Who Pays When Merchants Are Victims of Credit Card Fraud?

It's rarely the consumer. Instead, liability usually comes down to the merchant or the bank that issued the card.
Gregory Karp
By Gregory Karp 
Updated
Edited by Kenley Young

Many or all of the products featured here are from our partners who compensate us. This influences which products we write about and where and how the product appears on a page. However, this does not influence our evaluations. Our opinions are our own. Here is a list of our partners and here's how we make money.

You, the consumer, typically aren’t liable for credit card fraud, but someone pays the tab.

So who foots the bill when a thief uses your credit card or its number to illegally buy stuff? The short answer is it’s typically the merchant where you bought something or the bank that issued the credit card. It depends on the circumstances.

Credit card fraud is no small problem. As the most common type of identity theft each year, reported dollar losses in 2019 were about $135 million, according to the U.S. Federal Trade Commission. If you haven’t yet been a victim of credit card fraud, count yourself lucky. If you have, it’s probably not your fault. Card numbers get stolen in a variety of ways, including credit card security breaches at major retailers.

Here’s who pays when a thief illegally uses your credit card or its number to buy goods or services.

When cardholders pay

The short story is: rarely. If a credit card has been compromised, the card issuer typically cancels the old number and issues a new card with little fuss.

Why? It's because banks and credit card networks, such as Visa and Mastercard, have policies that promise consumers won’t be responsible for unauthorized charges, often termed "zero-liability policies."

Even better than their promise is U.S. federal law, specifically the Fair Credit Billing Act. It limits your liability for unauthorized use of your credit card to $50.

Again, as a practical matter, credit card networks waive even that $50 liability.

More broadly, however, U.S. credit card fraud over time raises retail prices for consumers, as businesses pass along the cost of fraud.

Stop fraud in its tracks
With a NerdWallet account, you can see all of your credit card activity in one place and easily access your credit report to spot any red flags quickly.

When merchants or banks pay

This can get tricky and could come down to whether the fraudulent transaction involved an actual card — called "card-present" fraud — or just the credit card number, called "card-not-present" fraud. Examples are a card dipped into a payment-card reader in a retail store versus paying for an online transaction by typing in a credit card number.

Generally, the bank is more likely to be liable for the fraud for card-present transactions, while the merchant might get stuck with the cost for transactions without a physical card. (Merchants using the older swipe payment terminals and not the newer chip readers also incur more liability.)

The rules on liability are dictated by the credit card network the transaction used, such as Visa, Mastercard, American Express or Discover.

And there are additional internal system costs for disputing the fraudulent charge — called a chargeback. That could mean that regardless of liability, the bank, for example, could make a business decision not to pursue reimbursement for fraud from the merchant and simply absorb the cost.

In addition, major credit card issuers — typically banks — have many fraud-related business costs other than reimbursing the customer for a fraudulent purchase. They pay to operate fraud departments, employ customer service representatives to answer fraud calls from consumers and incur the cost to replace compromised cards with new ones, for example.

When networks pay

Networks, such as Visa and Mastercard, act as a clearinghouse for the transaction and typically aren't liable for unauthorized charges.

What about the thieves?

Arrest and conviction rates for credit card fraud are hard to come by, but it’s safe to say those rates are low. That means thieves don’t often pay.

What’s different with debit card fraud?

If you report an ATM or debit card missing before someone uses it, you aren't responsible for unauthorized transactions, according to the Electronic Fund Transfer Act.

If someone uses your card before you report it lost or stolen, your liability depends on how quickly you report it. It ranges from $50 to $500 or even unlimited liability.

Again, liability between the merchant and card issuer is dictated by the rules of the card network that processed the transaction. And the debit card’s network or card issuer might have additional protections beyond federal law.

Find the right credit card for you.

Whether you want to pay less interest or earn more rewards, the right card's out there. Just answer a few questions and we'll narrow the search for you.

Get Started
Get more smart money moves – straight to your inbox
Sign up and we’ll send you Nerdy articles about the money topics that matter most to you along with other ways to help you get more from your money.