Credit Card Fraud Definition Under Federal Law

Under federal law, credit card fraud is any knowing, intent-to-defraud use of a stolen, counterfeit, forged, or otherwise unauthorized credit card or account to obtain money, goods, or services. Two statutes do most of the work: 15 U.S.C. § 1644 targets fraudulent card use directly, and 18 U.S.C. § 1029 covers the broader category of access-device fraud, including counterfeit cards, trafficking in stolen account numbers, and possession of card-cloning equipment. Prison exposure runs from 10 to 20 years depending on the conduct, and prosecutors routinely charge several overlapping statutes from the same scheme.

What the Statutes Require

Section 1644 makes it a federal crime to knowingly use a counterfeit, stolen, forged, or fraudulently obtained credit card to get at least $1,000 in money or goods within a one-year period. The maximum is 10 years in prison, a $10,000 fine, or both.¹ The transaction must affect interstate or foreign commerce, which in practice covers nearly every card purchase because card networks operate across state lines.

Section 1029 reaches further. It criminalizes not only using a fraudulent card but also producing counterfeit cards, possessing card-cloning equipment, and trafficking in stolen account data.² The statute uses the term “access device” to describe any card, code, account number, or electronic identifier that can initiate a transfer of funds. That definition is broad enough to cover physical cards, digital wallet credentials, and stolen PINs.

To convict under either statute, prosecutors must prove two things beyond a reasonable doubt. First, the defendant acted knowingly, meaning they were aware the card or account data was fraudulent or unauthorized. Second, they acted with intent to defraud, meaning the point was to deceive someone for financial gain. Accidentally using someone else’s card that looks like yours is not credit card fraud. Deliberately using a stolen card number to buy electronics online is.

The Common Forms

Using Someone Else’s Account

The most direct form: someone gets hold of your card or account details without permission and starts spending. Physically, this happens through theft of a wallet or mail. Digitally, it happens through data breaches, phishing emails that trick you into entering card details on a fake site, or malware that captures keystrokes. The legal line is simple: if you did not authorize the charge, the person who made it committed fraud regardless of how they got the information.

Online purchases make up a growing share of these cases because a thief never needs the physical card. A number, an expiration date, and a security code are enough to complete most checkouts, so the verification barriers are lower than at a physical register.

Counterfeit and Cloned Cards

Counterfeit fraud involves creating a physical replica of a legitimate card, typically by using a skimming device attached to an ATM or payment terminal to capture the data encoded on the magnetic stripe. That data is then written onto a blank card. Under 18 U.S.C. § 1029, simply possessing 15 or more counterfeit or unauthorized access devices is a standalone federal offense punishable by up to 10 years in prison, even if the cards were never used.² Possessing card-cloning equipment with intent to defraud carries a maximum of 15 years.

Application Fraud

Application fraud skips the existing account. The criminal applies for a new card using someone else’s personal information, or a mix of real and fabricated details. Traditional identity theft involves stealing a real person’s name, Social Security number, and date of birth to open accounts in their name; the victim often does not discover the fraud until a credit report check or a call from a debt collector. These cases move the prosecution into the identity-theft statutes, which carry their own penalties on top of any card-fraud charges.

Federal Penalties

Credit card fraud can trigger prosecution under several overlapping federal statutes, and the penalties escalate based on the specific conduct:

Fraudulent card use (15 U.S.C. § 1644): up to 10 years in prison and a $10,000 fine for using a fraudulent card to obtain $1,000 or more in a year.¹
Access-device fraud (18 U.S.C. § 1029): up to 10 years for using or trafficking counterfeit or unauthorized access devices, and up to 15 years for possessing or producing card-cloning equipment. A second conviction under the statute raises the ceiling to 20 years.²
Identity theft (18 U.S.C. § 1028): up to 15 years when the fraud involves producing or transferring identification documents, or when the offender uses someone else’s identity to obtain $1,000 or more in a year.³
Aggravated identity theft (18 U.S.C. § 1028A): a mandatory two additional years in prison, served consecutively, when identity theft is committed during another felony such as access-device fraud. If the underlying crime is terrorism-related, the mandatory add-on is five years.⁴
Wire fraud (18 U.S.C. § 1343): up to 20 years when the scheme uses electronic communications, which covers virtually every online credit card fraud. If the scheme affects a financial institution, the maximum rises to 30 years and a $1,000,000 fine.⁵

Federal prosecutors routinely stack these charges. A single scheme that involves stealing someone’s identity, creating counterfeit cards, and making online purchases could draw indictments under three or four of these statutes at once. The aggravated identity theft charge carries extra weight because the two-year sentence must run after the sentence for the underlying felony, not alongside it.

What You Owe If Your Card Is Used

If someone uses your credit card without permission, federal law caps your personal liability at $50, and in practice you will almost always owe nothing. Under 15 U.S.C. § 1643, a cardholder’s liability for unauthorized use cannot exceed $50, and even that limited liability applies only if the issuer gave you notice of the potential liability, provided a way to report the loss, and included a method for identifying authorized users.⁶ Once you notify the issuer that the card was lost or stolen, you owe nothing at all for charges made after that notification.

