Credit card fraud: what happens after the call

You called the bank. You reported the fraud. The representative said they'd handle it. Then the call ended, and you're sitting there wondering what actually happens next.

Most fraud advice stops at "call your bank immediately," as if the rest takes care of itself. It doesn't. The call triggers a multi-step process involving fraud analysts, payment networks, merchants, and sometimes law enforcement. You're not a passive observer in this process. You have specific obligations, deadlines, and decisions that affect whether you get your money back and how quickly.

This is the practical guide to what happens after you report credit card fraud. Here's the timeline, the behind-the-scenes mechanism, and what you need to do at each stage to protect yourself.

The first 24 hours: immediate account actions

When you report fraud, the bank's first action is defensive. They freeze the compromised card number immediately. This doesn't close your account. It prevents any new charges from processing on that specific card number while keeping your account active.

Within minutes, the bank's fraud detection system flags all recent transactions on that card for review. If you reported specific fraudulent charges, those get marked for dispute. If you said "I don't recognize anything after Tuesday," the system flags everything from Tuesday forward.

You receive a case number. Write it down. This number is your reference for every future conversation about this fraud. Without it, you're starting from scratch each time you call.

The bank sends you written confirmation, usually by email, summarizing what you reported and what they've frozen. This confirmation matters legally. It's your proof that you reported the fraud within the timeframes required by federal law. The Fair Credit Billing Act gives you 60 days from the statement date to dispute charges, but reporting immediately strengthens your case.

Most banks issue provisional credit within 2-5 business days. This means they return the disputed amount to your account while they investigate. You're not waiting 90 days to get your money back. The credit is temporary, but it's real money you can use while the investigation continues.

The bank orders a replacement card with a new number. Delivery takes 5-10 business days for standard shipping, 2-3 days if you pay for expedited. The new card arrives with the same account number but different card number, expiration date, and CVV. Your account balance, credit limit, and payment history transfer to the new card automatically.

During these first 24 hours, you need to do three things. First, update any recurring payments or subscriptions that use the old card number. The old card stops working the moment you report fraud, which means your Netflix, gym membership, and utility autopay will fail. Second, check your other accounts. If one card was compromised, attackers may have tried others. Third, pull your credit report from AnnualCreditReport.com to check for new accounts opened in your name.

The investigation: what the bank actually does

Once you've reported fraud, the case moves to a fraud analyst. This isn't the customer service representative you spoke with on the phone. It's a specialist who reviews disputed transactions full-time.

The analyst pulls transaction data from the payment network, Visa, Mastercard, Discover, or American Express. This data includes more than what appears on your statement. It shows the merchant ID, transaction type (card-present or card-not-present), authorization time, settlement time, and sometimes IP address or device fingerprint for online purchases.

Card-present transactions, where someone physically swiped or inserted the card, trigger different investigation paths than card-not-present transactions like online purchases. If the fraud involved card-present transactions and you still have your physical card, that's a red flag. It suggests either a cloned card or that you're lying. The analyst will ask for your card to verify the magnetic stripe or chip hasn't been tampered with.

For online fraud, the analyst looks at shipping addresses, IP addresses, and whether the purchase pattern matches your history. If you've never bought anything from overseas retailers and suddenly there are five charges to merchants in Eastern Europe, that's consistent with fraud. If the shipping address is your neighbor's house and you've been in a billing dispute with that neighbor, that's consistent with you making the purchase and regretting it.

The analyst contacts the merchant through the payment network's dispute resolution system. This process is called a chargeback. The merchant receives notice that you've disputed the charge and has the opportunity to provide evidence that the transaction was legitimate. Evidence might include signed delivery confirmation, IP address logs matching your location, or communication records showing you authorized the purchase.

If the merchant doesn't respond within the deadline, typically 30 days, the chargeback succeeds by default. The bank makes your provisional credit permanent, and the merchant loses the money. If the merchant does respond with compelling evidence, the bank reviews it and decides whether to side with you or the merchant.

In Sex and the City, Carrie Bradshaw's credit card gets declined at a boutique because of fraud. She's mortified, but the show skips the entire investigation process. In reality, that fraud investigation would involve the bank pulling transaction data, contacting every merchant where unauthorized charges appeared, and cross-referencing Carrie's usual spending patterns (expensive shoes, writers' lunches, cosmopolitans at specific bars) against the fraudulent charges. The analyst would notice immediately if someone tried to buy, say, power tools or sporting goods on Carrie's card, that's not her pattern. The investigation uses behavioral profiling, not just dollar amounts.

During the investigation, the bank may ask you to provide additional information. Common requests include a police report (for fraud over a certain dollar threshold, typically $500-$1,000), a signed affidavit confirming you didn't authorize the charges, or documentation proving you were somewhere else when card-present fraud occurred (flight records, hotel receipts, timestamped photos).

