Home > Security Guides > What to Do If Your Credit or Debit Card Was Exposed in a Data Breach

What to Do If Your Credit or Debit Card Was Exposed in a Data Breach

Your card showed up in a data breach. Follow these steps to replace the number, dispute fraud within the legal deadlines, and stop follow-up scams.

m00s3c
November 2, 2026
November 2, 2026

When a store, travel site or payment script is breached, card numbers are often the first thing criminals sell. Revolve disclosed in October 2026 that saved card numbers and expiration dates may have been taken, and its state breach report puts the total at 1.5 million people, and skimming code on hacked checkout pages has been grabbing card numbers, expiry dates and security codes as shoppers type them. This guide walks you through what to do if a breach notice says your credit or debit card was exposed, or you think you shopped on a skimmed site, from the first phone call to closing the case.

Moving fast matters most with a debit card. A stolen debit card number drains your own bank account, and federal liability limits for debit cards depend partly on how quickly you report.

Before you start

Have the breach notice, or the name of the store and the dates you shopped there.
Have the physical card or your latest statement, so you can find your issuer’s real phone number.
Open a note or a folder. You will record every call, case number and letter.

Step 1: Find out exactly what card data was exposed

Read the notice closely. It should list the data types involved, the dates of the incident and a contact number. Card breaches usually fall into 2 groups:

Card number and expiration date only. Criminals can still try online purchases, especially at sites that do not ask for the security code.
Card number, expiration date and security code (CVV), often with your name and address. This is what checkout skimmers collect, and it is enough for most online fraud.

Also note whether your password, phone number, Social Security number or bank account number was listed. Those need extra steps, covered in Step 9. If you are not sure the notice itself is real, check it first with our guide on how to tell if a data breach notification letter is real. Do not call a number printed only in the notice until you have confirmed it.

What success looks like: you know which card was involved, what data was taken and the date range of the breach.

Step 2: Call your card issuer using the number on the back of the card

The FTC’s IdentityTheft.gov data breach page says to contact your bank or credit card company to cancel the card and request a new one, using a phone number you know is real, like the number on the back of your card or on your statements. You can also use the issuer’s official app or website if you type the address yourself.

Tell the agent your card was exposed in a data breach, name the company and give the dates. Ask them to note your account and give you a reference number. Write down the date, the time and the agent’s name.

What success looks like: your issuer has a record that the card was exposed, and you have a reference number.

Step 3: Lock the card and ask for a new card number

Many issuers let you lock or freeze a card instantly in their app, which blocks new purchases while you sort things out. A lock is temporary. To fully protect yourself, ask the issuer to close the card and send a replacement with a new number. A replacement with the same number and a new expiration date does not fix a stolen number.

If the exposed card is a debit card, ask whether any pending transactions can be stopped, and ask how long the new card will take to arrive so you can plan for bills.

What success looks like: the old card number is closed, and a new card with a different number is on its way.

Step 4: Review every transaction since the breach window

Sign in to your account and read every transaction from the start of the breach dates to today, including pending ones. Look for:

Small test charges of a dollar or less, which criminals use to check that a card works.
Charges from merchants, apps or countries you do not recognize.
New subscriptions or digital wallet enrollments you did not set up.

Then repeat this check each time a new statement arrives for the next few months. IdentityTheft.gov advises reviewing transactions regularly and calling the fraud department to get any fraudulent charges removed.

What success looks like: you have a list of every charge you did not make, with dates and amounts, or you have confirmed there are none.

Step 5: Dispute unauthorized charges and know your limits

Report every unauthorized charge to the issuer right away. Federal law caps what you can lose, but the rules differ for credit and debit cards.

