PanicStation.org
UK USA
us Money & financial emergencies

What to do if…
you get an alert that your card details may have been exposed in a data breach

Produced and maintained by PanicStation.org Published: Last reviewed: Editorial policy USA guide

Short answer

Use your card issuer’s official app, website, or the number on the back of your card to verify the alert, then lock or replace the card if the details may be exposed. If personal information beyond the card number may have been exposed, consider a fraud alert or security freeze.

Do not do these things

  • Don’t click the link in the alert or call the number it gives; use your issuer’s official app, typed website, or the number on the back of your card.
  • Don’t share one-time codes, passwords, PINs, or approve security prompts you did not start.
  • Don’t assume there is no risk because you do not see fraud yet; exposed card numbers can be used later, including for small test charges.
  • Don’t close your main checking account or cancel essential auto-payments in panic; secure the exposed card first.
  • Don’t pay for dark web removal, credit repair, or urgent protection based only on an email or text.

What to do now

  1. Verify the alert safely. Log in through your card issuer or bank’s official app, or type the website address yourself. If you call, use the number on the back of your card.
  2. Lock the card and ask about replacement. Use a lock or freeze-card feature if available. Ask the issuer whether the card should be replaced with a new number.
  3. Review transactions line by line. Look for small test charges, unfamiliar merchants, new subscriptions, wallet payments, or online orders you do not recognize. Report unauthorized charges through the issuer’s fraud process as soon as you see them.
  4. If an unauthorized charge appears on a credit card statement, protect your dispute rights in writing. Call the issuer, and also send a written billing error notice within 60 calendar days after the charge appears on your statement. Keep copies and note dates and times of calls.
  5. If it involves a debit card, PIN, or money missing from a bank account, report fast.
    • If your debit card or PIN was lost or stolen, try to notify your bank or credit union within two business days of discovering it.
    • If you still have the physical card but see an unauthorized electronic transfer, notify your bank or credit union right away, and at the latest within 60 days after it sends the statement showing the unauthorized transaction.
    • If the bank or credit union asks you to confirm the report in writing, do that promptly and keep a copy.
  6. Check mobile wallets and saved-card accounts. Look in Apple Pay, Google Wallet, Samsung Wallet, merchant accounts, delivery apps, ride-hailing apps, app stores, and subscription accounts. Remove the exposed card or any wallet entry you do not recognize, then update essential payments after the replacement card is confirmed.
  7. Secure the logins that could let someone reuse the card. If the alert involved an online account, password, email account, or suspicious login prompt, change that password from the official site and turn on multi-factor authentication where available.
  8. If more than the card number may be exposed, protect your credit file.
    • A fraud alert is free; contact one of the three credit bureaus and it should tell the other two.
    • A security freeze is free; place it separately with Equifax, Experian, and TransUnion. You can lift it when you need to apply for credit.
  9. Check your credit reports through the official free route. Use AnnualCreditReport.com and look for new accounts, address changes, or inquiries you do not recognize.
  10. If identity theft starts, use the government recovery flow. If you find new accounts, loans, benefits claims, or tax activity you did not start, use IdentityTheft.gov for a recovery plan.
  11. Keep a short incident log. Record the date and time of the alert, what data was said to be exposed, actions you took, and any case or reference numbers.

What can wait

  • Switching banks, replacing unrelated cards, or paying for monitoring you do not understand.
  • Fixing your credit score; the priority is stopping unauthorized use and spotting new accounts.
  • A full password overhaul of every account; focus first on email, financial logins, and accounts where the exposed card is saved.
  • Legal action about the breach notice.

Important reassurance

A breach alert feels urgent and invasive, but you do not have to solve everything at once. Locking or replacing the card, checking transactions, reporting unauthorized activity quickly, and using a fraud alert or freeze when identity details may be involved are strong first steps.

Scope note

These are first steps for the first hours and days after a card-exposure alert. Later decisions, such as extended identity-theft recovery, disputes, or legal options, may need specialist help.

Important note

This is general information, not legal, medical, financial, therapeutic, or professional advice. Protections and timing can differ depending on whether the issue involves a credit card, debit card, PIN, electronic transfer, or account terms. If you see suspicious activity, contact your card issuer or bank using trusted contact details immediately.

Additional Resources

Closely connected guides that may be useful during the same situation or its immediate aftermath.

About this guide

This guide was produced and is maintained by PanicStation.org using its published editorial process. Official and specialist sources are checked where relevant, and AI-assisted tools may be used for drafting, organisation, and consistency checks. The site operator remains responsible for publication, revision, and removal decisions.

Support us