Credit Card Fraud Protection, Virtual Cards, and Dispute Processes

Credit cards offer consumers more than a way to borrow money. They also provide mechanisms for identifying unauthorized transactions, disputing certain billing errors, and limiting potential losses when card information is compromised.

Digital shopping has added another layer to the equation. Virtual card numbers, transaction alerts, card-lock features, and other security tools can reduce the exposure of a physical card number when making purchases online.

Still, no security feature eliminates fraud entirely. Consumers need to know how to recognize suspicious transactions, report unauthorized activity promptly, and understand the difference between fraud, billing errors, merchant disputes, and ordinary purchase dissatisfaction.

The Consumer Financial Protection Bureau (CFPB) advises cardholders to report unauthorized use promptly and provides specific guidance on disputing credit card billing errors.

What Counts as Credit Card Fraud?

Credit card fraud generally involves someone using a card or account without the cardholder's authorization.

Examples can include:

• A stolen physical card being used for purchases
• Card details being used for online transactions
• A fraudulent transaction made using compromised account information
• An unauthorized recurring charge
• A counterfeit card being used with stolen account information

The CFPB defines unauthorized use generally as use of a credit card by someone who does not have the right to use it.

However, not every unfamiliar transaction is automatically fraud.

A merchant may appear under a different billing name than the name consumers recognize. A recurring subscription may also produce a charge that the cardholder forgot about. Checking the transaction details before reporting it as fraudulent can help distinguish an unfamiliar legitimate purchase from genuine unauthorized activity.

Credit Card Liability for Unauthorized Charges

Federal law provides important protections for consumers whose credit cards are used without authorization.

The FTC states that federal law generally limits liability for unauthorized credit card charges to $50, although consumers can have stronger protection depending on the circumstances and whether the card was reported lost or stolen before unauthorized use occurred.

Reporting a lost or stolen card quickly is therefore important.

If the card is reported lost or stolen before unauthorized charges occur, federal protections can prevent the cardholder from being responsible for those subsequent unauthorized charges.

Consumers should contact the issuer as soon as they notice suspicious activity rather than waiting until the next statement arrives.

What to Do When You See a Suspicious Charge

The first step is to determine whether the transaction is actually unauthorized.

Check:

• The merchant name
• Transaction date
• Transaction amount
• Recurring subscription information
• Purchases made by authorized users
• Digital wallets connected to the account
• Recent online purchases

If the charge is genuinely unauthorized, contact the card issuer immediately using the phone number on the back of the card, the issuer's official website, or its mobile application.

The FTC similarly advises consumers to report unauthorized credit card use to the issuer immediately and request that the charge be addressed.

The issuer may cancel the compromised card number and issue a replacement card.

Freeze or Lock the Card

Many credit card issuers provide temporary card-lock or card-freeze features through their mobile applications.

A card lock can be useful when a physical card is temporarily misplaced. Depending on the issuer, certain recurring transactions or other transaction types may continue to process even when a card is locked.

A lock is therefore not necessarily a substitute for reporting a confirmed fraudulent transaction.

If the card has actually been stolen or the account information has been compromised, contacting the issuer directly is more appropriate than simply relying on a temporary lock.

What Are Virtual Credit Cards?

A virtual card is a digital card number that can be used for online or other eligible transactions without exposing the primary physical card number.

Depending on the issuer or service, a virtual card may provide:

• A separate card number
• A different expiration date
• A security code
• Spending controls
• Merchant-specific numbers
• Temporary or disposable numbers

The exact features vary by provider.

The main security concept is straightforward: the merchant receives a card number that can be different from the number printed on the physical card.

If that virtual number is compromised, the consumer may be able to deactivate or replace it without replacing the primary physical card.

Virtual Cards Can Reduce Exposure Online

Online shopping requires consumers to enter payment credentials into websites, applications, or other digital services.

Using a virtual card number can reduce the number of merchants that have access to the primary account number.

For example, a consumer might use a virtual card for an online subscription rather than providing the primary physical card number.

If the virtual number is subsequently exposed in a data breach, the compromised number can potentially be canceled without affecting the physical card, depending on the provider's functionality.

Virtual cards are therefore a risk-reduction tool rather than a guarantee against fraud.

Virtual Cards Are Not All the Same

Different virtual-card systems can work differently.

Some provide a persistent virtual number connected to the underlying account. Others may generate a number for a particular merchant or transaction.

Some allow spending limits, while others focus primarily on masking the primary card number.

