What to Do if Your Credit Card or Personal Information is Compromised

Federal laws, including the Fair Credit Billing Act and the Truth in Lending Act, provide consumers with protection from fraudulent credit card charges. If your credit card was lost or stolen, or if an unauthorized person used your credit card, you should immediately contact the credit card company to cancel the card and request a replacement. 

Always carefully review your account statements to make sure that all of the purchases listed were authorized. Contact the credit card company’s fraud department immediately to dispute any unauthorized charges. To ensure that you get the full protection you are entitled to under the law, put the disputed charges and the reason you are disputing them, in writing.

The federal Fair Credit Reporting Act (FCRA) gives you the right to freeze your credit and have fraud alerts placed on your accounts if you are a victim of identity theft or credit card fraud. Your state may have additional consumer protections as well.

Freezing your credit allows you to restrict access to your credit report, and makes it more difficult for anyone to apply for new credit in your name. That can be a hassle if you are applying for a new credit card or loan, but the extra security may be well worth the inconvenience. If you are applying for new credit, you may need to lift the credit freeze temporarily or for specific individuals or companies, and there may be costs associated with that. 

To freeze or unfreeze your credit reports, you’ll need to contact each of the three credit agencies, Equifax, TransUnion, and Experian, individually. Each state has its own rules for how long a credit freeze will last; in some states, the credit freeze will automatically expire after a set number of years, while in others, the freeze remains in place indefinitely until you request that it be lifted.

If you do not want to resort to a credit freeze, you may want to place a fraud alert on your account. A fraud alert is a less-drastic measure of security, which gives access to your credit report only if your identity is verified in the way you specify. For example, when a credit report request is made on your account, the company will contact you by telephone to ensure that the credit inquiry was authorized by you.

If your information was stolen during a large security breach or hack, such as the Equifax breach earlier this year, the company may offer you free credit monitoring services. If not, you might want to enroll in credit monitoring on your own. 

Although monitoring services won’t prevent your information from being taken, it can alert you to suspicious activity and help you to take action as soon as possible, preventing further damage. The credit monitoring service will check your credit reports and scores, flag certain credit activities, and notify you of any irregularities. 

You should also monitor your own credit. You are entitled to receive one free credit report per year from each of the three agencies. The reports from each service may contain different information, so you’ll want to check all three.

Although it can make life a little less convenient, using multi-factor authentication for purchases or other online activities can help to protect your personal information. Multi-factor authentication is a method of verifying the identity of an online user by requiring more than one method of identification. For example, a user may be required to enter a password and provide a code that is sent to an email address or mobile phone, or provide a combination of a password and fingerprint.

In addition to multi-factor authentication, always be sure that your browser is in secure mode with an “https://” web address when making online purchases or accessing financial websites (such as bank sites).

If you report a credit card stolen before unauthorized charges are made, you will not be held responsible for those charges. Even if you discover the missing card after charges are made, the Fair Credit Billing Act limits your liability for unauthorized charges to $50. 

If you still have the card but the number was used without your authorization, the $50 charge will not apply. Similarly, whether the card itself was stolen or the number was used, if the card has a “zero liability” policy, you will not be responsible for any charges. Most major credit card issuers or processors have zero liability policies, including Visa, MasterCard, and American Express.

If the card that was compromised is a debit or ATM card, as opposed to a credit card, your exposure may be much higher; according to the Federal Trade Commission, depending on how soon you report the theft or unauthorized use of your card, you could be responsible for all of the unauthorized uses of the card.

If your credit card or information was stolen and the individual has been identified, that person may be subject to criminal penalties, but you are also entitled to bring a lawsuit against them to recover the amount of any unauthorized purchases or withdrawals. 

Many states have also enacted legislation providing victims of identity theft with the right to sue the responsible party, and some even provide for damages that exceed the amount of your actual damages. You may also be able to recover if you can show other damages that resulted from the theft, such as difficulty getting a job due to poor credit or legal costs defending against creditors from the fraudulent charges.

Companies are responsible for keeping their customers’ data secure and are required to notify customers if there is a breach. If a company with whom you do business was hacked and your personal information was exposed, or if unauthorized purchases were made with your information, you may also be able to sue the business. Legal theories that may apply include negligence, breach of fiduciary duty, and breach of contract. In some states, you may have additional remedies if the company did not take the necessary steps to notify customers of the breach. 

If you have been the victim of identity theft or credit card fraud, or if your personal information has been exposed, an attorney familiar with identity theft and/or consumer protection can review your case and help you decide whether you have a claim.