Credit card scams

Using another person’s credit or debit card, or card number, without permission is a crime in Kentucky. Federal law limits how much a cardholder can lose to fraud, but the protection is much stronger when the loss is reported quickly.

Common ways card information is stolen

• Skimmers. A hidden device on a gas pump, ATM or store terminal copies a card’s data.
• Phishing. An email, text or fake website poses as a bank or other trusted sender and asks for a card number, password or PIN.
• Phone scams. A caller posing as the card company’s fraud department asks for the security code or a one-time passcode.
• Card-not-present fraud. A thief uses a stolen number to shop online or by phone.

How much a cardholder can lose

For a credit card, federal law caps liability for unauthorized charges at $50, and only for charges made before the issuer is notified. If the loss is reported before the card is used, or if only the account number was stolen, the cardholder owes nothing.

Debit and ATM cards carry more risk. Under the federal rule known as Regulation E:

• If the loss or theft is reported within two business days after the cardholder learns of it, liability is limited to $50.
• If it is reported later, liability can reach $500.
• If unauthorized transfers on a statement are not reported within 60 days after the statement is sent, the cardholder can lose all the money taken after that period.

What to do right away

Consumer agencies recommend these steps:

• Report the loss or the charges to the card issuer or bank right away.
• Follow up in writing and keep a copy.
• Review statements and dispute any unrecognized charge.
• Change online banking passwords and PINs.
• If other personal information was exposed, consider a free fraud alert or credit freeze with the credit reporting agencies.

Kentucky crimes and reporting

Kentucky law makes it a crime to steal a card, to use a stolen, forged, expired or revoked card, or to pose as the cardholder to obtain money or goods. Fraudulent use is a Class B misdemeanor when the amount obtained over six months is under $500, a Class A misdemeanor from $500 up to $1,000, a Class D felony from $1,000 up to $10,000, and a Class C felony at $10,000 or more. Using a skimming device (KRS 434.675) is a Class D felony for a first offense, and phishing (KRS 434.697) is a Class D felony.

Card fraud can be reported to the issuer and to local police. Scams can also be reported to the Kentucky Attorney General’s office online and to the Federal Trade Commission at ReportFraud.ftc.gov.