Before using a virtual card, consumers should check:

• Whether the number can be used for recurring payments
• Whether it works internationally
• Whether merchants can verify the card
• How refunds are handled
• Whether the virtual number can be locked or deleted
• Whether it has a separate spending limit
• Whether additional fees apply

These details can affect whether a virtual card is practical for a particular purchase.

Fraud Alerts and Transaction Notifications

Real-time transaction notifications can provide another layer of protection.

Depending on the issuer, consumers may be able to receive notifications when:

• A purchase is made
• A transaction exceeds a specified amount
• An online purchase occurs
• The card is used internationally
• A cash advance is attempted
• A card-not-present transaction is processed

The benefit is speed.

If a consumer receives an alert for a $600 purchase they did not make, they can contact the issuer immediately rather than discovering the transaction weeks later.

Regular statement reviews remain important even when alerts are enabled. The CFPB recommends reviewing credit card statements carefully to identify unfamiliar charges and billing errors.

What Is a Credit Card Billing Error?

Not every dispute involves fraud.

Federal law recognizes several categories of credit card billing errors, including unauthorized charges, incorrect amounts, charges for goods or services not received as agreed, and certain other problems with a credit card bill.

For example, a consumer may have legitimately purchased a $100 item but discover that the merchant accidentally charged $1,000.

That is a billing error rather than a fraudulent transaction.

Similarly, a consumer may have been charged twice for the same purchase.

The dispute process can address these situations even though the consumer originally authorized the transaction.

Fraud and Merchant Disputes Are Different

It is useful to distinguish unauthorized transactions from disputes involving a legitimate purchase.

Fraud: The consumer did not authorize the transaction.

Billing error: The consumer authorized the purchase, but something about the billing may be incorrect, such as an incorrect amount or duplicate charge.

Merchant dispute: The consumer authorized the purchase but has a problem with the product or service, such as non-delivery or failure to provide what was agreed.

The legal protections and procedures can differ depending on the circumstances.

The CFPB recommends contacting the merchant first when a consumer is seeking a refund for a product or service problem, while certain billing errors can be disputed directly with the card issuer.

How the Formal Dispute Process Works

For a billing error covered by the Fair Credit Billing Act, consumers generally need to provide written notice to the card issuer.

The CFPB says the written billing-error notice should generally reach the issuer within 60 days after the statement containing the error was sent.

The notice should include:

• Name
• Address
• Account number
• Description of the disputed charge
• Explanation of why the charge is incorrect
• Copies of supporting documentation when appropriate

Consumers should send the notice to the billing-dispute address specified by the issuer rather than automatically using the address for regular payments.

Keeping copies of the dispute and supporting documents can also create a useful record.

Why the 60-Day Period Matters

The 60-day period is particularly important for consumers seeking the federal billing-error protections.

The FTC explains that certain credit card billing errors must be disputed in writing within 60 days of the statement being sent.

This does not mean consumers should wait.

A suspicious transaction should be reported to the issuer as soon as it is discovered.

Early reporting gives the issuer more time to investigate and can reduce the potential consequences of continued unauthorized activity.

What Happens While a Billing Dispute Is Investigated?

When a qualifying billing error is properly disputed, consumers have specific protections during the investigation.

The CFPB states that consumers generally do not have to pay the disputed amount or related finance and other charges while the issuer investigates, although they remain responsible for paying the undisputed portion of the bill.

The issuer generally must acknowledge the written dispute within 30 days unless the issue has already been resolved.

The issuer then has up to two billing cycles, but no more than 90 days, to complete the investigation under the applicable billing-error process.

This makes documentation particularly important.

Keep Evidence for the Dispute

A strong dispute file can include:

• Credit card statement
• Transaction receipt
• Order confirmation
• Shipping information
• Cancellation request
• Emails with the merchant
• Screenshots
• Refund correspondence
• Subscription cancellation records
• Fraud alert notifications

The objective is to establish what happened and why the transaction or billing amount is incorrect.

The FTC recommends keeping copies of supporting documents and dispute correspondence.

Contact the Merchant When the Problem Is a Purchase

If the transaction was authorized but the consumer has a problem with the product or service, contacting the merchant can be the appropriate first step.

For example, a customer might have:

• Never received an order
• Received a different product
• Been charged the wrong amount
• Been charged after canceling a service
• Received a product that was materially different from what was agreed

The CFPB recommends first contacting the seller for many product or service disputes and asking the company to refund or correct the charge.

If the merchant does not resolve the issue, the consumer can then explore the dispute options available through the card issuer.

A Chargeback Is Not a General Refund Tool

Consumers sometimes assume that a credit card dispute can be used whenever they regret a purchase.

That is not generally how the billing-error process works.

