Using someone else’s credit card is legal only when that person has given you permission — either by adding you to the account as an authorized user or by approving a specific purchase. Without that consent, every swipe or online charge is fraud, and the consequences stack: federal prison time of up to ten years for a first offense, state charges on top, and a civil lawsuit from the cardholder for every dollar you spent.
The Two Ways It’s Legal
There are only two situations where using another person’s card is lawful.
You’re an Authorized User
The formal route is being added to the account. The primary cardholder contacts their issuer and asks that you be added; the issuer can then send a card imprinted with your name, and you can make purchases within whatever limits the primary cardholder and issuer agree on.1Consumer Financial Protection Bureau. Comment for 1026.12 – Special Credit Card Provisions The primary cardholder stays responsible for paying the bill. Authorized users are not cardholders under federal law, so they can’t be held liable for unauthorized charges on the account, though state law may let the primary cardholder pursue them for charges they personally made.
You Have Express Permission for the Purchase
The everyday version is someone handing you their card and asking you to pick something up. Verbal permission is enough to make the transaction lawful, but only within the scope of what was agreed. If a friend tells you to grab coffee with their card, using it to fill your gas tank on the way back is unauthorized.
This scope point cuts both ways, and it’s where lenders get burned. Under federal regulation, once a cardholder gives someone authority to use their card, the cardholder is personally liable for every charge that person makes until the cardholder tells the issuer to cut off access.2Consumer Financial Protection Bureau. Regulation 1026.12 Special Credit Card Provisions Lend your card to a cousin who then runs up a balance you never approved, and the issuer treats all of it as authorized. You owe the bill; your only recourse is to sue the cousin.
What Counts as Unauthorized Use
Any use without the cardholder’s permission is criminal, regardless of your relationship or your intentions. The specific scenarios people talk themselves into are all fraud:
- Picking up a lost card at a coffee shop and buying lunch with it.
- Taking a relative’s card from their wallet without asking, even if you planned to pay them back later.
- Using a card number you have saved from a past purchase to place a new order the cardholder didn’t approve.
- Entering card details someone else gave you access to for a phone or online order.
The lack of consent at the moment of the transaction is what makes it illegal. Intending to settle up later doesn’t change that. And digital transactions get the same treatment as physical swipes — card-not-present fraud actually draws more law enforcement attention because it tends to cross state lines, which opens the door to federal prosecution.
Federal Penalties
Two federal statutes target credit card fraud, and the exposure is steeper than most people expect.
15 U.S.C. § 1644 covers fraudulent credit card use in transactions that affect interstate commerce. If the charges total $1,000 or more within a one-year period, a conviction carries a fine of up to $10,000, up to ten years in prison, or both. A lower $500 threshold applies when the fraud involves transportation tickets purchased with a stolen or counterfeit card.3Office of the Law Revision Counsel. 15 U.S.C. 1644 – Fraudulent Use of Credit Cards; Penalties
18 U.S.C. § 1029 is broader. It covers fraud involving any “access device,” including credit card numbers, account codes, and PINs. A first offense under the most commonly charged subsections carries up to 10 years in prison. Certain subsections involving device-making equipment or unauthorized scanners carry up to 15 years, and a second offense under the same statute can bring up to 20.4Office of the Law Revision Counsel. 18 U.S.C. 1029 – Fraud and Related Activity in Connection With Access Devices Courts can also order forfeiture of personal property used in the offense.
Prosecutors sometimes add aggravated identity theft under 18 U.S.C. § 1028A. That charge carries a mandatory two-year prison sentence served consecutively — after whatever sentence applies to the underlying fraud.5Office of the Law Revision Counsel. 18 U.S. Code 1028A – Aggravated Identity Theft A card number tied to someone’s name qualifies as a means of identification, so this add-on comes up often in card fraud cases.
Federal jurisdiction attaches whenever the fraud affects interstate or foreign commerce. In practice, almost any credit card transaction qualifies, because card networks route payments across state lines. You don’t need to physically cross a border for federal prosecutors to get involved.
State Penalties
Most credit card fraud cases are actually prosecuted at the state level, and every state has its own statute. Penalties scale with the dollar amount of the unauthorized charges.
For smaller amounts, usually below a threshold that varies by state, the offense is a misdemeanor. Misdemeanor convictions generally carry up to one year in jail and fines ranging from a few hundred to several thousand dollars, depending on the jurisdiction. Once the total crosses the state’s felony threshold, the consequences escalate: multiple years in state prison, substantially larger fines, and a felony record that follows you for life. Courts routinely order restitution on top of fines or prison time, meaning you repay every dollar of the unauthorized charges in addition to serving the sentence.
Civil Liability on Top of Criminal Charges
A prosecutor’s decision isn’t the end of your exposure. The cardholder can sue you in civil court to recover the money, and that lawsuit is completely separate from any criminal case. It can move forward even if the prosecutor declines to file charges, and it can succeed even if you were acquitted — the burden of proof in civil court is lower than in criminal court, so the same facts can produce different outcomes.
The goal of a civil case is financial recovery, not punishment. A court can order you to repay the full amount of the unauthorized charges, plus court costs and sometimes attorney fees.
If Someone Used Your Card Without Permission
If you’re on the other side of this question and someone has used your card without your authority, federal law caps your out-of-pocket liability at $50, as long as the issuer gave you notice of that liability and a way to report unauthorized use.6Office of the Law Revision Counsel. 15 U.S. Code 1643 – Liability of Holder of Credit Card Once you notify the issuer, you owe nothing for charges after that point. Most major card networks go further and offer zero-liability policies that eliminate even the $50, though those voluntary protections can be withheld if the issuer finds the cardholder was grossly negligent — writing a PIN on the card itself, for example.
The $50 cap only applies when the person who used the card lacked your authority. If you handed your card over and the person overspent, the issuer treats that as authorized use and holds you responsible for the full balance until you contact them to revoke access.2Consumer Financial Protection Bureau. Regulation 1026.12 Special Credit Card Provisions
Call the card issuer as soon as you spot the charges; speed matters because the cap only protects you for charges that occur before notification. You can also file an Identity Theft Report through the Federal Trade Commission at IdentityTheft.gov, which produces a recovery plan and documentation your issuer or a police department may ask for.7IdentityTheft.gov. Identity Theft Steps