breaches.
- Malware on your device. See password-stealing malware.
- Photos of your card shared or seen.
Signs
- Small test charges, often from unfamiliar merchants.
- Alerts for purchases you did not make.
- Codes arriving for online payments you did not start.
Limit the damage
- Freeze the card in your app and call the issuer.
- Dispute the charges. See disputing a transaction.
- Get a new card number.
- Use virtual cards for online shopping in future. See virtual cards.
Related: spotting unauthorised charges early. For more, see how to protect your money.
Frequently asked questions
How can someone use my card if I still have it?
Online purchases only need the card number, expiry date and security code, which can be stolen through phishing, data breaches or malware.
Am I liable for the charges?
Protections vary by country and card type, but most issuers protect you from fraudulent charges if you report quickly.
Should I get a new card?
Yes. Ask your issuer to cancel the compromised card and issue a new number.
Sources
- Using Credit Cards and Disputing Charges, US Federal Trade Commission
- Credit Card Loss Protection, US Federal Trade Commission
- How To Recognize and Avoid Phishing Scams, US Federal Trade Commission
