What does credit card fraud look like, from test charge to dispute?
One illustrative night at an online headphone shop shows how a thief would commit card fraud.
- 02:10. Dozens of $1 authorizations hit different card numbers from one device. Most fail; the rest are live cards.
- 02:55. Three live cards each buy $640 headphones, shipped to a forwarding address.
- Day 30. The cardholders dispute the charges. The issuer refunds them and charges the sales back to the shop.
The shop loses $1,920 in goods plus shipping. Under Visa's rules, the issuer has 120 calendar days from the processing date to raise a fraud dispute on a card absent sale (Visa Core Rules, April 2026, condition 10.4). Step one is a warning sign the Office of the Comptroller of the Currency (OCC) lists: small authorizations that "test" an account before larger spending.
What is credit card fraud, and what is it not?
Credit card fraud is one of the main types of fraud. The OCC defines it as "the unauthorized use of a person's credit card or debit card to make purchases or withdrawals" (OCC). It happens with the card present, at a till or an ATM, or with the card not present, when only the details are used. Disputing a purchase the cardholder did make is a different problem, chargeback fraud.
Table 1. Credit card fraud and the terms next to it.
| Term | What happens | Who loses first |
|---|---|---|
| Credit card fraud | A card or its data is used without the cardholder's permission | The issuer or the merchant; the cardholder's share is capped (Table 3) |
| Card not present fraud | Stolen card details are used online, by phone or by mail | Usually the merchant, through a chargeback |
| Skimming | A device copies card data at an ATM or a point of sale terminal | The issuer, when the cloned card is used; the merchant if its terminal did not read the card's chip (Visa's EMV liability shift, condition 10.1) |
| Chargeback fraud | A cardholder disputes a purchase they did make | The merchant |
| Account takeover | A criminal takes control of an existing card account | The issuer, or the cardholder if grossly negligent |
| Identity theft | A person's details are used to pose as them, often to open accounts | The person named and the lender |
Is debit card fraud the same thing?
In method, yes; what differs is whose money moves. A credit card charge sits on the issuer's credit line until it is disputed under the Fair Credit Billing Act (FCBA), while a debit charge leaves the cardholder's account at once. Under Regulation E, a US debit cardholder who reports within two business days pays at most $50, and up to $500 after that.
How is it different from identity theft?
Identity theft uses a person's details, such as a Social Security number (SSN), to pose as them; credit card fraud uses card data. They meet in application fraud, when a stolen identity opens a new card account.
What are the warning signs of credit card fraud?
Red flags for a cardholder:
- a charge they do not recognize;
- a small charge from an unknown merchant, often a test;
- a call from the bank about a payment they did not make.
Merchants and issuers see runs of declined authorizations, several cards tried from one device, and disputes weeks after the sales.
From Burçak Aydın, author of this entry: "Card testing shows up as a burst of tiny authorizations on many cards from one BIN range or one device, minutes before the real spend. Issuers and merchants block on that pattern, not on any single amount."
Before onboarding a seller, a payment firm can check a merchant or counterparty for fraud news free.
What are the main types of credit card fraud?
Table 2. Card fraud types counted by UK Finance, UK issued cards, 2025.
| Type | How it works | 2025 UK losses | Example on this page |
|---|---|---|---|
| Remote purchase (card not present, CNP) | Stolen card details used online, by phone or by mail | £423.5m | Operation Chargeback; Gurugram call center |
| Lost and stolen (card present) | A lost or stolen card used in a shop or at an ATM | £109.8m | None |
| Card ID theft: application fraud and account takeover (ATO) | A new card opened in a stolen identity, or an existing account taken over | £54.0m (£16.1m and £37.8m) | US ring (application fraud) |
| Counterfeit | A cloned card made from skimmed data | £4.7m | Dallas skimmers |
| Card not received | A new card stolen before it reaches the cardholder | £2.8m | None |
UK Finance, the UK banking trade body, uses these five categories. Remote purchase fraud took £423.5 million of the £594.9 million lost in 2025, across 3,196,962 cases at an average of £132 (UK Finance, Annual Fraud Report 2026, 15 June 2026). Lost and stolen cards came second.
How do criminals steal card details?
Delhi Police said insiders at a Gurugram call center leaked customer data, and callers posing as bank executives tricked cardholders into revealing one time passcodes and CVV codes (New Indian Express, 17 August 2025). In Dallas, officers found 115 skimmers and more than 300 cloned payment cards (CBS Texas, 22 July 2025). Insider leaks, phone scams and skimming are three techniques; UK Finance's report adds data breaches (page 28).
How common is card fraud?
