I just had my credit card canceled because of fraud. This is actually a perfectly normal occurrence for me, which is the impetus behind this question. The card in question was only about 1.5 years old, because that is how long it has been since my previous card details were stolen. Over the past decade I would say that I have had my credit card canceled for fraud on average once every 2 years. I think there was once I made it to 3 years, but also at least once where I only made it a year before it happened again.

To be clear it isn't being physically stolen and I've never once lost my card. I obviously have no idea how it happens every time (although I'm certainly aware that there are plenty of ways for your card data to be stolen without you knowing). I generally consider myself someone who practices reasonable credit card security. I don't use my card at gas pumps (gas pump skimmers were common in my area for a while), I only use it with major e-commerce vendors online, and I usually use cash at restaurants rather than handing someone my card.

Most people seem surprised that my details get stolen so often, which makes me wonder if I'm doing something wrong even still. However, I don't actually know if that is the case. Fortunately it isn't more than a nuisance for me when it happens. I've never had to pay for any of the fraud and the bank always sends me a new card with a minimal of hassle. It just "costs" me the inconvenience of being card-less for a week or two and then having to update my credit card details everywhere. Still if there were additional steps I could take to minimize the chance of fraud I would take them to try to stop this from happening so often. So, I realize this is a bit broad, but:

The Question

  1. Is having my card details stolen every 2 years a sign that I am unlucky, doing something wrong, or is it perfectly normal?
  2. Are there any other steps I can take to minimize the chances of this happening in another 1-2 years?

A Second card

So far I've had lots of comments about having a second card. That's not a crazy idea, and hasn't really occurred to me. It can certainly help when I'm down a card, although it also has its own disadvantages (one more thing to check every week, one more place to make payments, etc...). Still, while strategies to minimize the inconvenience when my card gets stolen are helpful, I'd rather come up with ways to minimize the chances of my card getting stolen in the first place.

Fraud Example

As an example of the actual fraud, I found out my card was canceled when it was declined at a grocery store. I immediately went home and checked my transactions online. I saw a number of smaller transactions that were definitely fraud. Two were $0.30 transactions from a retailer who's name was literally a random string ~20 characters long and based out of Indiana (I'm in Florida). Then there were two ~$10 charges claiming to be from a magazine which I had never heard of. Those transactions were allowed by my card (although the transactions will likely be canceled before any money exchanges hands, and I certainly won't have to pay for them).

When I called Visa they asked about further charges that I didn't see on my bank statement because they had been declined. That included my attempt to get groceries, ~$500 at a travel center in Zurich, and a large number of smaller transactions that I can't remember. All of this makes me suspect that regardless of how my credit card was obtained, it found its way into the larger credit card fraud world where criminals try to turn stolen cards into actual cash. The small transactions followed by larger ones matches my own expectations in this area from my personal and professional experience - small transactions are first performed to verify that the credit card details are still valid while trying to stay under the radar, and then larger transactions are made for products that can be converted to cash (unfortunately I have no idea what was being "purchased" at the travel center in Zurich).

  • 7
    @conman: If being without a card is inconvenient, then why do you (apparently) have only one card? Also would help to know where you live &c.
    – jamesqf
    Commented Jul 15, 2019 at 18:48
  • 3
    I have two cards not just because card numbers can be stolen, but you can lose your card.
    – RonJohn
    Commented Jul 15, 2019 at 18:57
  • 8
    Despite your update, I think the idea here is to keep a second card but not to carry the second card. Stash it at home until you need it -- and if somehow that card gets stolen, you know it's an inside job. ;)
    – Steve-o169
    Commented Jul 15, 2019 at 19:30
  • 77
    Are your fraudulent transactions with different merchants or (at least sometimes) with the same one? I once had a card skimmed and then fraudulently used to rent from Redbox. When I noticed the charge, I disputed it, had the transaction reversed, and my bank issued me a new card with a new account number. A few weeks later I had yet another transaction from Redbox on my new card number... Turns out that VISA had helpfully updated Redbox with my new card details, even though the only transaction between "me" and Redbox was fraudulent.
    – brhans
    Commented Jul 15, 2019 at 19:41
  • 3
    "I'd rather come up with ways to minimize the chances of my card getting stolen in the first place." security.SE is the best place to ask that.
    – RonJohn
    Commented Jul 15, 2019 at 19:44

15 Answers 15


Statistically, one of the e-commerce sites you used your card on was hacked. Once every 2 years is above average for that kind of attack, but not by that much. There's no good way around those types of attacks, other than not saving your credit card details on e-commerce sites.

