What Should I Do If My Credit Card Gets Hacked?

Step 1. Call the Credit Card Company

This is the very first step to take (so kudos on acting quickly). In some cases, your liability for fraudulent charges depends on how soon you report them to the bank. Besides that, the sooner you notify the bank, the quicker they can start working on your case and getting this resolved.

During the investigation, the credit card company will usually reverse the charges (so you won't have to pay for some stranger's $5000 shopping spree on your billing statement). They should also issue you a new card (with a new account number) and close the old one so further fraudulent charges can't be made to it.

When you get your new card, remember to update any accounts where the card is used for automatic or recurring billing.

This process should only take a couple of days (sometimes just one day waiting for the new card), but in some cases it could take a month to resolve.

Step 2. Monitor Your Credit Card Accounts

In most cases, putting a stop to the charges and getting a new account number are all you need to do, but you should also monitor all your credit card accounts just in case this is more than just a singular event or a sign of even more damaging identity theft.

To monitor your accounts, you just need to keep an eye on your statements or regularly check recent activity. Be especially on the lookout for even small charges. Fraudsters know that amounts under $10—like the recent $9.84 scam—often go unnoticed.

There are also other easy ways to stay vigilant, long after your credit card fraud case is resolved:

Set up activity alerts on your accounts. Most bank and credit card online accounts let you set text or email alerts for all kinds of activity, such as charges over a certain limit.
Use free financial tracking apps. Previously mentioned BillGuard watches for charges flagged by other BillGuard members, and notifies you if your card(s) have similar ones; it also now tracks your finances, Mint-like. Speaking of Mint, the financial tracking app can also alert you to unusual activity on your accounts. If you usually only spend $50 a week on shopping, for example, Mint will let you know if a charge greatly exceeds that. (If you're—understandably—concerned about security for these credit card and bank tracking services, know that both use bank-level encryption and only have read-access to your account activity, so money transfers and changes to your account aren't possible even if someone could hack into one of those accounts.)
Use free credit monitoring services. Previously mentioned Credit Karma and Credit Sesame keep an eye on not just your credit score, but also new credit inquiries and balance changes. (Credit Sesame's report is from Experian, while Credit Karma provides scores from TransUnion.)

Step 3. Know the Signs of Bigger Identity Theft—and What to Do If Someone's Stolen Your Identity

Fraudulent charges on your credit card don't necessarily mean a data thief also has access to other personal information that could do more damage, like drawing down your bank account or social security fraud, but it still pays to know how identity theft works so you don't end up with even bigger issues.

To clarify: Credit card fraud is a form of identity theft that happens when the thief uses your card number to buy things. That can happen when someone gleans your credit card number (and signature) from a receipt, gets access to any other document with your account number on it, or your card comes into contact with fake ATM or other skimmers.

Even more debilitating identity theft happens when someone uses your personal information (which can include your credit card number) to not just make charges, but also perhaps open other financial accounts, get government documents, and/or otherwise impersonate you for their benefit. It's even less funny than the Jason Bateman movie Identity Thief and can be terribly expensive and trying to repair.

(If there's any silver lining to your credit card fraud experience, it may be that kick in the butt to check if any of your other information is compromised. According to Daily Finance, most people don't spot identity theft on their own; most of the time, financial institutions notify the victims. 20 percent of people do find it after spotting fraudulent charges on their statements, but only 8 percent of other identity theft victims discover the fraud themselves.)

Besides suspicious credit card charges, identity theft red flags include: withdrawals from your bank account that don't make sense, applications for credit or other accounts being turned down, collection notices for debts that aren't yours, and unfamiliar accounts on your credit report (which you can check for free every year at annualcreditreport.com). See a whole list of red flags at the Identity Theft Resource Center.

Place a fraud alert or credit freeze with the three credit bureau agencies(Experian, Equifax, or TransUnion). A credit freeze is generally more foolproof, as it usually stops all access to your credit report, whereas a fraud alert simply requires more verification of your identity before granting credit in your name. There may be a cost to place or lift the freeze, though, depending on your state laws. Learn more about these two protections at the FTC.
Review your credit reports from the three bureaus. If you placed a fraud alert or credit freeze, you should get a free copy. Dispute all inaccuracies.
File a police report and a report with the FTC. Depending on the nature of the identity theft, you might need records of the police report and information you report to the FTC to show creditors and others proof of the crime.
Contact any company that might have been affected. For example, if your Social Security Number might have been compromised, contact the Social Security Administration and the IRS. Also contact companies that have a fraudulent account open in your name to have the account frozen.
Keep good records of each communication with creditors, credit reporting agencies, and other companies while trying to fix this problem.

What about identity theft protection services? In general, the ones offered by credit card issuesaren't worth the money. The Wall Street Journal notes that third-party services like LifeLockand Trusted ID will run you at least $150 a year, but their most common tactics are setting up fraud alerts and credit freezes on your credit reports—things you can do yourself. (Note, however, that if you were a victim of a breach, like the Target one, you could be eligible for free credit monitoring, in which case go ahead and use it.)

Step 4. Stay Safe Going Forward

Most people never find out exactly how their credit card numbers (or other personal information) got into the wrong hands. While some things, like data breaches, are beyond your control, there are several things you can do to minimize your security risks.

Only shop on secure HTTPS sites belonging to merchants you trust (we recommend using the HTTPS Everywhere extension for Firefox, Chrome, and Opera).
Use virtual credit card numbers if your bank offers them—or consider switching to one. A virtual number hides you actual account when you shop online and can also limit additional charges.
Don't save your credit card information with online merchants. This is a hassle, because you have to enter the card manually every time you shop online, instead of saving the card in the account, but it's an extra precaution that could give you more peace of mind.
Make sure your computer is up-to-date with anti-malware protection. Ourfavorite for Windows is Avast, but we also recommend occasionally manually running another anti-malware tool like Malwarebytes Anti-Malware to catch and fix anything that's slipped through.
Check ATMs and other card readers for signs of tampering. These includeobscured flashing lights on a reader, cameras above the machine, or loose keypad or other parts. You should also always cover your hand when you enter your PIN in the machine
Consider getting a RFID-blocking wallet. Thieves can scan your cards that have radio-frequency identification chips (RFID) without you even noticing. There are lots of RFID-blocking wallets you can buy or you can make your own(even an Altoid tin could work).
Never give our your social security number unless you trust the organization and know it's necessary (for example, for your tax forms).
Shred all sensitive documents before you toss them out, and keep those you can't shred safely locked up. (If you've gone paperless, make sure those files are encrypted on your computer.) Sensitive documents include financial account statements, medical information, anything with your social security number on it, tax documents, and so on. source