You're not required to file a police report for most credit card fraud cases, but it strengthens your position. Police rarely investigate individual credit card fraud cases, the dollar amounts are too small and the perpetrators too hard to trace, but the report creates an official record that you reported a crime. If the bank's investigation drags on or they initially deny your dispute, that police report becomes leverage.

The investigation timeline varies. Simple cases, obvious fraud with clear patterns, close in 10 business days. Complex cases involving multiple merchants, large amounts, or conflicting evidence can take up to 90 days. Federal law requires banks to complete investigations within two billing cycles, which typically means 60-90 days maximum.

Your legal protections: what you're actually entitled to

Federal law limits your liability for credit card fraud, but the protections differ depending on how quickly you report and whether the fraud involves a credit card or debit card.

For credit cards, the Fair Credit Billing Act caps your liability at $50 for unauthorized charges, regardless of when you report. In practice, most card issuers waive even that $50 as a customer service policy. If you report fraud before any charges post, your liability is zero.

For debit cards, the Electronic Fund Transfer Act has stricter timelines. Report within two business days, and your liability is capped at $50. Report between two business days and 60 days, and your liability jumps to $500. Report after 60 days, and you could be liable for everything. This is why security professionals consistently recommend using credit cards for purchases instead of debit cards, the legal protections are stronger.

These protections apply only to unauthorized charges. If you authorized a purchase but later regretted it, that's a merchant dispute, not fraud. If you lent your card to someone who spent more than you agreed, that's a civil matter between you and that person, not fraud. If you signed up for a subscription and forgot to cancel, that's your responsibility, not fraud.

The bank can deny your fraud claim if they determine the charges were authorized. This happens more often than people expect. Common denial reasons include: you shared your card information with someone who used it, you authorized a small test charge that led to larger charges, you fell for a scam and willingly provided your card details, or the shipping address matches your address or a known associate.

If the bank denies your claim, you have the right to appeal. The denial letter includes instructions for requesting a review. You can submit additional evidence, such as proof you were traveling when card-present fraud occurred, documentation that your card was stolen, or records showing the merchant never delivered goods you supposedly purchased.

If the bank's final decision still goes against you, you can file a complaint with the Consumer Financial Protection Bureau. The CFPB doesn't reverse bank decisions, but it investigates patterns of unfair practices and can pressure banks to review cases more carefully. You can also sue in small claims court, though that's rarely worth the time and expense for typical fraud amounts.

What happens to the fraudster (usually nothing)

You reported fraud. The bank reversed the charges. You got your money back. Now you want to know: did they catch the person who did this?

Almost certainly not.

Credit card fraud investigations rarely lead to arrests. The FBI's Internet Crime Complaint Center receives hundreds of thousands of fraud reports annually, but prosecution rates are low. Law enforcement prioritizes cases involving large-scale organized fraud rings, not individual cardholders losing a few hundred or even a few thousand dollars.

The fraud you experienced is likely part of a larger operation. Attackers compromise thousands of cards at once through data breaches, skimming devices, or phishing campaigns. They test stolen card numbers in small transactions to verify they work, then sell verified card data on criminal marketplaces. The person who used your card may not be the person who stole it.

Payment networks track fraud patterns and share data with law enforcement, but individual victims rarely hear about the outcome. You might get a letter months or years later saying your information was part of a larger investigation, but by then the case is closed and you've moved on.

The merchant who processed the fraudulent charge loses money when the chargeback goes through. This creates a financial incentive for merchants to implement better fraud detection, but it doesn't punish the actual fraudster. The fraudster moved on to the next card before your dispute even started.

Preventing the next incident: what changes after fraud

Experiencing fraud once increases your risk of experiencing it again, not because you're targeted specifically, but because the conditions that led to the first fraud often haven't changed.

If your card was compromised through a data breach, your information is now in criminal databases. Changing your card number helps, but if the breach also exposed your email, phone number, or address, attackers can use that information for future phishing attempts or identity theft.

If your card was skimmed at a gas station or ATM, that skimmer is probably still there until someone discovers and removes it. Other customers are getting compromised at the same location.

If you fell for a phishing scam, the attackers know your email address responds to their tactics. You'll likely receive more phishing attempts, possibly more sophisticated ones.

After fraud, you need to address the root cause, not just the symptom. If the fraud resulted from a data breach, check HaveIBeenPwned.com to see what other accounts might be compromised and change passwords for those accounts. If the fraud came from a skimmer, report the location to the gas station or bank that owns the ATM and avoid that location. If you fell for a phishing scam, learn the patterns so you recognize them next time, our phishing guide covers the core patterns that still work in 2026.

