How do people steal credit card numbers?

There is seemingly no limit to how thieves get their grubby hands on somebody else’s credit card numbers, but here are a few key ways to understand what sometimes occurs:

Data breaches. According to the Privacy Rights Clearinghouse, thieves have stolen more than 10 billion records from approximately 9,000 (and counting) data breaches since 2005 (that includes not just credit card numbers but passwords and passports). If you see a news headline about a data breach, it just means a hacker has accessed a corporation’s database and stolen information, credit card numbers or something else, from it.

Phishing. This occurs when a crook emails and tricks you into giving up your credit card or other personal information. For instance, the thief may try to convince you to click a button or link that takes you to a fake store with the hopes that you’ll enter your credit card information to make a purchase. Behind the scenes, the crook watches all you enter and steals your info.

Malware. This refers to viruses designed to exploit your device or programs. Depending on the virus, you could type in your credit card information on a store website or something similar, and hackers somewhere in the world have your credit card number, the expiration date, and, ah, yes, the three-digit security code.

Keylogging. Criminals will sometimes install software on your computer – either by sneaking into your office, or sending it via spyware (a type of malware that spies on your computer). Keylogging software allows a crook to see everything you type. That includes passwords and credit card numbers – as well as all of the webpages you visit, whether a silly pop culture blog or some X-rated site you’d never want people knowing you go to, or your bank website. Keylogging software commonly ends up on your device via a phishing email.

Credit card skimmers. Credit card skimming devices attach to a credit card and debit card payment terminal, often a gas station pumps or ATM. When you run your card through to pay for your gas, the skimmer stores your credit card information for the thief to later recover.

Simply seizing an opportunity. Restaurant workers have stolen credit card numbers when they have a card in their possession (it probably doesn’t happen often, but you’ll see stories about it in the news sometimes). Leaving your credit cards in your hotel room for somebody who works there to come in and record the numbers also occurs (again, it probably doesn’t happen often, but it can happen). In both cases, your card is technically still in your possession, but the damage is done.

And, of course, there are just old-fashioned opportunistic pickpockets who can swipe your wallet or steal a credit card that’s in an envelope in your mailbox or steal a credit card financial statement from your garbage and the list goes on (thieves are, unfortunately, creative). Given that it isn’t hard to find out a person’s address these days, the numbers from your credit card are likely enough to make it possible for a thief to use your card account.

So keep those credit cards as close to you as possible.

Most often, with stolen credit cards people buy merchandise for themselves and to sell, often electronics and luxury items. If someone has stolen your physical card, they often sprint to a brick-and-mortar store and buy a bunch of stuff quickly – and then toss the card before they’re caught or as soon as they max out the limit.

Usually, crooks aren’t stupid enough to do online shopping and send products to their house with a stolen credit card, but that doesn’t mean they can’t shop online and send the items elsewhere. Remember, too, that entering billing information isn’t hard to do these days when most people’s addresses and contact info are so readily available online.

Some criminals will handle the theft of your credit card number like a business – and sell it (and the hundreds or thousands of other credit card numbers that they have found) to other crooks.

Also keep in mind that your debit card isn’t safe either if somebody makes off with your wallet. You may think to yourself, “Well, nobody knows my PIN,” but at many retail establishments, you can often still run your debit card as “credit,” which can make your PIN useless.

It’s going to be a hassle to deal with a stolen credit card, but you can quick steps to ease the burden: 

1. Call the police (in some cases). If it’s a situation where you were robbed or your wallet was taken, the police should be your first call. If it’s that you were hacked and this was a completely non-violent theft, it’s better go to step two first. Customer service can advise you on whether you should call the police.
2. Call your credit card issuers immediately. Chances are, they already know or have called you (credit card companies are pretty good at knowing, for instance, that you live where you live and that when somebody starts using your card 4,000 miles away, it probably isn’t you). Tell the customer rep what has happened, and they’ll put a stop to any more spending on your card or cards – and they’ll send you replacements with new numbers.
3. Consider putting a freeze on your credit. It’s a drag to have to do this, but you could freeze your credit report, which should keep random strangers from getting access to your file. That’s important because now a crook can’t use your good name to get a loan – because the lender won’t be able to check your credit report to approve the loan. If you, down the road, want to apply for a credit card or a car loan or whatever, you’ll need to lift the credit freeze – and reestablish it, if you think you’re better off with your credit report frozen. To freeze your credit report alert each of the three main credit reporting firms: Equifax, Experian and TransUnion. 

