Credit card security: fraud and liability

Modern security features

Credit cards today have several layers of protection that complement each other:

• EMV chip: it generates a unique code for every payment and is practically impossible to copy
• 3-D Secure (Visa Secure, Mastercard Identity Check, American Express SafeKey): you approve online payments in the app or with a code
• Strong customer authentication under the EU Payment Services Directive (PSD2): two factors from possession, knowledge and biometrics
• Contactless payments with limits: in Germany usually up to €50 per payment without a PIN; above that, and after several payments in a row, you are asked for the PIN
• Real-time notifications, limits and card blocking in the card app

Liability for misuse: what the law says

If your card is misused, the bank must in principle refund unauthorised payments immediately – at the latest by the end of the business day after it learns of them. How much you have to bear yourself depends on the situation:

In an emergency: block your card and dispute payments

If your card is lost or stolen, or you spot a suspicious transaction, every minute counts. Block the card immediately in the app or via your bank's hotline. The central card-blocking hotline (Sperr-Notruf) 116 116 is available around the clock, provided your bank is connected to it; from abroad, you can reach it on +49 116 116.

• Block the card in the app or by phone and have the block confirmed
• If the card was stolen, report it to the police – many banks require this before they refund you
• Dispute unauthorised transactions in writing or in the app; the deadline for this is no more than 13 months from the date of the debit
• Change your login details for online banking and the app if they may have been compromised
• Check your next statements particularly carefully

How to protect yourself

Besides your bank's technical safeguards, a large part of security comes down to your own behaviour. Turn on push notifications in the card app so that you see every payment immediately and can spot unauthorised transactions early. Never write your PIN down anywhere, and don't use it for other cards or accounts.

Today the most common scam is not card theft but phishing: fake emails, text messages or calls from supposed bank employees who try to get you to approve a payment or hand over your details. Your bank will never ask for your PIN, your full card details or approval codes. Only approve payments in the app that you have just initiated yourself – approving a payment for a fraudster can be considered grossly negligent.

Paying safely online

Only buy from merchants you know or whose legal notice (Impressum) and reviews you have checked, and make sure the connection is encrypted. For one-off or riskier purchases, some providers offer virtual single-use cards whose details become invalid after the payment.

Also set an online or daily limit. Many card apps let you temporarily block online, foreign or contactless payments and re-enable them when needed. If you are in a dispute with a merchant – for example because goods you have paid for never arrive – your card bank's dispute procedure (chargeback) can often help; ask your bank about it if the merchant doesn't respond.

Frequently asked questions about credit card security

How much do I have to pay if my card is misused?

If the card is lost or stolen, no more than €50 for payments made before you block it, and nothing after you have reported it. You are also not liable if the bank did not require strong customer authentication. You are only liable without limit in case of gross negligence or intent, for example if the PIN was written on the card.

Is contactless payment safe?

Yes. Every contactless payment generates a unique code, and without a PIN, payments in Germany are usually only possible up to €50; after several payments, you are asked for the PIN every now and then. If you don't need the feature, you can turn it off in many apps.

Is a credit card safer than a debit card?

The liability rules are the same for both. One practical advantage of a credit card: if it is misused, the money isn't missing from your current account straight away – at first it only appears on your card statement until the dispute is resolved.

What should I do if I don't recognise a payment?

First check whether the merchant name on your statement is different from what you expected. If the transaction remains unclear, block the card and dispute the payment with your bank immediately. You have up to 13 months for unauthorised payments, but faster is always better.