Fact Sheet



Most states require merchants to notify individuals whose personal information was taken without authorization in a data breach, but definitions of personal information and timeframes for consumer notice vary from state-to-state.  If you believe your personal information, or credit, debit, or banking account information may have been compromised in a data breach, there are steps you can take immediately – whether or not you have been contacted by a merchant – in order to safeguard your account:

  1. Change your PIN or access code. If you believe that an account accessible by PIN, password, or access code was compromised, immediately change that code.
  2. Monitor your financial accounts: Financial institutions deploy sophisticated fraud prevention and detection technology to protect accounts. If a financial institution sees or suspects fraud on your account, they will generally reach out to you. You should regularly monitor your financial accounts and contact your financial institution if you see or suspect fraud or theft in your account. When credit or debit card information is compromised in a data breach, the breached company will usually send information to credit card companies and banks so that they can deploy enhanced fraud monitoring on potentially impacted accounts. If your financial institution issues you a new credit or debit card number and you have set up auto-bill arrangements with any merchants, ask your financial institution if you should contact those merchants directly to change the billing information.
  3. Contact any credit bureau and request a fraud alert. An alert will notify businesses that you are a fraud victim, or a potential fraud victim, resulting in businesses verifying your identity before they can issue new or additional credit in your name. When you request a fraud alert through any one of the three companies below, they will notify the other two so you only need to make one call. You may also request that the credit bureau notify you before any new account is opened in your name. Placing an initial fraud alert entitles you by law to a free credit report from each of the three credit bureaus.

    Report Fraud: 1-800-525-6285
    Order Credit Report: 1-800-685-1111

    Report Fraud: 1-888-397-3742
    Order Credit Report: 1-888-397-3742

    Report Fraud: 1-800-680-7289
    Order Credit Report: 1-800-888-4213

  4. Order your free annual credit report. Visit www.annualcreditreport.com every year to request – and review – your credit report from each credit bureau, free of charge. Place a reminder on your calendar for next year, or always order during your birthday month or another noteworthy time of year to ensure you remember to order every year.
  5. Report any fraudulent activity to the Federal Trade Commission (FTC). Your complaint could help the FTC and law enforcement detect patterns that will expose criminals. Contact the FTC Identity Theft Clearinghouse at 1-877-IDTHEFT (438-4338) or by visiting https://www.ftccomplaintassistant.gov/#&panel1-2. For more information on creating an identity theft report, visit http://www.consumer.ftc.gov/articles/0277-create-identity-theft-report.
  6. Review the FTC’s consumer guides. The FTC website offers guidance with additional tips on protecting yourself from identity theft or advice on what to do after you have been victimized. For more information, visit http://www.consumer.ftc.gov/topics/protecting-your-identity.

Federal law offers some protection for victims of fraud resulting from the theft of credit, debit, or bank account cards or account information, but it is in your best interest to be proactive and contact your financial institution if you know your credit or debit card has been lost or stolen.

Credit Card Fraud: Under the Fair Credit Billing Act, you cannot be liable for more than $50 in authorized charges if your credit card is lost or stolen. If you report the card as lost or stolen before any unauthorized charges are made, your liability is $0. If just your credit card number is stolen (as in a data breach), you are not liable for any unauthorized charges.

Debit Card Fraud: Under the Electronic Fund Transfer Act, if your debit card was lost or stolen and you report it to your bank before any unauthorized use occurs, you are not liable for any charges. If a thief uses your debit card but you report the loss within two business days after you learn your debit card is lost or stolen, you are only liable for up to $50 of any unauthorized charges. If you report the loss of your debit card within 60 days of the date your bank sent your statement, you are liable for up to $500 of unauthorized charges. If you wait longer than 60 days after the date your bank sent your statement to report your debit card stolen, you could be liable for all losses. If just your debit card number is stolen (as in a data breach), you are not liable for any unauthorized charges if you report the transactions within 60 days of the date your bank sent your statement.

Fact Sheet