Enable transaction alerts on all your cards. Most banks offer real-time notifications for every purchase. Yes, your phone will buzz constantly, but you'll know within seconds if someone uses your card without authorization. The faster you catch fraud, the easier it is to stop.

Consider a credit freeze. This prevents anyone from opening new credit accounts in your name, which is the next step after card fraud in many identity theft schemes. Freezing your credit at all three bureaus, Equifax, Experian, and TransUnion, takes around 15 minutes and costs nothing. Our credit freeze guide walks through the exact process.

Review your credit report every four months by staggering requests across the three bureaus. You're entitled to one free report per bureau per year through AnnualCreditReport.com, which means you can check every four months by rotating which bureau you request from.

The paperwork: what to keep and for how long

Fraud generates paperwork, and you need to keep it longer than you think.

Keep the fraud report confirmation from your bank. This document proves you reported fraud within the required timeframe. If the bank later disputes your claim or tries to reverse provisional credit, this confirmation is your evidence.

Keep copies of all communication with the bank during the investigation. Emails, letters, and notes from phone calls all matter. If the bank claims you didn't respond to a request for information, your dated email showing you did respond is your defense.

Keep the police report if you filed one. Even if police never investigate, the report is proof you treated this as a crime, not a billing dispute.

Keep your credit card statements showing the fraudulent charges and the subsequent credits. If the fraud affects your credit report, you'll need these statements to dispute the erroneous information with the credit bureaus.

How long should you keep this paperwork? At minimum, until the investigation closes and the final decision is in writing. Better practice is to keep it for three years. Credit reporting errors can surface years later, and having the original fraud documentation makes disputes much easier.

If the fraud involved identity theft beyond just card fraud, someone opened accounts in your name, filed fraudulent tax returns, or committed other crimes using your identity, keep the paperwork indefinitely. Identity theft can have long-tail effects that emerge years later.

When fraud becomes identity theft: recognizing the escalation

Credit card fraud is often the first visible sign of broader identity theft. If someone has your card number, they might also have your Social Security number, date of birth, or other information needed to open new accounts.

Watch for these escalation signals in the months after card fraud: new accounts appearing on your credit report that you didn't open, calls from debt collectors about debts you don't recognize, denial of credit applications because of accounts you didn't know existed, tax return rejection because someone already filed using your Social Security number, or medical bills for services you didn't receive.

If you see any of these signs, you're dealing with identity theft, not just card fraud. The response is different. You need to file an identity theft report with the FTC, place a fraud alert or credit freeze with all three credit bureaus, and potentially work with the IRS Identity Protection Specialized Unit if tax fraud is involved.

Our identity theft recovery guide covers the full process, but the key difference is scope. Card fraud affects one account. Identity theft affects your entire financial identity and requires systematic cleanup across multiple institutions.

The aftermath: when the investigation closes

The bank completes its investigation and sends you a letter with the final decision. If they sided with you, the provisional credit becomes permanent. The fraudulent charges disappear from your statement. Your account balance reflects the removal. You're done.

If they sided against you, the letter explains why. Common reasons include: the merchant provided proof you authorized the purchase, the shipping address matched your address or a known associate, transaction patterns matched your typical behavior, or you missed deadlines for providing requested information.

You can appeal a negative decision, but success rates are low. Banks employ professional fraud analysts who review hundreds of cases weekly. If they determined the charges were authorized, they usually have solid evidence. Appeals succeed mainly when new evidence emerges that wasn't available during the initial investigation.

Once the case closes, monitor your account for several months. Attackers sometimes test compromised cards with small charges, wait for the fraud investigation to close, then hit the account with larger charges. If you see new unauthorized activity, report it immediately as a separate fraud case.

Check your credit report 30-60 days after the investigation closes. Make sure the fraudulent charges didn't get reported to credit bureaus as delinquent. If they did, dispute the information with the credit bureau using your fraud case documentation.

What actually matters

Credit card fraud is solvable. You report it, the bank investigates, and you get your money back in the vast majority of cases. The process isn't mysterious, it's systematic, with clear steps and defined timelines.

What matters most is speed. Report fraud the day you notice it. The faster you report, the stronger your legal protections and the easier the investigation. Waiting weakens your case and can cost you money.

What matters second is documentation. Keep records of everything, the fraud report, the case number, all communication with the bank, and the final decision letter. If anything goes wrong or the fraud escalates to identity theft, that paperwork is your defense.

What matters third is addressing the root cause. Fraud doesn't happen in a vacuum. Your card was compromised somehow, a breach, a skimmer, a phishing scam, or simple theft. If you don't fix the underlying vulnerability, you're likely to experience fraud again.

The call to your bank is the beginning, not the end. What happens after that call determines whether you recover fully or spend months fighting for your money back.