It would be a good idea to double-check your computer security, though.

  • 22
    I'll concur with this thought here. I had to replace a card myself. In the process of replacing that card, I got in the habit of using the other one I carry, since they both have very similar rewards. Lo and behold, a few months later, same problem with the now-commonly-used one. I looked through both sets of statements and noted that before each hack, I visited a gas station and a pizza place I used occasionally. Guess which pizza place and gas station no longer gets my business, and guess who hasn't had this problem for several years now. Commented Jul 15, 2019 at 20:46
  • 30
    good advise in general, except for the claim that getting your card stolen every 2 years is normal. I've NEVER had my card stolen, and I've been using credit cards online regularly for going on 20 years.
    – jwenting
    Commented Jul 16, 2019 at 4:38
  • 20
    Only the most insane website designer would store CC details in his own database. You NEVER do that. I cannot emphasize this enough. You will not be compliant with a single payment provider on Earth, or compliant with standards like PCI. You always pass that information to the payment provider, and they simply confirm the transaction for you. If you need to "store" the card, payment provider does that for you, too, by creating a "personalised" token for your shop, that expires after some time, and can be only used to purchase stuff from your store again. CONTINUED
    – Davor
    Commented Jul 16, 2019 at 8:39
  • 5
    Getting hacked and leaking store specific tokens does not compromise the card itself, just that token. And the store, upon being hacked, should invalidate all of it's tokens.
    – Davor
    Commented Jul 16, 2019 at 8:41
  • 7
    Please elaborate on the "not by that much". Do you have evidence to show that the average person's card gets stolen almost every other year? If so please link, because the frequency at which OP's information is being taken is the reason they're asking about this (and most people seem to agree that it isn't normal).
    – Aubreal
    Commented Jul 16, 2019 at 13:31

No, it's not common to replace your card so often

I'm going to attempt an answer on this one to provide a few steps you can take to minimize your risk of having your credit card number stolen. It sounds like you've taken a few steps already, but there are definitely other ways for scammers to get ahold of your digits.

Shred/burn Paper Credit Card Statements or switch to paperless statements

Considering your statement that scammers are using skimmers at gas pumps, it's probable that they are also dumpster diving for more ways to commit fraud. This is common if you keep your trash can outside and regularly add bags as needed -- and if you take the can to the curb the night before trash day. Completely destroying your statements before disposing of them could reduce your risk substantially. Another option would be to switch to paperless statements (double bonus - saving the environment). Switching to paperless has the added effect of eliminating the chance that someone takes your statement out of your mailbox.

Online Merchant Security

Another potential way for scammers to get your information is to send phishing e-mails that look legitimate. It may have all the hallmarks of an Amazon e-mail asking you to update card information, but it's best to avoid using links at all. If Amazon really wants you to update any information, simply type the address into your web browser and make sure you're on the correct site.

Additionally, it might be wise to get a solid anti-virus program to ensure there are no malicious programs that could be logging your keystrokes. Unlikely, but always a possibility. As another answer mentioned, do avoid public networks if you are doing any shopping from your mobile phone. Best to just disconnect from the WiFi and use a mobile network while you make the purchase.

Get an RFID blocking wallet

As I mentioned in my comment, it's possible for a scammer to walk up behind you in the mall and scan your card from your back pocket without you even knowing. You can purchase a specially designed wallet that will block these types of scanners and prevent your numbers from being stolen. As Will pointed out in a comment, there has been little evidence of RFID attacks occuring, but this remains an option for improving general security. It is more probable that your card information was stolen another way.

Another note on this -- the efficacy of this sort of attack has been hotly debated in the comments below. The chances of this being the cause of your card's theft is unlikely, at best. RFID-blocking technology is only potentially useful if you know that you do have an RFID card -- which is uncommon in the United States and more common overseas(such as in the UK).

Personally, I've carried 4 different cards for the better part of 5 years and the only reason I've needed to replace them is that they get worn down and unusable -- and I live in a fairly large city. Having to replace your card for fraud this often speaks to some very determined scammers in your area or particularly bad luck. A few small changes could increase your odds of keeping the same card longer.

