If Your Card Details Were Leaked: Steps to Take Now

In short: Call your bank or card issuer using the number printed on the back of your card, then ask them to block or replace it. In the UK, your bank must refund an unauthorised payment "no later than the end of the business day following the day on which it becomes aware" of it, under the Payment Services Regulations 2017. In the US, you have up to 60 days to dispute a credit card charge in writing to keep your legal rights, according to the CFPB.

If your card details are leaked in a breach, the response is mechanical once you know the order of operations: call your bank using the number on the card, block the card, check your statements, dispute anything unauthorized, and watch for the scam calls that tend to follow. Here's what to do, in what order, with the deadlines that protect you in both the UK and the US.

What should I do immediately if my card details were leaked?

Call the number printed on the back of your physical card — not a number from a text message, email, or the breach notification itself. Scammers impersonate banks right after a breach becomes public, so the only number you should trust is the one on the card or the one listed on your bank's own official website or app.

Once you reach the bank, ask them to block or freeze the card and issue a replacement. This stops the exposed card number from being used again even if someone already has it. The UK's Financial Conduct Authority puts the basic rule plainly: "Money should only be taken from your bank account if you authorise the payment. If you notice a payment that you didn't authorise, contact your bank or other payment service provider immediately," according to the FCA's guidance on fraudulent payments. The same logic applies whether you're in the UK, the US, or anywhere else: speed matters, and the bank needs to hear about it from you directly.

Can I get my money back if unauthorized charges appear?

Yes, in both the UK and the US, but the mechanics differ by country and by type of exposure.

In the UK, if a payment leaves your account without your authorization, your payment service provider is legally required to put the money back. Under Regulation 76 of the Payment Services Regulations 2017, the provider "must provide a refund under paragraph (1)(a) as soon as practicable, and in any event no later than the end of the business day following the day on which it becomes aware of the unauthorised transaction," per the regulation text on legislation.gov.uk.

In the US, the rules depend on whether it's a credit card or a debit card, and on how fast you report it. For credit cards, federal protections under Regulation Z mean you do not have to pay a disputed amount while the bank investigates, though you must keep paying any undisputed part of the bill, including finance charges, according to the FDIC's consumer guidance on card billing issues. If a lost or stolen physical credit card is used, your liability is capped at $50 — and it drops to $0 if the fraud happened over the phone, online, or by mail order — as long as you notify the issuer as soon as you know the card is missing, per the same FDIC guidance. If only the card number was stolen and the physical card never left your hands, liability is also capped at $50 once you report it.

Debit cards work differently and the timing matters more. If your physical debit card or PIN is lost or stolen, you need to notify the bank within two business days of discovering the loss to keep your liability capped at $50; wait longer and the cap jumps to $500, and past 60 days you could be on the hook for the full unauthorized amount, the FDIC guidance explains. If it's just the debit card number that was exposed and used — not the physical card — and you report it within 60 days of the statement first showing the unauthorized transfer, you owe nothing.

How long do I have to report fraud and dispute charges?

For US credit cards, call the card company immediately — the CFPB is direct about this: "To dispute a charge on your credit card bill, you should call the card company and let them know about the problem right away," according to the CFPB's guide to disputing a credit card charge. But the phone call alone isn't enough to lock in your legal rights. You also need to send a written billing-error notice within 60 calendar days after the charge first appeared on your statement. Once that notice arrives, the card company has 30 days to confirm it received your dispute, unless it has already resolved the issue within that window, the CFPB says.

Even if you already paid the disputed charge, you can still challenge it — you just likely won't see the money back until the card company rules in your favor, per the same CFPB guide.

For US debit cards, the clock is shorter if the physical card is missing: two business days to report a lost card or PIN keeps your liability at $50, per the FDIC. For a stolen debit card number alone, you have 60 days from the statement date to report it and owe nothing.

For UK accounts, the FCA's position is that you should contact your bank "immediately" once you spot an unauthorized payment, and the bank is then required to refund it by the end of the next business day under the Payment Services Regulations 2017. There's no reason to wait — the sooner you report it, the sooner the clock on that refund obligation starts.

What scams should I watch for after my details are leaked?

Breaches that expose card or account details are often followed by phone calls, texts, or emails from people pretending to be your bank, warning you about "suspicious activity" and asking you to confirm your card number, PIN, or a one-time code. A genuine bank will never need your PIN or full card number over the phone, and the only safe way to verify a call is real is to hang up and ring the number printed on your card yourself. For a detailed breakdown of how these follow-up scams are worded and how to recognize them, see Privacy Unpacked's guide on spotting phishing after a data breach.

If the same breach also exposed a password you reuse elsewhere, that's a separate problem worth handling too — see what to do if your password was leaked.

Checklist: what to do right now

1. Call your bank or card issuer using the number on the back of your physical card — never a number from a text, email, or breach notification.
2. Ask the bank to block, freeze, or cancel the compromised card and send a replacement.
3. Check your recent statements line by line, including small or unfamiliar charges — fraudsters sometimes test a stolen card with a tiny purchase before a larger one.
4. Turn on real-time transaction alerts in your banking app so you're notified the moment a new charge posts.
5. If you spot an unauthorized charge, report it to your bank immediately by phone, then follow up in writing if you're in the US — you have 60 calendar days from the statement date to send a written billing-error notice and preserve your dispute rights, per the CFPB.
6. In the UK, don't assume the charge will just disappear on its own — your provider is required to refund an unauthorized payment by the end of the next business day once it's reported, under the Payment Services Regulations 2017, but only after you've flagged it.
7. Treat any follow-up call or message claiming to be "from your bank" with suspicion, especially if it asks for your PIN, full card number, or a one-time passcode — hang up and call the number on your card instead.
8. Keep paying any part of your credit card bill that isn't in dispute, including finance charges, while the investigation is ongoing, per the FDIC.