Carding and card fraud: protecting your credit and debit cards
How phishing and skimming work, and what to do about an unfamiliar charge
Carding is the theft or misuse of payment card details for unauthorized transactions. It can happen while your credit or debit card is still in your wallet. Phishing and skimming are two ways card details can be stolen.
Phishing: when someone asks you to hand over the details
A message may appear to come from your bank, a shop or someone you know. It may say your account is in danger, a purchase needs to be cancelled, or a relative needs urgent help. The link leads to a convincing copy of a real page and asks for your card details, password or a payment code.
If a message is unexpected, open your bank's app yourself or call the number on your card or the bank's official website. Don't give anyone your PIN, card security code or one-time payment code. If a request comes from a friend or relative, contact them through another familiar channel. A recognizable sender name is not proof that they wrote the message.
Check a website's address before entering details. Familiar branding and a similar address are not enough to establish that the site belongs to the bank or retailer. Before approving a payment, check the payee and amount shown by your bank.
Skimming: when a device reads card data
Skimming uses an unauthorized device on an ATM or payment terminal to copy card data. A criminal may also try to observe or record your PIN.
Look at the card slot and keypad before using an ATM. If a part looks out of place or loose, or the machine behaves oddly, use another ATM and tell the bank. Don't try to remove a suspicious part yourself. Cover the keypad when entering your PIN. An ATM inside a bank branch may be easier to check, but still deserves a look.
A skimming attachment can resemble part of the machine. When in doubt, use another ATM.
If you spot a charge you don't recognize
Check your account in your bank's app or statement, since a payment alert itself can be fake. If the charge is unfamiliar, contact the card issuer immediately through an official channel and ask it to block or replace the card. Ask how to dispute the charge and keep a record of your report. If you disclosed a password or payment code, tell the issuer and follow its instructions for securing the account.
Dispute deadlines and protections vary by country and by whether the card is credit or debit. Reporting promptly matters; a refund cannot be promised before the issuer investigates. Avoid assuming that a familiar retailer or a chip card makes fraud impossible.
A personal finance app can help you review everyday spending, but it is not a substitute for your bank's transaction history or fraud alerts.