  • 5
    @conman Neither paper nor electronic statements from my banks ever contain the whole credit card number but rather just enough information to identify the card ("1234-XXXX-XXXX-5678"). In fact I've never seen that number anywhere except on the card itself.
    – Thomas
    Commented Jul 16, 2019 at 8:11
  • 32
    Recommending RFID-blocking technology is at best distracting to any real solution to this question. RFID skimming is almost certainly not how any of the OP's cards were accessed
    – Will
    Commented Jul 16, 2019 at 8:32
  • 3
    @Thomas You're lucky, then. It seems such an obvious security measure, but some banks put the full card number as an account reference in the header even on informational letters!
    – IMSoP
    Commented Jul 16, 2019 at 8:54
  • 3
    @Steve-o169 comments under answers are for discussing improvements to their contents. If you agree that the RFID section is unhelpful you can just remove it to improve the overall answer quality.
    – Will
    Commented Jul 16, 2019 at 12:13
  • 7
    RFID attacks can charge your card (if your card has tap technology) by setting up a purchase on a payment terminal and bringing it within range of the card, but people can't steal your card's information and use it somewhere else with RFID attacks. Since the former option is overwhelmingly easy to track, people don't use it.
    – Aubreal
    Commented Jul 16, 2019 at 18:12

It might be worth asking your bank for more details about the fraud (e.g. what triggered the fraud alert) because you might find that some perfectly legitimate sites are causing fraud errors.

About a month ago I got a phone call from my (Australian) bank informing me my card had been disabled due to potential fraud. When I asked what triggered it, they told me it was a payment attempt to Apple. I had renewed my Apple Developers subscription just days before, and due to a spike in scammers asking people to buy iTunes gift cards, they locked my card as a preventative measure.

My other advice is to change your account passwords for sites where you store your credit card details, and have a look on lists of compromised websites (such as HaveIBeenPwnd's list of websites to see if a company you're dealing with has been compromised and what data was breached.

Finally, as others have suggested, do a scan of your computer for malware and other nasties, in case attackers are getting to your details that way.

  • 1
    @RonJohn I'm surprised they do that in the US, because if your card has been stolen along with your phone, a thief is one click away from having (almost) free reign over your card. When I got the call, I didn't answer it, because I didn't recognize the number and the voicemail didn't sound convincing. I then looked at my bank's website, confirmed the number, then called them, and the guy did his usual verification (asking for my full name, date of birth and answer to my security question) before unblocking my account.
    – Grayda
    Commented Jul 16, 2019 at 6:35
  • 1
    #1 I didn't say that you should reply to the email. :) #2 Maybe I'm just old and don't understand smartphones as well as I think I do, but isn't a locked phone... locked? How does the thief get into my phone?
    – RonJohn
    Commented Jul 16, 2019 at 6:40
  • 2
    @RonJohn unfortunately not everyone locks their phone, or if they do, often it's an easy-to-guess password. I'm employed as a helpdesk operator, and sometimes we're able to log in to people's devices if they don't leave their passwords because we correctly guessed their pin code is 1234 or 0000, or their laptop password is ' (i.e. the button right next to the enter key) or asdfghjkl;' (so they can run their finger along the middle row to log in quickly. And kudos for not replying to the email, though I know of many who would ;D
    – Grayda
    Commented Jul 16, 2019 at 7:04
  • 1
    @RonJohn I've been in this job just over 12 years, and you memorize the most common, plus you can sort of guess based on how tech savvy they seem. They're the sort of clues scammers use as well when picking targets.
    – Grayda
    Commented Jul 16, 2019 at 7:24
  • 1
    I highly doubt you can guess my passwords, but might be able to guess my PIN given enough chances.
    – RonJohn
    Commented Jul 16, 2019 at 7:30

I have been in your shoes, and solved the problem. I followed all bank advice, but it didn't help at all. I finally switched to using strictly cash for all brick-and-mortar purchases, and the fraud stopped completely.

I think it was gas pumps. Soon after I switched, I saw a CBC documentary on skimmers used on gas pumps, and particularly ones furthest from the building. Those are the ones I preferred, too. U.S. pumps now have labels that break if the panel has been tampered with.

