How do credit card numbers get stolen?

We are a digitally connected society. With that, comes a greater opportunity for cybercriminals to exploit the vulnerabilities of our modern digital world. Criminals are becoming quite savvy when it comes to stealing credit card information. It's important to know their tactics so you can prevent, or at the very least, deter them from doing so.

How do people steal credit card numbers?

There are several common ways that criminals gain access to your personal information. You may be surprised at how low-tech some of these methods are, but they are effective none-the-less.

Phishing emails

Fraudsters have become sophisticated at creating official-looking emails from banks or retail stores that you already have a relationship with. These fake emails may ask you to click a link or give your personal information such as a Social Security number, account number or date of birth. Some will claim it's a requirement of the company in order to prove your identity, even though it's really just cybercriminals on the other end. Legitimate companies will never ask you to provide your personal information via email so don't click on any links or reply to any suspicious emails.

Public Wi-Fi

If you're using a device that is connected to a publicly shared internet connection, you are vulnerable to hackers. For example, let's say you're at your favorite coffee shop and you automatically connect to their public Wi-Fi. If you decide to take care of some bills or other banking business on your phone from inside this coffee shop, you are at risk of cybercriminals hacking into your device through this Wi-Fi channel.

Avoid making online purchases or doing anything where you reveal your credit card or bank account details unless you're sure you are using a password protected Wi-Fi connection. Any public place that offers “guest" Wi-Fi access without a password is risky to do any kind of online shopping or banking on.

Data breaches

If you have provided your credit card information to a trusted company (such as an online retailer, subscription service or financial institution), and that company gets hacked, your information may be vulnerable to fraudulent activity or potential stolen identity. It's not an uncommon news headline to see that a large organization is dealing with a data breach in which thousands or even millions of people's personal information has been exposed.

Card skimmers

A card skimmer is a device that's installed on card readers and can collect credit card numbers. Thieves can then recover and use the stolen information to make fraudulent purchases. In some cases, a skimmer is in the form of a tiny camera placed on a card reader. They're most often found at gas stations, ATMs, retail stores and even some restaurants. In other cases, a fake keypad is placed over a real ATM keypad and fraudsters are able to retain information from the numbers that are punched. Thieves work hard to make sure their devices blend in with the card reader, so it's hard to detect.

Spyware and malware

Malware is short for “malicious software" that sits in the background of your computer and collects your personal information. Also known as spyware, once given access to your computer through a link click on a website or suspicious email, it can begin recording your keystrokes and browser history. Aside from being an invasion of privacy, it also allows hackers to impersonate you or even sell your data.

Familial fraud

When a family member or someone you know uses your card or opens a new account in your name without your permission, it's called familial fraud, and it's a form of identity theft. This is usually committed by someone who has easy access to your personally identifiable information (PII). It may take you a while to realize this kind of fraud is taking place if it originates with someone you know or trust.

Lost credit cards

It's not uncommon for someone to lose their physical card and then have a thief use it to make a purchase. If you realize your card is missing, it's imperative to call the credit card company and place a freeze on your account immediately. Many banking apps also offer the option to freeze your account right from your own device.

Mail and trash

While it may seem like an outdated and unsophisticated way to steal data, some criminals may still go through your physical mailbox or trash bins in person. It's possible to find credit card account numbers, financial statements and sensitive information regarding your investments and retirement funds. When possible, don't throw out important financial statements without shredding them first.

How to check if your credit card information has been stolen

You may have no idea your information has been stolen until you see an unfamiliar charge on your monthly statement. You'll want to review each transaction on your statement for this very reason.

However, most credit card companies have sophisticated fraud monitoring systems in place to assist with this. These fraud alerts may let you know if suspected fraud has been detected and allows you to confirm or deny if the suspicious charge was in fact yours. If a fraudulent charge is identified, the card issuer will cancel that card and issue you a new one.

If you have not received a fraud alert, but still suspect your card has been lost or stolen, you can proactively request a new card and account number from your card issuer at any time. You can also speak to a customer service representative on the phone who will go over any recent credit card activity with you.

What to do if your credit card information is stolen

1. Contact your credit card issuer: If you suspect you are a victim of fraud, you should contact your card issuer to report it immediately. You can contact your card issuer via the phone number on the back of the card or the issuer website's live-agent chat feature. Card issuer typically have zero liability protection against unauthorized purchases. But reporting credit card fraud through the proper channels is just the first step.
2. Freeze your card account: You'll want to consider putting a freeze on your account right away. You can do this by calling your card issuer and requesting it, or using the issuer's banking app to initiate the freeze. Freezing your credit card will temporarily prevent purchases from being made with your credit card number.
3. Continue monitoring: Continue checking your financial statements and any other accounts you have to identify if unauthorized activity is taking place in multiple places under your name.

Protecting yourself and others from credit card fraud

There are a few proactive steps you can take to protect yourself from credit card fraud:

• Check your credit reports. All three major credit bureaus allow one free credit check per year. You'll want to do this to confirm that all the activity in your reports is accurate. If you'd like to try Chase's free service called Credit Journey, you can get alerts when there are changes to your credit report or when your personal information is exposed in a data breach.
• Monitor your monthly statements. Make sure you're closely monitoring each transaction listed on your statements. If you do find a fraudulent charge, you'll want to alert your credit card company immediately.
• Don't offer personally identifiable information over email or phone. If you receive an email or call claiming there is an “emergency" and you must supply your personal details or credit card number, do not comply. It is likely a fraud scheme.
• Shred printed financial statements. Before tossing any financial document or credit card statement into the trash, send them through a shredder to minimize the chances of someone using the information fraudulently.

In conclusion

Cybercriminals employ many tactics to gain your personal information. Protect yourself by knowing their most common schemes and proactively taking steps to avoid them. If you believe your credit card information has indeed been compromised, don't hesitate to contact your credit card issuer right away. Many issuers offer zero liability protection against unauthorized purchases. Be sure to check your account activity regularly to quickly identify anything unusual.