Dan Brownsword/Getty Images

Credit card fraud is an ongoing concern for Americans, and rightly so. According to a report by the Identity Theft Resource Center (ITRC) data breaches continue to rise, increasing almost 45 percent in the U.S. in 2017. Credit card fraud is now the most common identity theft crime. But these numbers barely scratch the surface of how widespread credit card fraud has become.

Gemini Advisory, an intelligence group, reported that more than 60 million U.S. payment cards—debit and credit—had been compromised in 2018, whether individually or as a result of major data breaches.

Credit card fraud takes many forms

There are many types of credit card fraud, including:

Skimming – When a thief places a device on a credit card scanner and transmits the data to a nearby mobile device, then uses it to create a counterfeit card.

Phishing – When thieves try to extract personal information from you via email or over the phone.

Lost or stolen card fraud – When a thief uses a lost or stolen credit card for physical or online transactions.

Card-not-present fraud – Fraud committed online or by phone, when the thief does not have your physical card in their hand, but they have obtained your card details by other means.

Accidental credit card fraud – When a friend or relative believed they had permission to use your credit card, but you didn’t know about it or the person charged more than you expected.

Chip-and-pin cards, otherwise known as EMV credit cards (after Europay, Visa and Mastercard, the three main credit card providers) have helped reduce certain types of fraud. In the U.S., counterfeit card fraud has dropped by 49 percent between September 2015 and December 2018, according to a study by Visa.

But card-not-present fraud remains a huge problem, and it could cost retailers as much as $130 billion worldwide by 2023.

As a consumer, it’s important to know your rights when fraud occurs. You should also get familiar with the steps you can take to protect yourself and what to do if your card is compromised.

Report fraud in a timely manner

Most credit card companies today offer zero-liability fraud protection if you report the charges within 30 days.

By law, your liability is limited to $50 for card-present fraud. If your card number is stolen but not the physical card, the Fair Credit Billing Act releases you of any liability.

Regardless of liability, you obviously want to report fraud as soon as you notice someone is using your account.

If you don’t report the fraud, you’ll be responsible to pay the bill when it comes due. Once you make a claim, you’re not responsible for any charges under investigation; you just have to make your minimum payment based on the charges you made that month.

Getting ahead of the issue and reporting fraud as soon as you notice it can save you the headache of disputing charges.

It’s a best practice to regularly review all your credit card statements to make sure you’re able to quickly catch any transactions that you didn’t make. This can also help you protect your credit score.

In the case of debit cards

Debit cards are a different story. You want to call your bank immediately if you notice your debit card is missing or think you may be a victim of fraud.

If you don’t report fraudulent charges within 60 days of your most recent statement, you could be liable for all charges made by the thief. Wait more than two days after you learn about the loss, and you could be on the hook for up to $500 of fraudulent charges. If you report within two business days after you learn about the loss or theft of your card, your liability drops to $50.

Dispute all charges you didn’t make

There’s no limit to the amount of charges you can dispute. If a debit card is stolen, thieves could gain access to any linked accounts, tapping into thousands of dollars or more depending on your available balances.

Review your online statement carefully and look for any charges you don’t recognize. If possible, cross-reference against paper or email receipts to ensure the charges are yours.

Provide investigators with the information they need

Once you’ve filed a dispute, you might wonder who investigates credit card fraud. In most cases, depending on the number of fraudulent charges, the bank or credit card company handles it through their internal fraud department. In a case of identity theft or higher amounts of fraudulent charges, local or state police, or even the Federal Bureau of Investigation, may be called in.

Fraud investigators are experts at tracking the origin of charges. They can match this data up with information the customer provides to determine if the charges are fraudulent. You can help the investigation go faster by providing any records the fraud investigators request.

What usually happens in the end?

Once you report fraudulent charges and provide any necessary documentation, the bank has 30 days to respond to your issue and begin an investigation. From there, the bank has to complete the investigation within 90 days.

Fortunately for consumers, most instances of credit card fraud end with the disputed charges being removed or money placed back into your account.

In the meantime, you should have received new cards, with new account numbers, to replace the compromised accounts. You can also place a fraud alert on your credit account with all three major credit bureaus to prevent additional instances of fraud. If you place a fraud alert on your credit file, you can’t open new credit without additional verification of your identity, usually involving a phone call from the creditor.

Who pays for credit card fraud

If consumers aren’t liable for fraudulent charges they report promptly, it begs the question: Who pays for credit card fraud?

The bank or credit card issuer shoulders much of the burden of fraudulent charges. In the case of debit card fraud, the bank must reimburse the account holder.

Often, the credit card company is liable to pay the merchant for the fraudulent credit card purchases made.

But if the bank can prove that lax security measures led to the fraud, the merchant may not receive money for the fraudulent charges from the bank. For instance, if a merchant fails to use a chip reader at point-of-sale, or an e-commerce site is determined not to be secure, they can face fines and also be held responsible for the fraudulent charges.

In the rare case that the thieves are caught and convicted, they might have to pay restitution to the bank or the merchant. But most credit card fraud goes unpunished, simply because thieves are so hard to catch.

Fraud costs merchants and banks money. As fraud continues to occur, retailers and banks may increase prices or fees, passing those costs on to consumers.