Your Card Data Is Compromised: What to Do in the First Hour

Scenario: You see a suspicious transaction in your banking app, or you've been notified of a data breach, or you simply noticed that your card details were entered on a page that turned out to be a skimmer. What to do next is a matter of minutes.

Minutes 1-5: Block the Card

In most banking apps, blocking a card takes 2-3 clicks. The most important thing in this minute is to block it, because an attacker with stolen data works fast.

Different banks use different terms: Block, Suspend, Freeze. Sometimes you have a choice between a temporary block (can be unblocked later) or a permanent block (requires reissue). For an immediate reaction, a temporary block is sufficient.

Virtual cards are usually even easier to block—one click in the issuer's dashboard or via a bot.

Minutes 5-20: Check Transactions

Review your transaction history for the last 24 hours. If you see any unfamiliar charges, note them or take a screenshot. This will be useful for disputing.

Attackers often make a small test transaction ($1-5) first to confirm the card is active. If you see one, it's a sign that the data is definitely in their hands; real large transactions will follow.

Minutes 20-60: Contact the Bank

Call your bank using the number on the back of your card or the hotline in the app. Say: "My card is compromised, please fully block it and reissue, and dispute these transactions (if any)."

In most banks, refunds for 3DS transactions are not guaranteed (the bank argues that you confirmed it yourself). For non-3DS transactions, refunds are usually processed if you report quickly.

Hours 1-24: Additional Measures

Change your password on the service where you used the card. If your card data was stolen via a skimmer on a merchant site, your account password on that site may also be compromised—attackers could have logged in and saved your card in the buyer's wallet.

Check subscriptions. In your bank's page, Apple/Google Wallet—review which subscriptions and saved payment methods exist. Remove any where the old card was linked.

Enable notifications. If your bank offers push notifications for any transaction (even $0.01), turn them on. In the future, you'll notice suspicious transactions as they happen.

What Not to Do

Do not panic and do not transfer money through other platforms. If someone calls from the bank and offers to move funds to a safe account—this is a second wave of attack, social engineering hot on the heels of the breach. A real bank does not offer such things.

Do not make payments until the card is reissued. Even if the card is unblocked, the old card data remains with the attacker. Wait for a new card.

Lessons for the Future

A virtual card with a limit equal to the amount of a single planned purchase makes such incidents less painful. If an attacker gets the data of a virtual card with a $20 limit, their gain is at most $20, and your main account is untouched.