Scanning your credit card statement and spotting charges you know you never made is stressful and can be disorienting, especially if the card in question is still "safely" in your wallet.
The reality is that thieves don't need your physical card to use your account.
How do thieves get credit card numbers?
Unfortunately, there seems to be no limit to how thieves get their grubby hands on credit card numbers, but here are a few key ways to understand:
Data breaches. According to the Privacy Rights Clearinghouse, more than 10 billion records have been stolen from approximately 9,000 and counting data breaches since 2005 (that includes not just credit card numbers but passwords and passports). If you see a news headline about a data breach, it just means a hacker has accessed a corporation's database and stolen information, credit card numbers or something else, from it.
Phishing. That's when a crook emails you and tricks you into giving up your credit card or other personal information. For instance, the thief may try to convince you to click a button or link that takes you to a fake store with the hopes that you'll enter your credit card information in it and make a purchase.
Malware. This is a virus designed to exploit your device or programs. Depending on the virus, you could be typing in your credit card information to a store website or whatever, and that hacker somewhere in the world now has your credit card number, the expiration date, and, ah, yes, the three-digit security code.
Keylogging. Criminals sometimes will install software on your computer - either by sneaking into your office, or sending it via spyware (a type of malware that spies on your computer). Keylogging software allows a crook to see everything you type. That includes passwords and credit card numbers -- as well as all of the webpages you visit, whether a silly pop culture blog or some X-rated site you'd never want people knowing you go to, or your bank website. Phishing emails are an incredibly common way for keylogging software to end up on your device.
Credit card skimmers. It's a device that thieves put on a credit card and debit card payment terminal, often a gas station pumps or ATM. You run your card through to pay for your gas, and the skimmer stores your credit card information for the thief.
Simply seizing an opportunity. Restaurant workers have stolen credit card numbers when they have a card in their possession (it probably doesn't happen often, but you'll see stories about it in the news sometimes). You're at risk if you leave your credit cards in your hotel room, and if somebody who works there comes in (again, it probably doesn't happen often, but it can happen). In both cases, your card is technically still in your possession, but the damage is done.
And, of course, there are just old-fashioned opportunistic pickpockets who can swipe your wallet or steal a credit card that's in an envelope in your mailbox or steal a credit card financial statement from your garbage and the list goes on (thieves are, unfortunately, creative). Given that it isn't hard to find out a person's address these days, the numbers from your credit card are likely enough to make it possible for a thief to use your card account.
So keep those credit cards as close to you, as possible.
How do thieves use stolen card numbers?
They buy merchandise for themselves and to sell, often electronics and luxury items. If they have your physical card, they often sprint to a brick-and-mortar store and buy a bunch of stuff quickly - and then toss the card before they're caught or as soon as they max out the limit.
They also often buy gift cards with them, and then they buy stuff with the gift cards - or they'll sell the gift cards at a discount. It's no problem for them to sell a $50 gift card for $40. It isn't like they paid $50 of their own money for that $50 gift card.
Usually, crooks aren't stupid enough to do online shopping and send products to their house with a stolen credit card, but that doesn't mean they can't shop online and send the items elsewhere. Remember, too, that entering billing information isn't hard to do these days when most people's addresses and contact info are so readily available online.
Some criminals will handle the theft of your credit card number like a business - and sell it (and the thousands or millions of other credit card numbers that they have found) to other crooks.
Also keep in mind that your debit card isn't safe either, if somebody makes off with your wallet. You may think to yourself, "Well, nobody knows my PIN," but at many retail establishments, you can often still run your debit card as "credit," which can make your PIN useless.
What to do if your card details are stolen?
It's going to be a hassle to deal with a stolen credit card, but you can quick steps to ease the burden:
- Call the police (in some cases). If it's a situation where you were robbed or your wallet was taken, the police should be your first call. If it's that you were hacked and this was a completely non-violent theft, it's better go to Step #2. Customer service can advise you on whether you should call the police.
- Call your credit card issuers immediately. Chances are, they already know or have called you (credit card companies are pretty good at knowing, for instance, that you live where you live and that when somebody starts using your card 4,000 miles away, it probably isn't you). Tell the customer rep what has happened, and they'll put a stop to any more spending on your card or cards - and they'll send you replacements with new numbers.