Something in your habit has a skimmer. It could be a restaurant, or gas pump, or whatever. I have resumed using my card, but not at far pumps, and have had no problem. My recommendation is to switch to cash for a long while and see if the fraud is local, vs online.

  • 8
    if you get a second (or third) credit card, you could use one exclusively online, one exclusively at restaurants, one at gas stations, and next time one is stolen you'll know which was the cause.
    – Carl Walsh
    Commented Jul 16, 2019 at 21:35
  • 2
    When it happened to me, I know it had to have been the gas pumps, because BOTH my cards got hit at once and it is the only place I use the 2nd card when I get the rotating 5% cashback for gas. I jiggle the scanner every single time now.
    – metalkat
    Commented Jul 16, 2019 at 23:50
  • Skimmers have been in the news a lot lately here, grabbing a wiggling the reader has been recommend. I always go inside to pay figuring there's less chance of a skimmer there. Though they just had on the news tonight a story of a in-store pin pad having a skimmer found on it at a gas station.
    – kicken
    Commented Jul 17, 2019 at 3:52
  • 1
    Also I want to point out that using a credit card protects from fraud purchases, but a debit card does not have the same protections -- and it could be months before you get your money back in your checking account. When in doubt about paying at some place that might be risky, use your credit card instead of debit.
    – Phil M
    Commented Jul 17, 2019 at 16:40
  • @PhilM I don't think that's true. When I had fraudulent transactions on my Visa debit card, it was refunded within a week.
    – Fax
    Commented Jul 18, 2019 at 11:13

I am really surprised that no one told about create a virtual card. Whenever i want to buy something with my CC, i genereate a virtual card. It has modififed data but can be used only once. After your first payment, you cannot reuse it.

Updated 04 Dec 2019: I would like to add that is also possible to use virtual cards phisically. You only need a NFC compatible phone and an app like Samsung Pay, Google Pay or Apple Pay. You could use a compatible wearable too.

  • This only works online though. Commented Jul 16, 2019 at 23:39
  • 1
    I was actually scrolling to see if this was offered as a choice. creditcards.com/credit-card-news/… - needs more +1s
    – WernerCD
    Commented Jul 17, 2019 at 0:46
  • 2
    @FabioTurati And? if you use different numbers for different reasons (IE: Redbox, Phone Bill, etc) you can possibly track WHICH number was leaked... AND you reduce the odds of the physical card being lost... AND if your physical card is the one lost, you can get a new one and your online bills continue to get paid and online cards still work. Amazing good choice if it's used properly.
    – WernerCD
    Commented Jul 17, 2019 at 0:48
  • 1
    @WernerCD I simply said that "this only works online". Taken from your link: "They also don’t work at brick-and-mortar stores", which is what I said. The OP had their card refused at a grocery store, so they aren't only using it online. If their number is stolen at a physical store, virtual cards won't help. Just that. I also think virtual cards are great (I've been using them since 2008), but they don't solve every problem. Commented Jul 17, 2019 at 9:31
  • @FabioTurati Well my take is separation and identification of "holes" - if you use the card "IRL" and a different card "online"... you can at least figure out which card is getting leaked - and only replace that one when needed. Likewise, you can give each online company a separate "Card" and know which one is getting leaked. Can't do that if ALL places use the same card.
    – WernerCD
    Commented Jul 17, 2019 at 23:25

The second card idea is useful more than just having a card when everything else goes down.

  • Pick up a card attached to a new account specifically for online purchases (They might know what you mean if you ask for a "Firewall" account).
  • Set it up so that the balance cannot go negative (it will decline rather than overdraft).
  • Keep a small balance, use a phone app to transfer money in before you do a major online purchase
  • Use ONLY this card for online transactions, never use it offline, never use your offline cards online

The really big advantage here is that the next time one of your cards are canceled, you will know if the thief was online or offline. Further subdivision is possible if you have the interest and patience--You might even identify the culprit in a decade or so :)

Also: Don't assume you are safe because you use Linux/Mac (However, assume you are compromised if you use Windows)