In the UK, 3,775,687 card fraud cases cost £594.9 million in 2025, almost level with £592.5 million in 2024, and a further £1,333.3 million was prevented (UK Finance, 2026). Country comparisons are in which countries report the most fraud. complead, formerly Sanction Scanner, reviews the wider year in its 2025 to 2026 Financial Crime and Compliance Report.
What are real examples of credit card fraud?
Three real life examples, each with its type:
- Operation Chargeback, Europe (card not present). On 4 November 2025, police acted against three networks that allegedly misused card data of over 4.3 million cardholders in 193 countries. From 2016 to 2021 they allegedly set up about 19 million fake online subscriptions, billed at around EUR 50 a month under obscure descriptors. Europol estimates the damage at over EUR 300 million (Europol, 5 November 2025).
- A three state ring, US (application fraud). Members used counterfeit driver's licenses to obtain "over $450,000 in fraudulent credit card accounts" at retail chains in 2018 and 2019 (US Secret Service, 26 May 2021).
- A Gurugram call center leak, India (remote purchase). Eighteen arrests in August 2025 over nearly Rs 2.6 crore, spent on electronic gift cards.
Operation Chargeback is where a card case meets the anti money laundering (AML) team. Europol says the networks allegedly used four German payment service providers and shell companies with fake directors and KYC documents. Executives and compliance officers are among six suspects accused of colluding; the charges include money laundering.
Which laws apply, and who pays for a fraudulent charge?
Payment law caps the cardholder's share.
Table 3. What the cardholder pays for an unauthorized charge.
| Rule | Applies to | Cardholder pays at most | When that changes |
|---|---|---|---|
| US: 15 U.S.C. 1643 and Regulation Z, 12 CFR 1026.12(b) | Credit cards | $50, before the issuer is told | Never higher; nothing after notice |
| US: Regulation E, 12 CFR 1005.6(b) | Debit cards | $50 if reported within two business days of learning of the loss | Up to $500 if later; no cap on transfers after 60 days from the statement |
| UK: Payment Services Regulations 2017, reg 77 | Cards and other payment instruments | £35 | All losses if fraudulent or grossly negligent; nothing after notice or where strong customer authentication was required and not applied |
| EU: PSD2, Article 74 | Cards and other payment instruments | EUR 50 | All losses if fraudulent or grossly negligent; nothing if the loss was undetectable to the payer |
A stolen card used for $900 costs a US credit cardholder $50 at most, and a debit cardholder who reports a week late up to $500. Card fraud proceeds also bring in money laundering law, covered for UK firms in AML rules in the UK.
What is the penalty for credit card fraud?
The legal consequences for the thief:
- United States. 18 U.S.C. 1029 covers counterfeit cards, unauthorized cards used for $1,000 or more in a year and holding 15 or more such cards: up to 10 years, 15 for some offenses, 20 after a prior conviction.
- England, Wales and Northern Ireland. The Fraud Act 2006 allows 10 years for fraud (section 1), 5 for possessing articles for use in fraud (section 6) and 10 for making or supplying them (section 7).
- European Union. Each member state sets its own penalties, within the floor that Directive (EU) 2019/713 on fraud and counterfeiting of non-cash means of payment sets for maximum prison terms.
Who catches credit card fraud, and how?
The issuer, the bank behind the card, sees every authorization and handles disputes. The acquirer, the merchant's bank, watches dispute rates, while the merchant checks the billing address through the address verification service (AVS), the CVV and 3D Secure, and the card network writes the dispute rules. Under Visa's, a counterfeit dispute is invalid when the chip was read, so the loss stays with the issuer, and the issuer must report the fraud to Visa before it disputes. At the issuer, models score each authorization and rules approve, decline or ask for a one time passcode (OTP), one factor of multi factor authentication (MFA). Analysts review the rest. This is the work of payment fraud detection.
PCI DSS, the card industry's security standard, covers any environment where card data is "stored, processed, or transmitted" (PCI SSC). Fraud detection and prevention covers how firms build these checks.
What should you do if your card is used without permission?
A victim should respond in this order:
- Call the issuer to report the charges and block the card; with a US debit card, within two business days.
- In the US, the OCC advises a fraud alert with a credit bureau and a report to the FTC at IdentityTheft.gov.
- In the UK, report to Report Fraud, which took over from Action Fraud on 4 December 2025 (ONS, 23 July 2026).
A merchant still has to choose which test pattern to block. A debit cardholder has a deadline instead: two business days keep the loss at $50.
Related terms
- Card testing. Small authorizations that check which stolen numbers work, often from one bank identification number (BIN) range.
- Chargeback fraud. Disputing a purchase the cardholder did make, to get the money back.
- Credit fraud. The wider term: getting or using credit by deception, such as a loan or card account opened in a stolen or false identity.
