Credit card fraud and unauthorised payments

If someone uses your credit card without your permission, the starting point in UK law is that the card provider carries the loss, not you. Two sets of rules apply. The Consumer Credit Act 1974 caps what a cardholder can owe for unauthorised transactions on a lost or stolen credit card at £50¹. The Payment Services Regulations 2017, which govern day-to-day card payments, set a lower cap of £35 where a lost or stolen card was not reported, and say that once you have told your provider, you are not liable for anything that happens afterwards unless you acted fraudulently².

In practice, most people pay nothing at all. Providers refund unauthorised transactions as a matter of routine, and the caps exist for the narrow case where a card was lost or stolen and the cardholder had not yet reported it. This page explains where those limits apply, when a refund can be refused, how to report a lost or stolen card, and what a fraud marker on your credit file means for borrowing later.

What counts as card fraud and an unauthorised payment

Card fraud is when a criminal steals personal information from your credit or debit card, or steals the card itself, and then uses that information to buy goods or services charged to your account⁶. The term covers several different situations, and which one you are in affects how you report it and what protection applies.

The Scottish Government's description of banking and credit industry fraud gives a sense of the range: fraud committed against a bank or financial institution using a false identity, credit or debit cards, cloned cards, cheque books or online accounts⁷. The National Crime Agency notes that some fraud types, such as card-not-present fraud, where the criminal uses card details remotely rather than the physical card, are increasing⁸. Digital wallets add another route: transactions you did not make are the headline warning sign of digital wallet fraud⁹.

An unauthorised payment, in the legal sense used by the Payment Services Regulations, is a transaction you did not approve. That includes someone using your physical card, someone using your card details online, and someone adding your card to a wallet or device without your knowledge. It does not include a payment you authorised but regret, such as goods that never arrive or a trader who misled you. Those are disputes, and for credit card purchases over £100 and up to £30,000 you have a separate right under Section 75 of the Consumer Credit Act to hold the card provider jointly liable with the trader for a breach of contract or misrepresentation⁴. Which? describes the effect simply: your credit card provider is jointly liable with the retailer if something goes wrong, so you can claim a refund for faulty goods or items that never arrive, even if you only put part of the cost on the card¹⁰.

The two routes are not interchangeable. Fraud is about a payment you never authorised; Section 75 and chargeback are about a payment you did make. If a criminal used your card details, you report fraud. If a shop took your money and broke the deal, you claim under Section 75. Some distance-sale purchases also fall outside the card rules entirely, for example financial services such as insurance and banking¹¹.

Warning signs: charges you don't recognise

The earliest and most reliable sign of card fraud is an item on your statement that you do not recognise. The Information Commissioner's Office lists exactly that, items you don't recognise appearing on your bank or credit card statement, as a warning sign of identity theft¹². Take Five, the national fraud awareness campaign, puts the habit plainly: check your transactions regularly for payments you don't recognise⁶.

Unrecognised charges are not always fraud. A shop may trade under a different name on statements, a family member with access to the card may have spent on it, or a recurring subscription may have renewed. But several signs together point to something more serious than a one-off card compromise:

• Unusual payments or direct debits appearing on your bank statements¹³
• Bills arriving for things you have not bought¹³
• Important mail going missing, or bins being tampered with, which can mean someone is taking your documents¹³
• New credit cards appearing on your credit record that you never opened¹³

That last sign matters because it means the problem has moved beyond your existing card. Criminals can use just a few of your personal details to apply for bank accounts, credit cards, benefits and official documents in your name¹³. In some cases criminals apply for a credit card in your name without you knowing and open a new account⁶. This is identity fraud, and it is a crime¹⁴. The practical response is the same in every case: inform your bank, building society and credit card company of any unusual transactions on your statement, and monitor your credit report for accounts you did not open¹⁵.

Your liability: at most £50, and in some rules £35

For credit cards, the Consumer Credit Act sets the outer limit. Sections 83 and 84 of the Act impose a limit of £50 liability for unauthorised transactions made before the card issuer is notified, where the card has been lost or stolen¹⁶. Which?, summarising the rules for consumers, describes the same limit: a cardholder's liability is capped at the first £50 of any unauthorised transactions made before the card was reported missing¹.