  • 2
    Assuming you are compomised if you use Windows is too paranoid to be practical. Commented Jul 17, 2019 at 15:42
  • I've assumed that any windows computer directly connected to the internet is compromised for years (I Never put credit card info into a windows computer). The home computers behind routers supplied by your provider are probably not in much better condition, once deployed the routers are rarely updated and are riddled with vulnerabilities. I agree I'm paranoid but probably barely paranoid enough.
    – Bill K
    Commented Jul 17, 2019 at 16:20
  • I've been using only Windows machines for at least 10+ years and I've never had a card compromised by online shopping. Assuming that your machine is vulnerable simply based on the OS is not useful advice.
    – Steve-o169
    Commented Jul 18, 2019 at 11:04
  • @Steve-o169 Just because you haven't had a credit card stolen doesn't mean your windows pc isn't compromised. There are virtually no protections against a rootkit, they can't be detected by AV software and all they take is one period when your system was vulnerable before a patch came out to be infected forever. They can be written into the bios of your hard disk where a format won't even get rid of them. Few internet connected computers are safe if someone actively targets you, but if your windows machine isn't infected it's just coincidence.
    – Bill K
    Commented Jul 18, 2019 at 15:55

To be clear it isn't being physically stolen and I've never once lost my card.

Are you sure someone with physical access to your credit cards isn't selling the details online? They don't need to steal it in order to get the details.

For example: roommates, family members, hired help, coworkers?

  • I have had a similar thing happen. The card was never stolen or skimmed, but ultimately what I found is that my bank was using a weak algorithm for generating numbers, and that hackers had come up with a way to duplicate that and would generate numbers and test them until they found one that worked. The bank issued me a new card that was said to be stronger against that kind of identity attack. Commented Jul 26, 2019 at 22:33

My immediate reaction is that your account(s) is compromised. Do you have an easy to guess password? Change it. Turn on multi-factor authentication if your bank offers it. Check your "last visited" note every time you log in (if the bank doesn't offer this, change to a bank that does). If you don't bank online, immediately call your bank and see if someone opened an online account for you. You might want to quietly observe your mailbox and see if people are snooping.

Instead of just sending you a new card, your bank should be changing your account numbers, changing your login id and such.

Other steps: If you do anything requiring login from public wifi, stop that. Make sure your "major ecommerce vendors" are in fact the real address, and you haven't been using a front the entire time. As mentioned in the comments, consider separate cards for things like your online purchase, automatic billing and everyday use and only carry the everyday use one around. Consider a RFID-shielded wallet.

  • 4
    It's a new card with a new number. A while back, I was getting my number stolen as often as OP was. Chase sent me a card with a new number each time. Never was there a need to change my login id or password.
    – RonJohn
    Commented Jul 15, 2019 at 19:39
  • 4
    What account(s)? I think you think this answer is helpful but the issue here doesn't seem to have anything to do with bank account credentials.
    – quid
    Commented Jul 15, 2019 at 19:49
  • @quid Indeed. I don't think changing online banking details is related here, but otherwise the advice is solid.
    – conman
    Commented Jul 15, 2019 at 23:28
  • 2
    If the card number was being stolen shortly after getting it, then someone else having access to the bank account could maybe be the culprit. But usually you can't get all the card information from the account itself (such as CVV), so it'd be an inefficient way to do it. With this long a gap, it's probably not the bank account access.
    – Bobson
    Commented Jul 16, 2019 at 0:33
  • 3
    most likely the problem isn't at the bank, but that OP is using his card at some extremely shady online stores. E.g. some/many pr0n sites are really fronts for international criminal organisations that WILL harvest your credit card and personal details if you are stupid enough to buy from them, and I'd not be surprised if there are many more unscrupulous online businesses out there doing the same.
    – jwenting
    Commented Jul 16, 2019 at 4:41

Many good suggestions have been made here. I just wanted to add that there are more secure alternatives to pay online. For example, Amazon gift cards can be purchased with cold hard cash - if compromised, your more sensitive accounts are still protected. Mobile providers sell top-up cards at the grocery store (at least by me). I use Amex Serve a lot: it's prepaid debit that can be pre-loaded with cash, but then functions like a card. One obtained in-store starts out anonymous, but you can sign up for an online account, add sub-accounts with extra cards for subsets of purchases, delegate one to -let's say- your teenager to use as allowance... It's a different, probably lower, tier of services than you are probably used to with credit cards, but it can confine the damage: if my Serve card is stolen/skimmed, the most the thief gets is the $50 in my account at the time, and certainly no credit score damage.


Yes, this is common.

I had a call from the bank, saying that they unfortunately had to change my card, because the details were stolen. They detected this in the internal audit, I didn't have to do anything to verify the card statement.

