Your Credit Card Was Stolen -- Did They Take Your Identity, Too?

Imagine you're about to pay your credit card bill. Before you do, you check over your card statement and notice charges that aren't yours.

If you still have your physical credit card, then it could mean a criminal got their hands on your credit card number, expiration date and other important information.

Fortunately, credit cards have built-in fraud protection, so you can report fraudulent purchases and have them removed from your account. Not only that, but federal law limits liability for credit card fraud to $0 for stolen card numbers and $50 when fraud is reported after someone's physical card is stolen. 

Unfortunately, credit card fraud is incredibly common. There were more than 24,000 instances of credit card fraud reported to the Federal Trade Commission (FTC) in the third quarter of 2024 alone. However, if one aspect of your identity was compromised, does that mean the thieves have it all?

Is credit card fraud a sign of identity theft?

While credit card fraud can make you feel like your identity has been stolen, that's not always the case. 

Michael Bruemmer, vice president of Experian data breach resolution and consumer protection, said credit card fraud can happen on its own or as a result of identity theft. 

There are two types of credit card fraud: One that happens when an existing credit card account is used to make unauthorized purchases and one that occurs when a person's information is stolen and then used to open a new credit account.

If a criminal uses a skimmer to steal a consumer's credit card information, for example, it's fairly likely the credit card details are all they have. The same may be true if someone has their card details stolen after using an unsecured or fake website to make a purchase.

However, if the thieves also get access to your account and personal information like your Social Security number, there's a greater danger of identity theft.

If someone has your credit card information, what else might they have?

The information a criminal has after committing credit card fraud will typically depend on how they accessed your credit card details. 

Data breach

Someone who accessed your credit card account details through a data breach might also have your Social Security number, email passwords or other sensitive information.  

Phishing

When criminals send out fake texts or emails that lure consumers into sharing sensitive personal information, the fraudsters can get additional personal details, including credit card numbers, Social Security numbers and account login information.

Skimming

This typically happens when criminals install a physical device on credit card readers that copies a consumer's credit card information. Credit card fraud that results from skimming devices typically means criminals have your PIN number (if you used one) and other card-related information. 

Account takeover

When a criminal obtains account login information and passwords to your account, fraudsters can then change the billing address so they can report a card lost or stolen and obtain a credit card in your name. If they obtain your credit card information through an account takeover, the thieves might have access to other online accounts you have and other personal data.

What to do if your credit card information is stolen

If you believe your credit card details have been stolen or you have already had fraudulent purchases show up on a credit card you have, the first thing you should do is call your credit card issuer to notify them. They will typically cancel the card number for that account and send you a new card with new details.

Other steps to take include:

• Look over your credit reports regularly. Bruemmer recommends checking your credit reports regularly for activity you don't recognize, and to confirm the accuracy of the information. You can access your reports with all three major credit bureaus (Experian, Equifax and TransUnion) for free at AnnualCreditReport.com.
• Report the fraud to the credit bureaus. Immediately report fraudulent purchases on your card to the three credit bureaus, who can add fraud alerts to your accounts. By setting up a one-year fraud alert with each credit bureau, creditors will be encouraged to reach out to you to verify your identity before allowing new accounts to be opened in your name.
• Freeze your credit reports. You can also freeze your credit reports with all three credit bureaus. This ensures nobody can open new accounts in your name -- even you. Note that you can temporarily unfreeze your credit reports if you need to apply for a credit card or a loan.
• Use a credit monitoring service. These services monitor the dark web for any of your personal information and will alert you to any new credit accounts opened in your name. There are both free and paid services, like Aura.

You can freeze your credit reports with the major credit bureaus at the links below, or call them.

• Experian -- (888) 397-3742
• TransUnion -- (888) 397-3742
• Equifax -- (888) 909-8872

You can also sign up for a free credit monitoring service like Capital One's CreditWise, and let your bank or card issuer know your information was compromised.

How to help keep your personal information secure

Once a thief gets their hands on your credit card number and other sensitive information, it's likely only a matter of time until they use it. 

Your best bet is to keep your information safe and secure so that it doesn't happen. The following steps can help.

• Secure your devices. Set up antivirus software on your home and personal devices, and make sure to update all computer software you use regularly. Only visit secure sites, indicated by the "https://" at the beginning of the URL.
• Use strong passwords. Set up and use strong passwords that criminals won't be able to guess, and never use the same password twice. A password manager can both generate secure passwords and save them for you to simplify the process.
• Enable multi-factor authentication. Multi-factor authentication requires you to input a unique code sent via text or email before you can access your account.
• Choose the right security questions. Set up strong security questions only you would know the answers to.
• Keep your account numbers private. Do your best to keep your card in your possession at all times, and be suspicious of emails or texts you receive that ask you to log into an account or share your card details. If you do need to log into an account or pay for something with your credit card, go directly to the site instead of "clicking through" an email or text message first.
• Use a virtual credit card. A virtual card number replaces the physical number on your card with a unique number to use while shopping online. This can help prevent bad actors from accessing your card info.
  

Consider signing up for identity theft protection to keep your personal information more secure. Aura is CNET's pick for the best identity theft protection service.

Aura

CNET's pick for the best identity theft protection service

See at Aura

Protect your personal data and get peace of mind with CNET's top pick for identity theft software.

See at Aura