Beyond the federal floor, every major card network now offers a zero-liability policy that eliminates even the $50 exposure for most transactions. Visa’s policy, for example, requires issuers to replace stolen funds within five business days of notification, though the issuer may withhold provisional credit if it finds gross negligence or significant delays in reporting.⁷ A typical credit card fraud victim ends up paying nothing out of pocket.

Debit Cards Are Treated Differently

One important boundary: these credit card rules do not apply to debit cards. The Electronic Fund Transfer Act, implemented through Regulation E, ties your debit liability to how fast you report. Report a lost or stolen card within two business days and your exposure caps at $50. Miss that window but report within 60 days of your statement and your liability can reach $500. Wait longer than 60 days and you could lose every dollar taken after that deadline.⁸ And because debit charges pull cash straight out of your account, you are waiting for the bank to put it back rather than disputing a balance on paper.⁹

Reporting Fraud and Preserving Your Rights

Speed matters, and the Fair Credit Billing Act imposes a hard deadline for credit card disputes. Under 15 U.S.C. § 1666, you must send a written notice of the billing error to your creditor within 60 days of the date your statement was sent. The notice must go to the address your issuer designates for billing inquiries, not the payment address. Sending it by certified mail with a return receipt gives you proof of the date it was received.¹⁰

Once the issuer receives your written dispute, it has 30 days to acknowledge receipt and must resolve the investigation within two billing cycles, no more than 90 days. During that period, the issuer cannot try to collect the disputed amount or report it as delinquent. If the investigation confirms fraud, the issuer must credit your account and remove any related finance charges.

Beyond the formal dispute, take these steps as soon as you notice unauthorized charges:

Call your card issuer immediately. Most issuers have a 24-hour fraud hotline and will freeze the card on the spot. The call protects you right away; the written dispute preserves your formal rights under the FCBA.
Review recent statements. Fraudsters often test a stolen card with a small charge before making larger purchases, so look for unfamiliar transactions of any size in the weeks before the fraud you noticed.
Place a fraud alert with the credit bureaus. Contacting any one of the three major bureaus triggers a 90-day alert that requires lenders to verify your identity before opening new accounts. If your Social Security number was compromised, a credit freeze blocks new credit applications entirely.
File a report at IdentityTheft.gov. The FTC’s reporting portal generates a recovery plan and produces an official identity-theft report you can use with creditors and law enforcement.

If You Carry a Company Card

The $50 statutory cap protects individual cardholders, but the rules shift at the business level. Under 15 U.S.C. § 1645, when a card issuer and a business provide cards to 10 or more employees, the business and the issuer can negotiate their own liability terms for unauthorized use by contract, without regard to the normal $50 cap.¹¹

The protection that survives: no individual employee can be held liable beyond the $50 limit set by Section 1643. The contract between the business and the issuer can reallocate risk between those two parties, but it cannot push that risk onto the employee whose name is on the card. If your company-issued card is stolen, the company or the issuer bears the loss, not you personally.

False Disputes Cut the Other Way

Not every chargeback involves a genuine victim. “Friendly fraud” refers to a cardholder disputing a legitimate purchase, claiming it was unauthorized. Sometimes it is intentional, functioning as a form of shoplifting where the buyer keeps the merchandise and gets a refund. Other times it is unintentional: a family member used the card, or the cardholder forgot about a recurring subscription.

For consumers who file false disputes deliberately, the legal exposure is real even though enforcement is rare. Knowingly making a false fraud claim to a financial institution can constitute bank fraud or wire fraud under federal law, with the penalties above. More commonly, issuers who detect a pattern of suspicious disputes may close the account or blacklist the cardholder from future products. The same statutes that protect genuine fraud victims apply to anyone who abuses the dispute system against them.

1
Office of the Law Revision Counsel. 15 USC 1644 – Fraudulent Use of Credit Cards; Penalties
2
Office of the Law Revision Counsel. 18 USC 1029 – Fraud and Related Activity in Connection With Access Devices
3
Office of the Law Revision Counsel. 18 US Code 1028 – Fraud and Related Activity in Connection With Identification Documents
4
Office of the Law Revision Counsel. 18 US Code 1028A – Aggravated Identity Theft
5
Office of the Law Revision Counsel. 18 US Code 1343 – Fraud by Wire, Radio, or Television
6
Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card
7
Visa. Visa Zero Liability Policy
8
Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability for Unauthorized Transfers
9
Consumer Financial Protection Bureau. Regulation E – Liability of Consumer for Unauthorized Transfers
10
Office of the Law Revision Counsel. 15 USC 1666 – Correction of Billing Errors
11
Office of the Law Revision Counsel. 15 USC 1645 – Business Credit Cards; Limits on Liability of Employees