Fast-forward, less than a year!

I had a new call from the bank, saying they again unfortunately had to change my card, because the details were stolen.

Sites get hacked all the time. There's nothing you can do for it. Even I, as a professional software developer keenly interested in security, do not have enough time in my hands to fix every single e-commerce site.

Let's just say security of most online sites is way too low by professional standards. It's interesting how these unprofessional programmers are hired massively at low cost and do a poor job in all aspects of software design.

The only thing you can do is to be careful of how you use your card online, and to use it less online and pay more in physical stores. But is that worth it? Probably not. You're missing a lot of good deals by avoiding e-commerce.

I think your card terms & conditions should say that as long as you are careful enough with using the card online, you are not personally responsible for the losses caused by card detail theft.

Edit: there's of course the option of only using sites that support PayPal. Most of the E-commerce sites I don't trust, but if a site uses PayPal, your card details are only handled by PayPal and thus I'd say your card details are in safe hands.

  • 3
    No It isn't common. I use paypal on all websites I don't know, and never store my card details. i have never had card fraud.
    – WendyG
    Commented Jul 16, 2019 at 14:32
  • @WendyG If all you do is use PayPal, then it is not common. But some sites don't offer PayPal support.
    – juhist
    Commented Jul 16, 2019 at 14:34
  • 1
    then I don't use those sites unless I already trust them for other reasons (like they use sage pay)
    – WendyG
    Commented Jul 16, 2019 at 14:59
  • 1
    There ought to be some sort of consequence for merchants who handle your details in a sloppy way... Commented Jul 16, 2019 at 19:06
  • If you can’t or won’t use PayPal (long story), there are other similar outfits, e.g., Skrill.
    – WGroleau
    Commented Jul 17, 2019 at 12:02

There are some great answers already, but I realized one more likely culprit for this latest theft that hasn't been mentioned in the answers:

I recently signed up for pest control services from local companies (one spraying for standard household pests, and one for mosquitoes). Since both are a monthly service they wanted to have a payment method on file, and so took my credit card details. Both companies took a copy of our card details when they fist came out (I'm not sure how exactly because my wife set it up), and I didn't give it a thought at the time. Both started within the last 4-6 weeks though, which makes the timing very suspicious.

I'm definitely not going to let them put my new card on file, although unfortunately I don't know what other payment options they have for me. I'm sure card-on-file is their preference, but it's definitely not my preference anymore. I may have to see if they'll just accept a check or cash everytime. Check fraud is a risk too of course, but in my experience is not as common as credit card fraud.

  • 1
    While this could explain the most recent theft, it doesn't really explain why this happens every couple of years. Based on the edit, I'd say it's more likely to be caused by some online vendor considering the spread of where the transactions occurred. I assume a local scammer would spend local, but I'm not a scammer so I wouldn't know scammer best practices. Definitely keep a tight lease on what vendors you use online. Honestly, it may be better to give those companies your new card as a test. If it gets stolen again, guess who isn't getting anymore business from you?
    – Steve-o169
    Commented Jul 16, 2019 at 12:32
  • 1
    @Steve-o169 Yeah, my aim with this wasn't to come up with a comprehensive list of possibilities. I actually wouldn't suspect the local companies of being directly responsible for the fraud. Rather, I would suspect that a lack of proper security at the companies makes it easy for other parties to come along and suck up credit cards easily. Having worked with many small businesses over the years, the security level is generally terrible.
    – conman
    Commented Jul 16, 2019 at 12:41
  • So you let your wife handle your card details. Is she as internet-savvy as you are?
    – pipe
    Commented Jul 17, 2019 at 22:07

As a few answers above have intimated it appears your main issue has been very lax social security when it comes to your financial information.

The more you use your credit / debit card(s). Be it at Macy's , Best Buy or the local restaurant and bar...the vastly more likely it will be that you'll encounter fraud against one of those accounts.

Social Engineering is THE low hanging fruit method for fraudsters to get access to your card data. Among their methods:

1) Fishing , either via phone calls or emails that get you to provide information to fake services or response to fail emails purporting to be from your bank or card holder.

2) Eye surfing, you'll be surprised how quickly some one trained at doing it can remember a 16 digit card number. Any live agent at a store, bar, restaurant, mall... is thus a potential breach point. Trust that the pimply faced 18 year old who just sold you a shirt could have recorded your digits (assuming they handle the card).