The Payment Services Regulations 2017, which sit alongside the older Act, set a lower figure for the same situation. Regulation 77 provides that a provider may require the payer to be liable up to a maximum of £35 for losses arising from the use of a lost, stolen or misappropriated payment instrument¹⁷. The Financial Conduct Authority's consumer guidance states the same: if your card was lost or stolen and you do not report it, you may have to pay up to £35 of the unauthorised transactions¹⁸. An FCA market study confirms the £35 figure as the deduction limit where the provider can show you had not taken reasonable steps to protect the security of your card, such as your PIN or online security details¹⁹.

The two caps describe the same worst case from two different rulebooks, and the lower one does not automatically replace the higher. The £35 cap under regulation 77 comes with an important exception: it does not apply if the loss, theft or misappropriation of the card was not detectable by you before the payment was made, unless you acted fraudulently, or if the loss was caused by the acts or omissions of an employee, agent or branch of the provider²⁰. In plain terms, if someone cloned your card or obtained the details without the physical card ever going missing from your pocket in a way you could notice, the conditions for charging you even £35 are not met.

You pay nothing once the card is reported

Once you have notified your provider, your liability ends. Regulation 77 of the Payment Services Regulations states it directly: except where the payer has acted fraudulently, the payer is not liable for any losses incurred in respect of an unauthorised payment transaction arising after notification³. So the report itself is the turning point. Everything charged before it may, at most, attract the £50 or £35 cap; everything charged after it is the provider's problem.

The timing of the report is therefore the one thing worth acting on quickly. The Consumer Standard of Caution, the industry code the largest banks have signed up to, sets the outer boundary for reporting: you must report the fraud as soon as you can, and no more than 13 months after the last fraudulent payment was made⁵. That 13-month window is a backstop for cases that surface late, such as fraud discovered during a credit file check, not a reason to wait.

One further rule works in your favour on PIN transactions. UK Finance, the banking industry body, states that if the correct PIN is entered, the card issuer will usually bear liability for fraud committed by the person using the card; if the cardholder discloses their PIN, responsibility may shift²¹. So a fraudster who knows your PIN does not automatically land the loss on you, but telling anyone your PIN, including someone claiming to be from your bank, weakens your position.

Where you can be liable for more: negligence, consent and fraud

The caps are not unconditional. The FCA's rulebook allows a firm to provide that a banking customer is liable for all losses in respect of unauthorised payments in two situations: where the customer has acted fraudulently, or where the customer has intentionally or with gross negligence failed to comply with obligations relating to the issue or use of the payment instrument or to keep its personalised security features safe²². Gross negligence means a significant degree of carelessness, not an ordinary mistake, and the burden of showing it sits with the firm.

Two other situations remove the caps entirely, and both involve someone you know:

• Card used with your consent. FCA analysis of the credit card market found there is no limit on the customer's liability for transactions made before notification where the card has been used by an individual who had the card with the cardholder's consent¹⁷. If you lent your card to a partner, friend or adult child and they spent more than agreed, that is a dispute between you and them, not unauthorised use in the eyes of the rules.
• You acted fraudulently. Fraud by the cardholder themselves removes every protection in this area, under both the Consumer Credit Act framework and the Payment Services Regulations³.

The line between negligence and ordinary behaviour matters in practice. Writing your PIN on the card, or sharing security details after a cold call, is the kind of conduct firms point to. Not noticing a card was taken from a bag, or missing a statement while abroad, is not. Where a provider refuses a refund on negligence grounds, the decision can be challenged through its complaints process and then the Financial Ombudsman Service, which is free. The Ombudsman has historically taken a firm line on the caps: in one published case about disputed cash-machine withdrawals, it found that under the Consumer Credit Act the cardholder's liability was limited to £50, regardless of any gross negligence²³.

Reporting fraud to your card provider quickly

The first call is to your card provider. NI Direct's official guidance is to speak to your bank or building society straight away if you think your credit card, online account or cheque book has been stolen or hacked¹³. Use the number printed on the back of your card or the provider's app, not a number from an email or text message, because fraudsters impersonate banks to catch people mid-panic.

When you call, the provider will normally stop the card, refund the unauthorised transactions, and issue a replacement. Keep a note of when you called and what was said, because the date of notification is what ends your liability for later losses³. If you believe you are a victim of fraud, you can also make a report to Report Fraud, the national reporting service²⁴. Reporting the crime does not get your money back, that is your provider's job, but it feeds the national picture and supports any later dispute.

