What to do if you gave your card details to a fraudster

If you have given your card number, expiry date and security code to a fraudster, contact your bank or card provider immediately. Those three pieces of information are enough for someone to make purchases on your card¹. The Financial Ombudsman Service's advice for scam victims is to contact your bank or payment services provider immediately, contact the police on 101, report the scam to Report Fraud, and keep records of all contact and correspondence between you and the scammer².

Speed matters because of how liability works. You are not liable for any unauthorised payments taken after you tell the bank that your card has been stolen or that someone else has got hold of your security details³. The sooner you make that call, the clearer the line between what you authorised and what you did not.

This page sets out what a fraudster can do with the details you gave away, how to spot that your card is being used, how your details were probably captured, and how to protect your card and credit file from further fraud.

Tell your bank or card provider immediately

The first call is to your bank or card provider, using the number on the back of your card⁵. If you think your credit or debit card, online bank account or cheque book has been stolen or hacked, speak to your bank or building society straight away⁶. If you have paid for a fake ticket or shared your financial information with a criminal, contact your bank immediately⁷.

Identity fraud involving plastic cards, online banking or cheques should be reported directly to the financial institution concerned⁸. If your identity has been stolen, contact your bank, credit card company and the local police on the non-emergency number, 101, as soon as possible⁹.

There is a second reporting route. Report Fraud, formerly known as Action Fraud, takes reports of scams and fraud¹⁰. The Financial Ombudsman Service lists the same sequence: bank or payment provider first, then the police on 101, then Report Fraud, and keep records of all contact and correspondence between you and the scammer². Those records matter if the case later goes to the ombudsman.

If you are worried you have given your payment details or money to a scammer, contact your bank or payment provider as soon as possible and explain what has happened¹¹. If you have lost money or spotted an unauthorised transaction on your account, contact your bank immediately using the phone number on the back of your card⁵.

What a fraudster can do with your card number, expiry date and security code

Card fraud is when a criminal steals personal information from your credit or debit card, or steals the card itself⁷. If someone knows your card details such as the 16-digit number, expiry date and the security code, then they can make purchases¹. Criminals then use this information to purchase goods or services, which will be charged to your card⁷.

The damage is not always limited to your existing card. Card ID theft is when a criminal uses a fraudulently obtained card or card details, along with stolen personal information, to open or take over a card account held in someone else's name⁷. In some cases, criminals apply for a credit card in your name without you knowing and open a new account⁷.

Identity fraud more broadly covers a wider set of uses. When a criminal uses your personal information to obtain goods or services or to open accounts in your name, that is identity fraud¹². Fraudsters can use your identity details to open a bank account; obtain credit cards, loans and state benefits; order goods in your name; take over your existing accounts; take out a mobile phone contract; and obtain genuine documents, such as passports and driving licences, in your name¹³. Using just a few of your personal details, criminals can apply for bank accounts, credit cards, benefits and official documents in your name⁶.

Once they have your information, they can buy things with your money, open new accounts and apply for loans in your name, or have new credit or debit cards sent to them¹⁴. They can also take out credit in your name, such as a loan or credit card, take money from your bank account, apply for benefits in your name, buy goods in your name, or obtain documents such as a driving licence or passport in your name¹⁵.

Signs your card details are being used

The clearest sign is on your statement. Items that you do not recognise appear on your bank or credit card statement⁴. The same warning sign is listed by the Information Commissioner's Office: items that you do not recognise appear on your bank or credit card statement¹⁶.

Other signs of identity theft include unusual payments or direct debits appearing on your bank statements, important mail going missing, recycling bins and rubbish bags being tampered with, bills arriving for things that you have not bought, and new credit cards appearing on your credit record⁶. Messages saying your card was added to a new device are another warning sign¹⁷. Stolen details are then used to access your account and make unauthorised payments¹⁸.

A card can also be rejected even when you have money. If you were sure you had funds in your account but your card was rejected, or if you have spotted unusual activity in your transaction history such as purchases or withdrawals, that is a warning sign¹. Banks can refuse a payment because of suspected unlawful or fraudulent use, and the reason has to be given unless the bank suspects you of fraud or money laundering¹⁹.

How your details were likely captured

Card information can be captured from company data breaches, compromised cash machines, compromised webpages, and bogus texts and emails²¹. Card fraud can happen if your card is stolen, copied, or if your details are taken through a phishing message, data breach or online scam²². A fraudster may get access to your card details by intercepting your account information when you are shopping or subscribing online, stealing your card, or cloning your card using a swipe machine¹⁴. They may do this by stealing your card or finding out the card number, expiry date and security code²³.

