Credit Card Fraud Protection and Credit Freezes, Explained by a CPA

By Tom, CPA · Updated October 25, 2026

TL;DR: Federal law caps your liability for unauthorized credit card charges at $50, and most issuers advertise $0. Debit cards have weaker protection that depends on how fast you report. A free credit freeze at Equifax, Experian and TransUnion blocks most new-account fraud, and you can lift it temporarily when you apply for a card.

Educational only, not tax, legal, or investment advice. Examples are illustrations, not predictions. Rules and limits change; verify current figures and talk to a qualified professional about your situation.

Affiliate disclosure: This page may include links to card offers. If any are added, CPA FIRE may earn a commission if you apply through them, at no cost to you. That never changes what we write, and nothing here is financial advice. Card terms, rewards and fees change; verify with the issuer.

Points collectors spend hours optimizing a 2% card versus a 3% card, then use the same password for every account and leave their credit files open to anyone with a stolen Social Security number. That's like installing a fancy lock on a screen door.

This guide covers the defensive side of a card strategy: what the law protects, what it doesn't, how to lock your credit file, and the exact steps to take when something goes wrong. Legal limits below are as of Oct 2026, from the Federal Trade Commission's consumer guidance. This is education, not personalized advice.

CPA Warning Label: Your Social Security number has been in more data breaches than a reality show contestant has been in confessionals. Freeze accordingly.

Zero-liability basics

Credit cards come with strong federal protection. Under the Fair Credit Billing Act, as summarized by the FTC (as of Oct 2026):

• If you report a lost or stolen credit card before anyone uses it, you owe nothing for unauthorized charges.
• If it's used before you report it, your maximum liability is $50.
• If only your card number is stolen (the physical card is still in your wallet), you have no liability for unauthorized use.

Most major issuers go further with voluntary "zero liability" policies, so in practice many people pay nothing. Still, the legal floor matters, because voluntary policies have conditions.

Debit cards are a different animal

Debit and ATM cards fall under the Electronic Fund Transfer Act, and the protection depends on speed. According to the FTC (as of Oct 2026):

There's also a practical difference. With a credit card, fraud uses the bank's money while you dispute it. With a debit card, it's your checking account that's empty while the bank investigates, and your rent payment may bounce in the meantime. That's one of the strongest arguments for using a credit card for everyday spending and keeping the debit card in a drawer, assuming you pay the balance in full.

Freezes at three bureaus

A credit freeze (also called a security freeze) restricts access to your credit report, which makes it very hard for someone to open new accounts in your name. Key facts from the FTC (as of Oct 2026):

• It's free to place and free to lift.
• It doesn't affect your credit score.
• It stays in place until you lift it.
• You must place it separately at each of the three nationwide bureaus: Equifax, Experian and TransUnion.
• It doesn't stop your existing creditors from accessing your file, or stop you from using existing cards.

Freezing as a rewards card user

The common objection is "but I apply for cards." A freeze is still compatible with that. Before an application, you temporarily lift ("thaw") the freeze, usually online, and it can be set to refreeze automatically after a set period. Some people check which bureau a given issuer is commonly reported to pull from and lift only that one; others lift all three for a few days, which is simpler and less error-prone.

Also freeze the smaller files that affect financial accounts. Many banks check ChexSystems when you open a checking account, and some lenders check other specialty agencies. Those freezes are separate from the big three.

Illustration (hypothetical): Frugal Fran applies for two cards a year. Each time, she lifts her freezes for a week. That's about 15 minutes of work per application, in exchange for blocking the most common form of identity theft the other 51 weeks of the year.

Alerts

A fraud alert is different from a freeze. It tells lenders to take extra steps to verify your identity before opening credit, but it doesn't block access to your report. According to the FTC (as of Oct 2026):

• An initial fraud alert is free and lasts one year. You contact one bureau, and it must notify the other two.
• An extended fraud alert is for identity theft victims, requires an identity theft report, and lasts seven years.
• Active-duty service members can request an active duty alert.

For most people, a freeze offers stronger protection, and the two can be used together.

The other kind of alert

Also turn on transaction alerts in your card apps: a push notification for every charge, or every charge above a small amount. Fraud is easiest to stop when you see it the minute it happens instead of three weeks later on a statement. Review your free credit reports too; you can get them weekly at AnnualCreditReport.com, the only website authorized by federal law for that.

Virtual card numbers

Some issuers and browsers let you generate virtual card numbers: a different number tied to your real account, sometimes locked to one merchant or with a spending limit. If a merchant gets breached, you cancel that virtual number and your main card keeps working.

Mobile wallets (Apple Pay, Google Pay and similar) work similarly by tokenizing your card, so the merchant never sees your actual number. In-store, tapping a phone or card is generally safer than swiping, which is easier to skim.

Habits that matter more than products

• Use a password manager and unique passwords for every financial login.
• Use app-based two-factor authentication instead of SMS where available.
• Never give a code to someone who calls you, even if caller ID shows your bank. Hang up and call the number on the back of the card.
• Be skeptical of urgency. "Your account will be closed in 30 minutes" is a scammer's line, not a bank's.
• Shred old statements and convenience checks, or go paperless.

What to do after fraud

If you see a charge you didn't make, act in this order:

1. Call the issuer using the number on your card or in its app. Report the charge, and they'll usually close the account and issue a new number.
2. Dispute in writing if the issuer asks, or if it's a billing error. The FTC recommends writing to the billing-error address within 60 days of the statement that showed the charge.
3. Update autopays that used the old number, so your utilities don't lapse.
4. Check your credit reports for new accounts you didn't open.
5. If it's identity theft (new accounts, not just a stolen card number), report it at IdentityTheft.gov, which creates a recovery plan and an identity theft report, then freeze your credit or extend your fraud alert.

A tax angle

Personal theft losses are generally not deductible on your federal return for tax years 2018 and later unless tied to a qualifying declared disaster (as of Oct 2026). Because reimbursed card fraud isn't a loss to you anyway, this rarely matters. But it's one more reason to report fraud on debit accounts quickly, because unrecovered losses are usually just gone. Also watch for fraudulent tax returns filed in your name; the IRS offers an Identity Protection PIN to anyone who verifies their identity.

A simple security checklist

Rewards cards bring more accounts, more logins and more statements. Use this list once and repeat it every year:

• Freeze credit at Equifax, Experian and TransUnion; note the login details in your password manager.
• Turn on charge alerts for every card.
• Use a credit card, not debit, for online and everyday spending, and pay in full.
• Enable two-factor authentication on every bank and card login.
• Pull your free credit reports a few times a year.
• Keep a list of your cards and the issuers' phone numbers somewhere safe, for a lost wallet.

Lavish Larry carries eleven cards and remembers the numbers for none of them. If his wallet goes missing, he'll spend an evening reconstructing which issuers to call. Fran keeps a one-page list. Be Fran.