3) Device scanning, by using very simple swipe devices on cards without chips ... live agents can grab hundreds of numbers. Using clandestine devices in ATM's or metro transit fill machines is one of the biggest vectors for mass gathering of card numbers.

So what you can do to dramatically reduce your exposure is clear.

When making purchases in any real life store, get cash and pay with that.

When making purchases at a restaurant or bar, similarly always use cash.

To prevent theft of your cards, just keep one in your wallet or bag. There is no reason to carry all your cards out to the world if you don't plan on using them all.

It is a vast misnomer that online spending is a vector for such breaches WHEN you stick to large well known businesses. Google, Facebook, Macy's , Best Buy, Amazon....etc. tend to have extremely rare incidences of security breaches and when they do happen they are contained and restricted to a small impact due to isolation of data.

Do buy or shop from big companies for this reason and shun smaller/ newer companies that don't outsource their e-commerce needs to a bigger provider. Amazon and Paypal both have excellent secure payment services that many smaller companies implement so look for these as providers for small companies if you insist on buying from them...that said, again..online breaches are still a vastly smaller vector for credit card data theft compared to the earlier described real world examples. Get rid of those vulnerabilities and your breach incidence should fall dramatically.

  • online breaches are still a vastly smaller vector for credit card data theft compared to the earlier described real world examples do you have data to support that?
    – dwizum
    Commented Jul 16, 2019 at 13:26
  • 1
    For number 1, "Fishing" should be changed to "Phishing".
    – Aubreal
    Commented Jul 16, 2019 at 18:46
  • On #2, at many restaurants, they walk away with the card and can photograph it or write down the number before they come back to the table. Memory and training not needed. (Happened to me once, but I knew which restaurant!)
    – WGroleau
    Commented Jul 17, 2019 at 12:14

Video skimming? I used to have my card compromised annually. I realized that my card information was easily available ... on my card. Any good video camera can skim my number from distance at a gas pump or short range at a diner. I put a piece of tape over my card number and haven't had a problem in three years (knock on wood). Nobody needs to see the number at the gas station or most any other uses, and if they need to, they can peel back the tape.


I would recommend buying cards from revolut and transferwise to be used in online shopping transactions. When not in use keep the cards frozen. I mean keep it disabled from the app.

Some normal banks also do offer to disable/freeze the card from the mobile app when its not being used actively.

  • 1
    This might solve the problem in a round about way, but it doesn't answer the question of how the cards numbers are being stolen. Commented Jul 16, 2019 at 17:12
  • Just for completeness, Revolut has several competitors, e.g., N26 & denizen.io
    – WGroleau
    Commented Jul 17, 2019 at 12:06
  • I just think its easier to use the freeze card functionality of disable swipe payments in card when not in use
    – Kiran
    Commented Jul 18, 2019 at 8:39

I expect your identity is compromised. This will be the fault of one of the retailers you use (not necessarily where you use this particular card), or possibly a criminal working in a card issuer's customer support centre. You might volunteer to help your bank's fraud team, but don't push it. They have the "hall of mirrors" problem well known in spy novels -- they have to guard their procedures carefully and they have to regard every defrauded customer as a possible perpetrator of fraud.

I have always had several cards, and the risk of having one suspended because of fraud is one of the reasons. (It only ever happened once to me). It also means that if one bank's computer systems have failed while I am trying to pay, or if the chip or mag-stripe on the card has gone bad, I just pull out another one. NB never use the same PIN for two or more cards! (To keep the issuers happy, make sure you use all your cards occasionally. They'll expect you to have a favourite and will occasionally send you offers to try to get you to make their card your new favourite. But if you don't ever use it and have zero balance they'll cancel it).

In the UK there is a system called (IIRC) CIFAS which adds extra security precautions to your identity with respect to obtaining new cards or making "risky" purchases (such as high-value goods online). Crucially, being CIFAS-registered does not affect your credit rating, although it may make your life more irksome after you are approved for a new card.

  • 3
    I'm not sure why having my card details stolen implies that my identity is compromised. Certainly, no one has applied for cards in my name - the details of individual cards have simply been stolen.
    – conman
    Commented Jul 16, 2019 at 12:18

Not the answer you're looking for? Browse other questions tagged .