It’s become a sad reality of the modern world: Someday, your credit card information will fall into the wrong hands. Maybe hackers will compromise the number in a large data breach like the recent one at Newegg.com. Or maybe you’ll get unlucky and leave the plastic in the grocery store checkout line. (Even if someone returns a lost card, you should assume the information on it has been compromised.)
Either way, you’ll need to take immediate action. Here’s what to do if someone gains access to your credit card information.
Reach out to the credit card company
“The most important thing you can do is act rapidly,” says Rod Griffin, director of consumer education and awareness at credit bureau Experian.
As soon as you suspect your card may be compromised, log into the website of its issuer and check your statement for any unauthorized transactions. Then give your credit card issuer a call—you’ll find the customer support number on the back of the card (if you still have it) or on the website. You should reach out even if you haven’t noticed any suspicious activity—just because no transactions have shown up yet doesn’t mean they won’t appear soon.
Once you let the company know your information has been stolen, they’ll likely cancel the card and send you a new one. If the thieves made any unauthorized transactions, you’ll have to walk through these items with the issuer. If your card number, rather than the plastic itself, was stolen, you won’t be liable for those charges. Similarly, if you report the theft before any charges are made, you won’t be liable. Unfortunately, if neither of those situations apply to you, you might be on the hook for up to $50, but it depends on the card issuer’s policy—some may not charge you anything.
Keep in mind that those rules only apply to credit cards—debit cards do not have the same protections. This means the later you report the theft, the more money you’ll be responsible for.
Once you’ve made your initial contact, your next step depends on whether your card was part of a larger-scale breach. If so, you’ll receive a breach notice with a list of next steps you should follow.
“The breach notice will give you instructions for working with the organization that had the breach,” says Griffin. “They may also offer free identity theft monitoring services, which can help alert you to this use of your information so you can take action immediately.”
In fact, you may also ask your credit card company about identity theft monitoring services, as they may already offer a similar service that sends you an email or text message you when suspicious charges appear.
Depending on the situation: Check your credit report
“In most cases, when your credit card number is stolen, they aren't really interested in your identity,” says Griffin. “They want to take that card, use it to make some purchases, and then disappear—not perform other sorts of financial frauds.” Unfortunately, that’s not always the situation.
If you suspect that the thieves might have other personal information of yours—especially something private like your social security number—you’ll want to keep an eye out for larger-stakes identity theft.
If that possibility worries you, you should request a copy of your credit report. Ensure you don’t see any newly-opened accounts that don’t belong to you, and then add a one-year fraud alert to it. This forces lenders to undergo extra identity verifications before they open a new account in your name. The fraud alert can be annoying—it will slow down the process if you’re trying to open a new account for yourself—and it isn’t imperative every time this happens. Still, it may be a worthwhile protection.
“We recommend you get your credit report at least once every 12 months anyway, to make sure everything is what it should be,” says Griffin. “You can do that free at annualcreditreport.com, which is the federal free credit report site.”
Note that your credit report does not include your credit score, which isn't particularly important in this scenario. If you want to check your credit score as well, you can do so separately by contacting one of the three bureaus. Just make sure that in doing so you don’t automatically sign up for any credit-monitoring services you don’t want, as these may charge you monthly fees.
Final clean-up
Once you’ve contacted the credit card issuer (and possibly protected your credit), the company should send you a new card in the mail. Then it’s time to perform a few final tasks.
Even though your old card was cancelled, you should still destroy it. Because it contains personal information, dumpster divers could use it for identity theft (just like much of your other trash). Cut it up into multiple pieces or shred it with a cross-cut shredder. If your card is made of actual metal, request an envelope from the credit card company, ship it back to them, and they’ll destroy it for you. Or, if the issuing bank has a physical branch near you, you may also be able to take it to them for destruction.
Finally, don’t forget to enter your new credit card number on any recurring bills, such as your cable subscription, Netflix account, and so on. Some companies, like American Express, can automatically redirect those recurring charges to your new card, but it’s still a good idea to change the numbers as soon as you have the option.
And if you weren’t already checking your credit card statements regularly, start a new habit. “You need to monitor your billing statements,” says Griffin. “You'll see signs of fraud there before you will on your credit report.” This early detection can prevent the larger hassles that ensue if a thief goes unnoticed.