There are several strategies you may want to try to prevent your credit cards from being stolen. In no particular order, here we go:

Keep your wallet in a smart spot. If you typically keep your wallet in your back pocket, in a big city, put it in your front pocket, making it difficult for pickpockets to remove your wallet. If you carry a purse, have it so that the strap is diagonally across your chest (it’s much harder for a thief to grab it and run), or you could use a short-strapped purse, if you tuck it under your arm. And don’t leave your purse anywhere, where somebody could rifle through it when you aren’t looking, like in a grocery cart.

Keep your computer and devices protected. Hopefully we’ve all gotten the memo by now, this deep into the 21st century, but make sure your computer has formidable anti-virus protection.

Live your best digital life. To prevent your credit cards from being stolen by the rare rotten apple working at a restaurant or hotel, or from a pickpocket thief, you may want to leave your credit cards securely at home – and put the credit cards on your phone and pay that way. Just make sure your phone isn’t stolen (or that it’s properly locked).

Keep an eye on your card during in-person transactions. This can be tough. You hand your card over to a fast food employee or a waiter, and for maybe a minute or so, your card is out of your sight. (Don’t give the employee any grief; they’re probably underpaid and overworked as it is.) But in general, you want to try to keep an eye on your card when you hand it to somebody.

Check your credit card statements regularly. Check your credit card and bank websites regularly (every day is a good idea). The last thing you need is to not know that your credit card, or debit card, has been stolen, and for days or weeks to pass, with you blissfully unaware as to what’s happened.

Staying informed is important, particularly when it comes to debit cards. Laws do a decent job of protecting credit cardholders from being on the hook for fraudulent purchases, but debit cardholders don’t have the same protections. If your debit card is stolen, you could be out all that money depending on how quickly your report the theft.

Only use secure websites. Look for websites in which the URL starts with https:, instead of http:. If a website goes with “http:,” that doesn’t mean it’s a crooked website at all – the person running the website may be as honest as the day is long – but it does mean that there are no safeguards to protect your information… and so you are more at risk for getting hacked.

Don’t give your account number over the phone. It’s a good practice to get into. Obviously, there may be times when you feel like you have to give out your credit card number. You’re past due on a bill with your doctor’s office, and they ask for your credit card account number, and you know you’re talking to your physician’s office – you were the one who called them – and you don’t feel like putting off making the payment any longer. So you give out the number.

In other words, use your common sense and best judgment, but at the same time, there’s no harm in being paranoid about giving out your credit card number. If you can avoid giving out your credit card account number over the phone, you’re increasing your odds that you won’t have your financial information compromised.

Remove credit card information from e-commerce sites. Yeah, your favorite stores ask if they can store your credit card information to save you time later from typing out the information, but it does mean you’re increasing your odds of being hacked. Generally, yes, having your credit card info stored a trusted reputable brand’s website isn’t going to lead to anything nefarious at all.

That said, no website is 100% hack-proof. And if you do have your information stolen, your dealing with the financial and paperwork headaches to come will be a much bigger time waste than retyping a credit card number, date and security code into a store’s website.

A lot. If somebody spends money using your credit card, you aren’t out much and probably nothing – the credit card company, however, is. So they have a lot of incentive to make sure that your credit cards aren’t stolen. You need to try and do your part, of course, like having anti-virus protection on your computer and not leaving your wallet in your unlocked car where a thief might pass by.

All of the major credit card issuers, however, have been partnering with technological companies and employing artificial intelligence to come up with algorithms designed to detect credit card fraud.

Credit card companies are always working on new ways to prevent theft. The security code on the back of your card is one safeguard, and a popular method among some credit cards is to allow cardholders to use a lock feature that essentially turns off their credit card, so it can’t be used, unless the cardholder wants to turn it on and use it.

