Card details stolen but card retained: what to do
Card fraud does not require somebody to steal the plastic. Card number, expiry date and security information can be taken through phishing, a compromised merchant or other data theft while the physical card stays in your wallet.
If the details are exposed or you see an unfamiliar card payment, contact the card issuer promptly. Use any temporary freeze as an immediate precaution if available, but ask whether the card should be cancelled and replaced because the old credentials may remain usable online.
Possessing the card does not make an online transaction authorised
Online and stored-card transactions can use credentials copied from the card or stolen from another system. When you tell the bank you still have the plastic, that fact helps the investigation but does not by itself prove the payment was yours.
The FCA states that the use of card details, password or PIN may not on its own prove authorisation. The bank should consider the circumstances.
Practical checkpoint for stolen card details when you still have the card: establish the starting position before you change anything. Use an unfamiliar £3 verification followed by a larger card-not-present attempt while the plastic card remains in your wallet as a worked example and write down merchant names, timestamps, card controls, digital-wallet list and any recurring-payment relationships. That turns 'Possessing the card does not make an online transaction authorised' into a testable sequence rather than a vague problem.
Separate a merchant dispute from an unauthorised transaction
If you recognise the merchant but dispute the quality, cancellation or amount, that is usually a merchant/card dispute. If you never made or approved the transaction, describe it as unauthorised.
That distinction matters because the processes and legal protections differ. Give the issuer a clear statement of what you did and did not consent to.
Run the numbers or sequence on paper before repeating the action. In the example of an unfamiliar £3 verification followed by a larger card-not-present attempt while the plastic card remains in your wallet, separate the amount, date, channel and decision point, then mark which part is confirmed and which part is still an assumption. For 'Separate a merchant dispute from an unauthorised transaction', the useful question is not simply whether something can work, but what result you should see next and how long you are prepared to wait before changing route.
Second check for section 2, 'Separate a merchant dispute from an unauthorised transaction': use an unfamiliar £3 verification followed by a larger card-not-present attempt while the plastic card remains in your wallet and write a one-line expected result beside the actual result. Then verify merchant names, timestamps, card controls, digital-wallet list and any recurring-payment relationships. If the two do not match, pause rather than creating another transaction or application. Freeze or report the card through the bank, dispute unknown transactions and ask whether a replacement card number is required.
If details were exposed, stop future use of those credentials
A temporary freeze can help while you contact the bank, but stolen card numbers can remain a problem when the card is unfrozen. Ask the issuer whether replacement is required and how digital wallets or recurring payments will be handled.
Do not post the suspicious transaction publicly with visible card or account information while asking others if they recognise the merchant.
Use a controlled process for 'If details were exposed, stop future use of those credentials'. Gather merchant names, timestamps, card controls, digital-wallet list and any recurring-payment relationships, take one deliberate action, and record the result before trying a second route. Do not assume possession of the physical card means its number has not been compromised. If the first route clearly cannot complete the job, freeze or report the card through the bank, dispute unknown transactions and ask whether a replacement card number is required rather than improvising with an unverified workaround.
Report unfamiliar payments quickly
The FCA says to notify the bank as soon as you notice an unauthorised payment and, in general, within 13 months. Eligible unauthorised payments are usually refundable by the end of the next business day unless a permitted exception applies.
Keep screenshots, receipts from your real purchases and any phishing message or breach notice that may explain how the details were taken.
Build a failure plan before the deadline matters. For stolen card details when you still have the card, decide what you will do if the normal route fails at the worst reasonable moment: a bill is due, a payment is time-critical, a phone is unavailable or verification will not complete. Keep enough time and money outside the process to recover. Under 'Report unfamiliar payments quickly', note the exact error or refusal wording because that is usually more useful to support than a general statement that it did not work.
Second check for section 4, 'Report unfamiliar payments quickly': use an unfamiliar £3 verification followed by a larger card-not-present attempt while the plastic card remains in your wallet and write a one-line expected result beside the actual result. Then verify merchant names, timestamps, card controls, digital-wallet list and any recurring-payment relationships. If the two do not match, pause rather than creating another transaction or application. Freeze or report the card through the bank, dispute unknown transactions and ask whether a replacement card number is required.
Review the route by which the details may have leaked
If you entered the card on a fake delivery or banking site, secure any passwords entered there too. If the card was saved in a shopping account, change that account password and review its order history.
The goal is not to prove exactly where every digit was stolen before acting. Replace the exposed credential first, then investigate the wider account security.
Treat evidence as part of the solution, not paperwork added afterwards. For 'Review the route by which the details may have leaked', keep merchant names, timestamps, card controls, digital-wallet list and any recurring-payment relationships in one dated folder and write a two-line chronology of each contact. Do not assume possession of the physical card means its number has not been compromised, and use only a channel you reached independently when security or fraud is involved.
Card-not-present theft can happen without the plastic ever leaving your hand
If the card number, expiry date or security code has been copied, somebody may attempt online purchases while the physical card is still in your wallet. Freeze or report the card through the issuer's official route, then review the statement for small unfamiliar authorisations as well as obvious large payments. Criminals sometimes use low-value transactions to test whether stolen details are still active.
Do not assume changing the PIN fixes stolen card details. The PIN protects different payment routes; an online merchant can use the card number without it. Once the issuer replaces the card, check subscriptions and digital wallets, but only update merchants you recognise. If an unknown 'support agent' contacts you after the replacement request, do not give them the new card number or activation code.
Unauthorised card fraud is different from an APP scam where you personally send a bank transfer after being deceived. Describe the incident accurately when you contact the bank. The FCA notes that different reimbursement rules apply depending on the payment method, so using the correct fraud route matters.
Finish with a decision rule for stolen card details when you still have the card. In the worked example of an unfamiliar £3 verification followed by a larger card-not-present attempt while the plastic card remains in your wallet, the safer next step is the one that preserves evidence and keeps essential money or account access recoverable. If the provider cannot explain the next step clearly, freeze or report the card through the bank, dispute unknown transactions and ask whether a replacement card number is required and keep the case reference until the outcome is reconciled.
Sources and verification
Victoria Hughes - Consumer Rights Specialist
“The card is still in my hand” rules out physical loss, not card fraud. Treat exposed card credentials as stolen credentials: secure the card account, identify unauthorised transactions and then fix the channel through which the details were leaked.
MyBankAnswers uses official provider and UK regulatory sources wherever practical. Information is general and does not constitute financial advice.