A dispute should be based on an actual unauthorized transaction, billing error, or other circumstance covered by the issuer's dispute rules.

Simply deciding that a purchase was too expensive or that the consumer no longer wants the product does not automatically make the charge fraudulent.

The CFPB distinguishes between billing errors and ordinary dissatisfaction with a purchase.

Consumers should provide accurate information when filing a dispute.

What Happens If the Issuer Finds the Charge Was Correct?

An issuer may determine that a disputed transaction was authorized or that the billing was correct.

If that happens, the issuer generally must explain the result and tell the consumer how much is owed and when payment is due.

Consumers who disagree with the outcome may have additional options, depending on the circumstances and the issuer's procedures.

The FTC recommends keeping records of the dispute and contacting the issuer if the consumer believes the decision was incorrect.

Protecting the Account Before Fraud Happens

Fraud protection works better when consumers use several layers of security.

Practical measures include:

• Enable transaction notifications
• Use strong, unique online-account passwords
• Enable multi-factor authentication when available
• Avoid entering card information on suspicious websites
• Use virtual card numbers when appropriate
• Review statements regularly
• Keep contact information current with the issuer
• Report lost cards promptly
• Avoid sharing card details through unsolicited messages
• Monitor credit reports for unfamiliar accounts

The FTC also warns consumers about scammers who impersonate card issuers and request account information. Legitimate fraud departments will not require consumers to purchase "credit card loss protection" products to obtain protection from unauthorized use.

Be Careful With Fraud Alerts From "Your Bank"

A common scam involves receiving a text message or phone call claiming that a suspicious transaction has occurred.

The person may ask the consumer to confirm:

• Full card number
• Security code
• Online banking password
• One-time verification code
• Social Security number

The safest response is to contact the card issuer through an official channel rather than using the telephone number or link supplied in the unsolicited message.

If a message claims to be from the card issuer, open the official banking application or use the number printed on the physical card.

What to Do if the Physical Card Is Stolen

If a physical card disappears, consumers should report it immediately.

The FTC advises contacting the issuer as soon as a card is lost or stolen and following up in writing when appropriate.

The issuer can generally deactivate the compromised card and issue a replacement.

Consumers should also review recent transactions for charges that occurred before the card was reported missing.

If identity theft appears to be involved, checking credit reports and reporting the incident through the federal IdentityTheft.gov system can provide additional recovery steps.

What If Card Information Is Stolen but the Physical Card Is Still With You?

Fraud can occur even when the physical card never leaves the consumer's possession.

Online merchants, payment processors, or other systems can experience security incidents that expose card information.

If an unauthorized online transaction appears, the consumer should report it to the issuer even if the physical card remains in their wallet.

The issuer may replace the card number or take other measures to prevent additional unauthorized transactions.

Virtual cards can reduce exposure in future online transactions, but they cannot prevent every type of fraud.

Credit Reports Can Help Identify Larger Identity-Theft Problems

A fraudulent credit card transaction may sometimes be part of a broader identity-theft incident.

For example, a criminal might use stolen personal information to open a new credit account rather than simply making purchases on an existing card.

Consumers who suspect identity theft should review their credit reports for unfamiliar accounts and inquiries.

The CFPB explains that consumers have the right to dispute inaccurate information on their credit reports with both the credit reporting company and the company that supplied the information.

This is a separate process from disputing an individual credit card transaction.

Keep Fraud Protection in Perspective

No credit card security feature guarantees that fraud will never occur.

Virtual cards can reduce exposure. Transaction alerts can improve detection speed. Strong authentication can make unauthorized account access more difficult. Regular statement reviews can identify suspicious activity sooner.

But consumers still need to respond quickly when something goes wrong.

The combination of prevention, monitoring, and a clear understanding of dispute rights provides a more complete approach to credit card security.

The Bottom Line

Credit card fraud protection involves both technology and consumer action.

Virtual card numbers can provide an additional layer of protection for online purchases by allowing consumers to avoid exposing their primary card number. Transaction alerts and account monitoring can make suspicious activity easier to detect.

When unauthorized charges or billing errors occur, consumers should contact the card issuer promptly. For qualifying billing errors, federal law provides a formal dispute process, including a generally applicable 60-day written-notice period and protections while the issuer investigates.

The key is to distinguish fraud from ordinary merchant disputes and billing mistakes. A transaction that a consumer never authorized is different from a legitimate purchase that arrived late, was defective, or did not meet expectations.

Reviewing statements regularly, protecting account credentials, using available digital security features, and keeping documentation can all make it easier to identify and resolve credit card problems.