After the immediate report, check your credit file. If the fraud went beyond your existing card, there may be accounts opened in your name that you know nothing about, and those do not stop just because one card was cancelled¹³. The steps in short:

1. Call your card provider on its official number and report the unauthorised transactions.
2. Ask for the card to be stopped and the charges refunded.
3. Report the fraud to Report Fraud²⁴.
4. Check your credit report for accounts you did not open.
5. If your identity was used, consider protective registration with Cifas (see below).
6. If the provider refuses a refund, complain to it in writing, then to the Financial Ombudsman Service.

Fraud prevention agencies and fraud markers

Behind the scenes, information about fraud is shared widely, and it is worth knowing what is held and who sees it. Credit reference agencies (CRAs) hold files used by lenders, and the Information Commissioner's Office explains that the information generated by the CRAs, for which they are responsible, includes financial links, linked addresses and alias information²⁶. The Welsh-language version of the ICO's guidance confirms the same data is also used to verify the identity, age and residency of individuals, to identify and track fraud, to combat money laundering and to help recover payment of debts²⁷.

Crucially, the CRAs have a special agreement in place which enables them to share information with each other about victims of fraud²⁶. So a fraud recorded with one agency will normally be visible through the others, which helps stop a criminal retrying your details with a different lender.

If there has been any fraud against you, for example if someone has used your identity, there may be a marker against your name on your credit file to protect you²⁸. MoneyHelper, the free government-backed money service, explains that a Cifas marker may be added to your credit file to warn lenders that your identity has been compromised²⁹. You can see this marker when you check your own file. National Debtline's guidance is blunt about the consequence: identity fraud can affect your ability to get credit, such as loans and mortgages³⁰.

You can also add a marker yourself. The ICO advises contacting Cifas, the UK's Fraud Prevention Service, to apply for protective registration, which places a warning flag against your name and other personal details on the National Fraud Database³¹. Lenders then know to carry out extra checks before opening anything in your name. The trade-off is that extra checks mean extra friction: applications in your name, including your own, may take longer or require more proof of identity.

You have the right to see what is held. The Financial Ombudsman Service confirms you can go directly to a fraud prevention agency if you want to find out whether they hold information about you, and that you have a right to ask any organisation if they are using or storing your personal information and to request copies of it³². Citizens Advice adds the practical detail: you can check your credit record yourself by contacting one of the credit reference agencies, and there is a small fee³³.

Your data held for up to six years: your right to see it

Whatever is held about you, it does not stay there forever. Information about you is usually held on your file for six years, as Citizens Advice explains in its guidance on how lenders decide whether to give you credit²⁸. Your credit file shows details of your finances for the last six years, including whether you are a good payer and any court orders you have had in that period³³.

The six-year rule applies to the negative records as well as the neutral ones. StepChange notes that some information stays on your credit file for six years, including missed payments, defaults and court judgments³⁴. The Financial Ombudsman's own published material confirms that a default will stay on the consumer's credit file for six years³⁵. A fraud marker sits alongside this history rather than replacing it, and a lender reading your file sees both: the six years of conduct, and any warning flag about your identity.

This is why checking your file after a fraud matters twice over. First, it reveals accounts opened in your name¹³. Second, it lets you confirm that nothing the fraud caused, such as missed payments on an account a criminal opened, is sitting on your record unchallenged. If a fraud-related entry is wrong, you can dispute it with the agency that holds it, and take the dispute to the Information Commissioner's Office or the Financial Ombudsman if it is not resolved.

Where to get free help

You do not need to pay anyone to deal with card fraud. Your card provider's refund process and the Financial Ombudsman Service are both free, and the Ombudsman can look at complaints about fraud and scams, including disputed fraud markers³². Card fraud generated 5,783 complaints opened with the Ombudsman in the first quarter of 2026/27 across credit cards alone, so disputed refunds are a well-trodden path³⁶.

Free, independent guidance is available from:

• MoneyHelper, the government-backed money and pensions service, which explains fraud types and markers²⁹
• National Debtline, which publishes guidance on dealing with fraud and its credit consequences³⁰
• Citizens Advice, which covers card misuse, credit records and how lenders decide whether to give you credit²⁸
• The Information Commissioner's Office, for questions about what data is held about you and how to see or correct it²⁶
• Take Five, for straightforward advice on avoiding card and digital wallet fraud in the first place⁶

If the fraud has left you with debts that are not yours, StepChange's guidance on debts not in your name is the place to start, because identity fraud is a crime and the resulting liabilities can be challenged¹⁴. For the wider picture of card protections, see the guides to Section 75, chargeback and complaining about a credit card provider, or the overview of credit cards.