Stolen credit card numbers: what happens and what to do?

Stolen credit card numbers can be resold, tested through small purchases, or used for unauthorized spending even while the physical card stays in your wallet. For US cardholders, the practical response is to report suspected compromise to the issuer, arrange replacement when needed, and identify fraudulent transactions separately.

• Possession of the physical card does not mean its payment details are safe.
• An unfamiliar small charge can matter just as much as a larger purchase.
• A temporary card lock is not the same as reporting fraud or replacing a compromised number.
• Keep reviewing transactions and recurring payments after receiving a replacement.

What can happen to stolen credit card numbers?

A stolen number is payment information, not just a record of a missing piece of plastic. Criminals may try to use compromised details for purchases, pass them to other criminals, or use captured card information to produce counterfeit cards.

Experian describes both resale and counterfeit-card use in its guidance on card skimming, reviewed on November 2, 2026. Its guidance also notes that criminals may delay using stolen information, so the first suspicious purchase does not necessarily reveal when the theft happened.

That uncertainty matters when looking back through purchases. A recent transaction at a particular store is not proof that the store caused the compromise; focus first on protecting the affected account rather than trying to identify the source yourself.

Why might a thief start with a small purchase?

According to Experian’s guidance on hacked cards, reviewed on November 2, 2026, an unfamiliar low-value purchase can be a test before larger spending. Its size does not make it harmless or establish that the account is safe.

Not every unfamiliar charge is fraud, however. A merchant may appear on a statement under a different business name, so comparing receipts and order histories can help distinguish a confusing description from an unauthorized purchase.

What if your card is still in your wallet?

The card does not need to disappear for its details to be misused. Experian explains that payment information can be compromised and used while the owner still has the physical card.

Useful warning signs include purchases you did not authorize, alerts about unfamiliar spending, an unexpected decline, or less available credit than anticipated. These are reasons to investigate, not proof of a particular theft method.

Checking the card account directly is more useful for this question than looking only at a credit score. Our explanation of why a normal credit score cannot rule out identity theft discusses the limits of relying on that single indicator.

When an alert arrives, verify it through an independently opened banking app or a contact number on your statement or card. That separates checking a genuine account problem from trusting an unsolicited message.

What can you do after spotting suspicious activity?

Chase’s fraud-reporting guidance, reviewed on November 2, 2026, directs customers to report unauthorized charges or suspected account compromise promptly. The contact route depends on the product, so use the credit card channel rather than assuming debit-card procedures apply.

1. Review the transaction description against receipts, subscriptions, and purchases by authorized users.
2. If available, use the issuer’s temporary lock while contacting its fraud team about suspected compromise.
3. Explain whether the card is missing or whether you still hold it but suspect its details were stolen.
4. Identify each transaction you did not authorize and ask how to submit the required claim.
5. Keep the case reference and any instructions about documentation, payments, and follow-up.

A lock can be a useful immediate control, but it is not a completed fraud report. Experian notes that locking a card generally does not interrupt recurring automatic payments already established, so it cannot be treated as a universal stop on account activity.

Ask what happens to the number and the claim

Card replacement and transaction investigation address different problems. Replacement addresses further use of compromised payment details; the claim addresses purchases already made without authorization.

Bank of America’s security FAQ, reviewed on November 2, 2026, describes cancellation and replacement alongside a separate fraud-claim process. Its conditions include verification and posted, settled transactions, so its processing arrangements are not a promise that every issuer will resolve every charge immediately.

What changes after the issuer replaces your card?

A replacement can mean checking payment arrangements as well as activating new plastic. Review subscriptions and essential bills linked to the affected card, then confirm whether their stored payment details need updating.

Experian notes that some merchants receive updated card information automatically. That makes it useful to confirm the status of each recurring payment rather than assuming everything stopped or everything transferred successfully.

Replacing a card also does not eliminate the need to follow the investigation. Ask which transactions remain under review and how legitimate payments are handled while the dispute is open; avoid treating the entire bill as canceled.

What if someone also accessed your online account?

Report signs of broader access, such as changes you did not make, rather than describing the incident only as a stolen number. Ask the issuer which additional security steps apply to your situation.

For a separate layer of account protection, see our guide to using two-factor authentication in everyday life. Stronger login protection and replacing compromised payment credentials solve different problems; neither makes transaction review unnecessary.

Informational content only, not financial advice.