- Consider putting a freeze on your credit. It's a drag to have to do this, but you could freeze your credit report, which should keep random strangers from getting access to your file. That's important because now a crook can't use your good name to get a loan - because the lender won't be able to check your credit report to approve the loan. If you, down the road, want to apply for a credit card or a car loan or whatever, you'll need to lift the credit freeze - and reestablish it, if you think you're better off with your credit report frozen. So how do you freeze your credit report? You alert each of the three main credit reporting firms: Equifax, Experian and TransUnion.
Can I find out who used my credit card online?
You probably can't - and really shouldn't try. What are you going to do? Go confront the thief and get yourself beat up or worse? Leave the Nancy Drew and Hardy Boys detective work to the credit card companies - and law enforcement.
What you can do, of course, is find out online what your credit card was used to buy - and where. But you knew that, and that's probably not making you feel any better right now, if you're the victim of a credit card theft.
How can you prevent this from happening to you?
There are several strategies you may want to try, to prevent your credit cards from being stolen. In no particular order, here we go:
- If you typically keep your wallet in your back pocket, in a big city, put it in your front pocket, making it impossible for pickpockets to remove your wallet. If you carry a purse, have it so that the strap is diagonally across your chest (it's much harder for a thief to grab it and run), or you could use a short-strapped purse, if you tuck it under your arm. And don't leave your purse anywhere, where somebody could rifle through it when you aren't looking, like in a grocery cart.
- Hopefully we've all gotten the memo by now, this deep into the 21st century, but make sure your computer has formidable anti-virus protection.
- To prevent your credit cards from being stolen by the rare rotten apple working at a restaurant or hotel, or from a pickpocket thief, you may want to leave your credit cards securely at home - and put the credit cards on your phone and pay that way. Just make sure your phone isn't stolen (or that it's properly locked).
- Check your credit card and bank statements regularly (every day is a good idea). The last thing you need is to not know that your credit card, or debit card, has been stolen, and for days or weeks to pass, with you blissfully unaware as to what's happened.
That fourth point is important, particularly when it comes to debit cards. Laws do a decent job of protecting credit cardholders from being on the hook for fraudulent purchases, but debit cardholders don't have the same protections. If your debit card is stolen, you could just be out all that money depending on how quickly your report the theft.
What are card companies doing to combat fraud?
A lot. If somebody spends money using your credit card, you aren't out much and probably nothing - the credit card company, however, is. So they have a lot of incentive to make sure that your credit cards aren't stolen. You need to try and do your part, of course, like having anti-virus protection on your computer and not leaving your wallet in your unlocked car where a thief might pass by.
All of the major credit card issuers, however, have been partnering with technological companies and employing artificial intelligence to come up with algorithms designed to detect credit card fraud.
Credit card companies are always working on new ways to prevent theft. The security code on the back of your card is one safeguard, and a popular method among some credit cards is to allow cardholders to use a lock feature that essentially turns off their credit card, so it can't be used, unless the cardholder wants to turn it on and use it.
Many credit cards issuers also monitor the "dark web," the part of the Internet that isn't indexed by search engines, like Google and Bing. That's where crooks often sell stolen credit cards.
So you might understandably be concerned about credit card theft, but it's the credit card executives and their tech teams who are likely losing sleep over this as laws are pretty explicit that the bank, not the cardholder, is on the hook for the lost funds in most cases.
Am I responsible for fraudulent credit card purchases?
A little, but odds are, you won't pay a dime, even if a thief spends thousands of dollars with your credit card. The Fair Credit Billing Act limits your liability for unauthorized use of your credit card to $50 - but the four major credit card networks (Visa, Mastercard, Discover and American Express) offer $0 liability if you have your credit cards stolen.
That's one argument for using credit cards over debit cards. If you miss the fact that your debit card was stolen and don't report it stolen for two or more business days, you could be liable up to $500. If somehow two months goes by, and then you realize you had money stolen from you via your debit card, you may be liable for all of your losses.
So the odds are pretty good that you will not be paying anything if your credit cards are stolen. That said, you do want to act fast if they are. You don't want shady people doing who knows what with your credit card - and if they have other personal information of yours, like your Social Security number, your problems are just starting, and stolen credit cards are, in a way, the least of your problems.