Can someone charge your credit card without authorization? Your legal rights

How unauthorized charges happen without your card being stolen

Most credit card fraud today occurs without a physical card ever leaving your possession. Fraud rings use distributed bot software to launch Bank Identification Number (BIN) attacks — also known as card-testing or account number enumeration. Software takes a known six-digit or eight-digit bank prefix and systematically generates thousands of potential card numbers and expiration dates, testing them against payment processors with micro-transactions of one or two dollars until a valid combination approves.

Data breaches represent another common entry point. When an online retailer, hotel chain, or subscription platform suffers a security compromise, stored payment credentials and vaulted payment tokens can be exported to illicit marketplaces. Criminals buy these credential packs and use them to purchase gift cards, electronics, or digital subscriptions.

Additionally, card networks utilize Automated Account Updater (AAU) services. When your bank reissues an expired or compromised card, card brand updater networks share the new account number with merchants that have your profile on file. If a scammer established a recurring billing agreement on your old card number, the charges can follow you to the replacement card unless your bank places a merchant-specific block.

Why transactions clear without a CVV or one-time passcode

Consumers often assume that an online transaction cannot process without entering the 3-digit CVV code on the back of the card or receiving a two-factor text confirmation. In reality, payment networks allow merchants to configure their own fraud risk thresholds.

A merchant can choose to submit an authorization request without CVV verification, address verification (AVS), or 3D-Secure authentication. Doing so lowers checkout friction for customers, but shifts financial liability onto the merchant if the charge proves fraudulent. Fraudsters specifically target web storefronts with relaxed verification rules, allowing unauthorized charges to clear your account without any alert reaching your mobile phone.

Your protections under the Fair Credit Billing Act

United States federal law provides robust protections against unauthorized credit card charges. Under the Fair Credit Billing Act (FCBA, codified in federal statute at 15 U.S.C. § 1643), your maximum legal liability for unauthorized credit card use is fifty dollars. If your card number was used without the physical plastic card being stolen, your statutory liability under federal law is zero.

Major card networks — including Visa, Mastercard, American Express, and Discover — maintain contractual zero-liability policies that go beyond federal minimums. Under these network rules, cardholders owe zero dollars for unauthorized purchases provided they exercise reasonable care and report the compromise promptly to their financial institution.

What to do in the first 24 hours

Acting quickly when you spot an unrecognized transaction limits financial exposure and protects your credit record.

1. Freeze or lock your card in your banking app Most major bank apps feature an instant card lock toggle. Freezing the card prevents subsequent automated transactions from approving while you investigate.
2. Call the fraud department on the back of your card Notify your bank that the charge is unauthorized. Specify that your physical card was not lost or stolen so they can flag the incident as card-not-present fraud.
3. Request a new card with a clean account number The bank will permanently deactivate the compromised card number and reissue a new plastic card. Explicitly ask them to disable Automated Account Updater links for that specific merchant descriptor.
4. Review your recent statement lines thoroughly Fraudsters often test a stolen card number with a trivial transaction — such as a small charge from a vending machine or fast food chain — before attempting major purchases.

Dispute filing vs. fraud reporting

Banks treat billing disputes and fraud claims through separate operational pipelines. A merchant dispute applies when you willingly did business with a merchant but received damaged goods, encountered a billing calculation error, or were billed after cancellation. A fraud report applies when an unknown third party used your credentials without your permission.

Never file an unauthorized transaction as a simple merchant dispute. Doing so prompts the bank to ask for proof of purchase or cancellation receipts that you do not have, causing needless delays. Clearly state to customer service that you have no commercial relationship with the merchant and did not authorize the charge.