Many credit cards issuers also monitor the “dark web,” the part of the internet that isn’t indexed by search engines, like Google and Bing. That’s where crooks often sell stolen credit card numbers.

So you might understandably be concerned about credit card theft, but it’s the credit card executives and their tech teams who are likely losing sleep over this as laws are pretty explicit that the bank, not the cardholder, is on the hook for the lost funds in most cases.

Yes, but it’s unlikely. That isn’t to say that it won’t happen, just that it doesn’t very often. Thieves who have scanners may be able to pick up the faint radio signals that are in RFID chips that some credit cards have, if they manage to get about an arm’s length away from you. It reportedly happened, for instance, to a shopper in Holly Springs, North Carolina, last year, where thieves apparently had a credit card reader or scanner and managed to get a hold of a woman’s credit card information while she was in a Walmart. She received an alert from her credit issuer that somebody had made purchases with her card – while she was still in the store.

Not that it’ll make you feel any better, but your odds are probably far higher of having your credit card stolen in some way, like a database being hacked, or you accidentally getting malware on your computer and having thieves steal your credit card and other personal financial information that way.

There’s actually no sure-fire way to know if your credit card information has been stolen, unless somebody actually tries to use it, and you have proof that it was taken. Or perhaps if a business shares with you that their database was hacked, and that your personal information was taken. However, there are strategies to try that can uncover whether somebody has taken your credit card number.

First, as a quick reminder, don’t go to any website that asks you to give out your credit card information and its expiration date, so you can determine if it was stolen. There are such types of websites out there that you might easily stumble upon if you go looking online for articles about stolen credit cards. Please don’t use them. That’s a good way to get your credit card number stolen.

Secondly, you can and should contact the three major U.S. credit bureaus (Equifax, TransUnion and Experian) and look at your credit reports every so often. During typical times, you can get one free credit report a year by going to AnnualCreditReport.com and requesting a report, so generally, it’s advised that every four months, you ask for a report, and then three times a year, you’re getting a new report. Learn more about why this is important.

Since the pandemic began, people have been allowed to get free weekly access to those credit reports – and they’ll be able to until April 20, 2022, unless, of course, the deadline is extended.

Meanwhile, many banks and credit cards offer free credit scores, and checking those out, too, sometimes may lead a consumer to realize that their personal identification may have been compromised – if, say, their credit score has mysteriously plunged from 740 to 590.

A little, but odds are, you won’t pay a dime, even if a thief spends thousands of dollars with your credit card. The Fair Credit Billing Act limits your liability for unauthorized use of your credit card to $50 – but the four major credit card networks (Visa, Mastercard, Discover and American Express) offer $0 liability if you have your credit cards stolen.

That’s one argument for using credit cards over debit cards. If you miss the fact that your debit card was stolen and don’t report it stolen for two or more business days,  you could be liable up to $500. If somehow two months goes by, and then you realize you had money stolen from you via your debit card, you may be liable for all of your losses.

So the odds are pretty good that you will not be paying anything if your credit cards are stolen. That said, you do want to act fast if they are. You don’t want shady people doing who knows what with your credit card – and if they have other personal information of yours, like your Social Security number, your problems are just starting, and stolen credit cards are, in a way, the least of your problems.

Unfortunately, yes, credit card fraud can impact your credit if the fraudulent activity ends up in your credit report. The good news, however, is that once you detect and report the fraud, the fraudulent transactions or accounts can be removed from your report and should no longer impact your credit. Learn more about how to dispute and fix credit report errors.

If you’re a victim of identity theft, this could also impact your credit as someone could use your identity to open a new credit card in your name, triggering a hard inquiry on your credit report. The good news is this shouldn’t ding your credit too much, but on the flip side, you might not even realize you’ve fallen victim until checking your credit report. This is why it’s important to keep a close eye on your credit report, checking it no less than once a year, but ideally every four months as you’re allowed a free report from each of the three major reporting agencies once a year. If you stagger your requests, you should never have to go more than a few months at a time without a free report.

>>MORE: Protecting your credit following identity theft