Credit Card Fraud Report 2026

Under the Fair Credit Billing Act (FCBA), your maximum liability is $0 for unauthorized credit card charges, as long as you report them within 60 days of your statement date. For debit cards under Regulation E, liability depends on reporting speed: $0 if reported within 2 business days, $500 if within 60 days, unlimited after 60 days.

Within 24 hours for maximum protection. For credit cards, the 60-day FCBA window is generous but reporting within 48 hours dramatically increases bank responsiveness and reduces the risk of additional charges. For debit cards, Regulation E REQUIRES reporting within 2 business days for full $0 liability — waiting exposes you to up to $500 or more.

Yes, under specific circumstances. If the bank determines the transaction was authorized (e.g., a family member used the card), or if you waited past the FCBA/Regulation E deadlines, they can legally refuse. If they do, escalate to CFPB — they reverse approximately 40% of denied disputes.

Any transaction you did not consent to. This includes stolen cards, cloned cards, phishing-obtained numbers, and use by household members who did not have permission (though banks may question the latter). It does NOT include charges you authorized but later regretted.

Under current law, AI voice clone scams where YOU voluntarily initiated the transfer are typically NOT covered by FCBA or Regulation E, because you "authorized" the transaction. Your only realistic recovery path is proving the bank acted negligently or filing an FBI IC3 report for criminal investigation. Prevention is the only real defense.

Yes, especially after any data breach exposure. A credit freeze is free at all three bureaus (Equifax, Experian, TransUnion) and prevents anyone from opening new credit in your name. It does not affect your credit score and can be lifted temporarily when you need to apply for credit.

Skimming is when a fraudster attaches a device to a card reader (ATM, gas pump, retail terminal) that captures your card data. Skimming has dropped sharply since the US transitioned to EMV chip cards in 2015 but is still active at gas pumps and older ATMs. Use tap-to-pay whenever possible and inspect card readers before inserting.

Technically yes. Knowingly filing false chargebacks is wire fraud under 18 U.S.C. § 1343. Prosecution is rare for one-off disputes, but repeat offenders have been charged. A safer path: contact the merchant directly for a refund first, and only dispute if they refuse.

PIN debit (using your PIN at checkout) is processed as a direct bank account debit — Regulation E still applies but disputes can be harder because PIN use is considered strong authentication. Signature debit (processed as a credit transaction through Visa/Mastercard) gives you access to Visa/Mastercard zero-liability policies, which are often more protective than Regulation E alone.

The FTC publishes real-time data at consumer.ftc.gov/explore-data. The FBI's IC3 publishes an annual Internet Crime Report. The CFPB publishes a monthly complaint snapshot at consumerfinance.gov. For industry data, Nilson Report (subscription) is the authoritative source for payment fraud statistics.