Some methods rely on pressure rather than technology. Fraudsters will attempt to stir a panic in you so that you will reveal your card details over the phone²⁴. Others rely on impersonation: fraudsters call you pretending to be your bank, or another company you trust, and say they will send a one-time passcode to confirm your identity. Really, they are trying to use your card details to make a fraudulent payment, and know the bank will send you a code to check whether it is genuine. When you share the code with them, they use it to authorise the payment²⁵.

Fake messages are a common route. Some fraudsters send emails purporting to be from reputable organisations such as the Post Office. These invite you to click a link to a fraudulent website asking for bank account or payment card details²⁶. Parcel delivery scams work in a similar way: a postcard from a fake delivery company claims a parcel is waiting and asks you to call a number, then requests payment by credit card for a non-existent package²⁷.

Is it card fraud if I paid for discounted goods that never arrived?

Paying for goods that never arrive is not the same as someone using your card without your permission, though the two can overlap. Remote purchase fraud, also called card not present fraud, is when a criminal uses stolen card details to buy something on the internet, over the phone or through mail order⁷. Card-not-received fraud is when a card is stolen in transit, after a card issuer sends it out and before the genuine cardholder receives it⁷. Some fraud types, such as card-not-present fraud, are increasing²⁹.

If you paid a seller directly and the goods never came, that is a dispute with the seller rather than card fraud, but your bank is still the first call. If you think you have paid for a fake ticket or shared your financial information with a criminal, contact your bank immediately⁷. If you do think you might have been scammed, contact your bank immediately and report it to the police at Report Fraud³⁰.

Gift cards are a separate case. Fraudsters take the codes from the physical cards displayed in the shop and then steal the funds once money has been loaded onto them³¹. If you think you have been conned in a gift card scam, contact your bank and the gift card provider immediately to try and recover your money. Sometimes the gift card provider will be able to block the gift card³¹.

Protecting your card and credit file from further fraud

Start with your statements and your credit report. Regularly check your credit card and bank statements for suspicious activity and monitor your credit report⁴. If there has been any fraud against you, for example if someone has used your identity, there may be a marker against your name to protect you. You will be able to see this on your credit file³².

Cifas Protective Registration places a warning flag against your details. This tells any creditor using their information to carry out extra checks when your details are used to apply for credit or goods³. The Information Commissioner's Office lists the steps to take after a personal data breach: report details of lost or stolen documents, such as passports, driving licences, credit cards and cheque books, to the issuer; check bank statements and credit report; watch out for phishing; use strong passwords and multifactor authentication; and apply for Cifas protective registration³³.

Everyday habits matter too. Keep your card safe and shield your PIN whenever you enter it⁷. Set up bank alerts in your app so you know when your card has been used¹⁷. Some banks send transaction notifications when you spend on your card, as well as when a payment is made from your online bank account³⁴. Others send real-time alerts of transactions and declined transactions³⁵.

If your card is lost or stolen you may be protected against fraudulent activity and will not be liable for any losses, unless you have given your card to someone³². If you contact your bank, you may be able to recover money you have lost in unauthorised or unexpected payments³⁶.

How to check a call or text is really your bank

If you are unsure whether a message is genuine, call your bank immediately on the number on the back of your debit card³⁵. If you want to double check a caller is genuine, hang up and ring your bank or card company directly using the numbers given when you opened your account²⁹. Challenge the caller with sceptical questions, ask for the name of the company conducting the call and its fraud department contact, and if you are not satisfied, hang up²⁹.

The one-time passcode scam is the method to watch for. Fraudsters call you pretending to be your bank, or another company you trust, and say they will send a one-time passcode to confirm your identity. Really, they are trying to use your card details to make a fraudulent payment, and know the bank will send you a code to check whether it is genuine. When you share the code with them, they use it to authorise the payment²⁵.

Bank outages create openings too. Sometimes the Financial Ombudsman Service hears from people who were scammed by fraudsters who used a bank outage to trick them into sharing their bank details, for example pretending to call from the bank and offering to help³⁰.

Where to get free help

Several organisations offer free, impartial help. The Financial Ombudsman Service handles complaints about scams involving unauthorised payments and identity theft, and about IT problems at banks². If your bank refuses a refund, you can complain, and if that fails, take the case to the ombudsman.

Age UK offers support for scam victims³⁷. National Debtline publishes guidance on dealing with fraud¹⁵. The Information Commissioner's Office covers identity theft and what to do after a personal data breach⁴. MoneyHelper explains basic bank accounts if you need a simpler account while things are sorted out¹⁹.

If you are helping someone else who has been targeted, the same first steps apply: contact the bank, report to the police and Report Fraud, and keep records².