Credit cards: the CFPB’s dispute guidance says to call the card company and also send a written billing error notice within 60 calendar days after the charge appeared on your statement. Under Regulation Z, your liability for unauthorized use is capped at $50, and the official interpretation says you cannot be held liable when only the account number was used, for example in a phone or online order.
Debit cards: the CFPB’s unauthorized transaction guidance says that if you still have the card but someone used the number, you must notify your bank within 60 days after it sends the statement showing the charge. If you wait longer, you could have to pay for transactions after that 60 day period. If the card or PIN itself was lost or stolen, reporting within 2 business days limits you to $50, and later reports can cost up to $500.

For debit disputes, the bank generally has 10 business days to investigate. If it needs more time, it must generally give you a temporary credit, minus up to $50, and resolve the case within 45 days, or up to 90 days for some transactions such as debit card point of sale purchases. If the bank asks you to confirm your phone report in writing, do it within 10 business days to keep the temporary credit.

What success looks like: every unauthorized charge has an open dispute or has been reversed, and you have sent any written notice the issuer asked for.

Step 6: Update automatic payments and saved cards

Once the new card arrives, update every service that charges the old number, such as phone, streaming, utilities and insurance. IdentityTheft.gov specifically reminds breach victims to update automatic payments with the new card number. Missing one can mean a late fee or a cancelled policy.

While you are signed in, delete saved cards from shopping sites you rarely use. Every saved card is one more place your number can leak from. Think twice before saving the new card again at the breached company.

What success looks like: every recurring bill uses the new card, and old saved cards are removed from sites you no longer use.

Step 7: Turn on transaction alerts and pay with a mobile wallet

In your issuer’s app or website, turn on alerts for every purchase, or at least for online purchases, card not present purchases and purchases over a small amount. Alerts turn a stolen number from a month-long problem into a same-day phone call.

Where you can, pay with a mobile wallet instead of typing your card number. Apple’s Apple Pay security page says the issuer creates a device-specific Device Account Number, and neither Apple nor your device sends your actual card number to the store, app or website. A merchant that never receives your real number cannot leak it.

What success looks like: you get an alert within minutes of every charge, and your everyday purchases go through a mobile wallet where possible.

Step 8: Watch for fake fraud calls and texts

Breached card data is often followed by scam calls and texts that claim to be your bank’s fraud department. The caller may already know your name, the last 4 digits of your card and the store that was breached, because that data was in the leak.

Never share a one-time code, PIN, full card number or online banking password with someone who contacted you.
Never move money to a “safe account.” Your bank will not ask you to do that.
Hang up and call the number on the back of your card. Caller ID can be faked.

If you were tricked or lost money, call your bank first, then report it to the FTC at ReportFraud.ftc.gov.

What success looks like: you only talk to your bank on calls you started, using a number you trust.

Step 9: Decide whether you also need a credit freeze

A card number alone cannot be used to open new accounts in your name, so a stolen card number by itself does not usually require a credit freeze. Add these steps if the notice listed more than your card:

Social Security number or date of birth: freeze your credit at all 3 bureaus with our guide on how to freeze your credit after a data breach, and follow what to do if your Social Security number was exposed.
Account password: change it on the breached site and anywhere you reused it. Our password generator creates strong random passwords.
Bank account number: IdentityTheft.gov advises contacting your bank, closing the account and opening a new one.

IdentityTheft.gov also says you can check your credit reports online every week for free at AnnualCreditReport.com. If your issuer will not fix a valid dispute, you can file a complaint with the CFPB at consumerfinance.gov/complaint or by calling (855) 411-2372.

What success looks like: every type of exposed data on the notice has a matching action, and you have a reminder to check your reports and statements again next month.

Common mistakes

Waiting for fraud to show up before calling. Your losses are lowest when you report before anyone uses the card.
Accepting a replacement with the same card number. Ask for a new number, not just a new expiration date.
Calling the number in a text or email. Use the number on the back of the card or your statement.
Only calling about a credit card dispute. Send the written billing error notice too, so your legal rights are protected.
Forgetting the debit card. Debit fraud takes your own money, and the reporting clock matters more.
Saving the new card everywhere again. Use a mobile wallet or save cards only where you shop often.