What should I do if my credit card number is stolen?

Freeze or close the card immediately in your banking app, then report every charge you did not make — Canadian issuers apply zero-liability protection for confirmed fraud. Request a new card number, update the legitimate payments attached to it, and check your credit report a few weeks later for accounts you did not open.

Last updated — July 2026 · 6 min read

The first hour

  1. Freeze the card in the app

    Every major Canadian issuer has an instant lock. Use it before calling — it stops further authorisations while you are still on hold.

  2. List every charge you do not recognise

    Go back at least 90 days. Card thieves usually test with a small charge before a large one, so a forgotten $1.50 is often the first sign rather than noise.

  3. Report the fraud to your issuer

    Confirmed fraudulent charges are covered by network zero-liability rules. Report promptly — delay is the main thing that weakens a claim.

  4. Get a new number, and write down what breaks

    A reissued card breaks every subscription and saved checkout attached to it. Make the list before the new card arrives so you are not discovering them one failed payment at a time.

The first week

  • Change the password on any account where that card was saved, especially if you reused the password anywhere.
  • Turn on two-factor authentication on your bank, your email, and any shopping account holding a card. Email is the master key — protect it first.
  • Watch for follow-up phishing. A stolen card is often accompanied by a convincing call or text from "your bank" asking you to confirm details. Your bank will not ask for a full card number or a one-time code.
  • Request your free credit report from Equifax Canada and TransUnion Canada. A stolen card number alone rarely enables new accounts, but if more of your identity leaked, this is where it shows.

How did the number leak?

Almost never by someone watching you type. The realistic sources are a merchant or processor breach where stored card data was taken, malware on a device you shopped from, a skimmer or compromised terminal, or a convincing phishing page that you entered the card into yourself.

You will often never find out which. That is genuinely fine — the useful conclusion is not which merchant failed, but that your one card number is held by dozens of parties, any one of which can fail without telling you.

Making the next one cost nothing

The reason a stolen card number is painful is not the fraudulent charges — those get reversed. It is the reissue: a new number, and then two weeks of failed subscriptions, declined checkouts, and re-entering details everywhere.

That pain exists only because one number is shared with everyone. When each merchant holds a different number, a breach is a single card you close and replace in seconds. Nothing else you pay for notices, because nothing else uses that number.

This is the entire argument for per-merchant virtual cards, and it is worth more the more places you shop. ReVault is building this for Canada, where the dedicated platforms Americans use are not available.

Related questions

  • Am I liable for fraudulent charges in Canada?

    Generally no. Visa and Mastercard zero-liability policies cover confirmed unauthorised charges when you report promptly and did not act with gross negligence — sharing your PIN, for instance. Report as soon as you notice; delay is the main thing that jeopardises a claim.

  • Should I file a police report for a stolen card number?

    For card fraud alone, usually not — your issuer handles it and rarely asks. Report to the Canadian Anti-Fraud Centre, which tracks patterns. If your broader identity was stolen and accounts were opened in your name, a police report becomes genuinely useful.

  • How long do I have to dispute a fraudulent charge?

    Issuers set their own reporting windows and network chargeback rules typically allow around 120 days from the transaction. Do not rely on the outer limit — report as soon as you spot the charge, because a prompt report is the strongest version of the claim.

  • Will I have to change all my subscriptions again?

    With one shared card number, yes — every saved payment on it breaks when it is reissued. With a card per merchant, no: you replace only the one card that leaked, and every other payment continues untouched because it uses a different number.

Every dollar gets a mission

ReVault is pre-launch in Canada. The waitlist is free and invitations go out in order.

Join the waitlist

Keep reading