Credit and Debit Card Fraud Explained: Types, Examples and how to Stay Safe

—
Credit and debit cards make payments simple.
You can use them at:

• Shops
• ATMs
• Restaurants
• Websites
• Mobile applications
• Subscription services

But criminals may also try to steal or misuse card information.
This is commonly known as credit card fraud or debit card fraud.
A simple definition is:
Card Fraud = Unauthorized or fraudulent use of a credit or debit card, its credentials, or associated authentication information
A criminal may not even need the physical card.
Depending on the transaction, stolen information such as:
Card Number + Expiry Date + CVV + OTP
may be enough to attempt an online payment.
Card fraud can therefore happen in both:
PHYSICAL WORLD
and:
ONLINE WORLD

—

Understanding Credit and Debit Card Fraud

Card fraud can happen in several ways.
The criminal may:

• Steal the physical card
• Copy card information
• Observe the PIN
• Use a fake payment website
• Trick the victim into revealing card details
• Steal information from a compromised website
• Obtain an OTP through social engineering
• Make unauthorized purchases

The objective is usually simple:
Use Someone Else’s Payment Information for Financial Gain

Simple Example

Suppose a victim enters their card details into a fake shopping website:
Card Number
Expiry Date
CVV
The website does not actually sell anything.
Instead, it sends the entered information to the criminal.
The fraudster then attempts to use those details elsewhere.

—

Credit Card Fraud vs Debit Card Fraud

Both types involve unauthorized use of payment-card information, but the source of money differs.

The Safety Rule Is the Same

Whether the card says:
Credit
or:
Debit
protect:

• Card number
• Expiry date
• CVV
• PIN
• OTP
• Banking credentials

—

Card-Present vs Card-Not-Present Fraud

Understanding these two terms makes card fraud much easier to understand.

Card-Present Transaction

The physical card is involved.
Examples:

• ATM withdrawal
• Card payment at a shop
• Restaurant POS payment

Fraud may involve:

• Stolen card
• Card skimming
• PIN theft
• Tampered terminal

Card-Not-Present Transaction

The physical card does not need to be presented.
Examples:

• Online shopping
• App payment
• Online subscription

The transaction may rely on information such as:
Card Number + Expiry Date + CVV + Additional Authentication

—

Stolen or Lost Card Fraud

This is one of the easiest card-fraud scenarios to understand.
A criminal physically obtains your card.
They may try to:

• Use contactless payment
• Make retail purchases
• Attempt online transactions
• Withdraw cash if the PIN is known
• Collect information printed on the card

Why Immediate Action Matters

If your card disappears, do not simply wait to see whether it turns up.
Use your bank’s official channel to:
Block / Freeze the Card
Many banking applications allow this directly.

—

ATM Card Skimming

Card skimming involves secretly copying information from a payment card.
A criminal may attach or insert a malicious device around an ATM card reader.
When the victim inserts the card, information may be captured.
The criminal may also attempt to obtain the PIN using:

• Hidden camera
• Fake keypad overlay
• Shoulder surfing
• Other tampering

A simplified attack looks like:
Insert Card
↓
Skimmer Reads Card Information
↓
PIN Captured
↓
Criminal Obtains Card Data
↓
Unauthorized Activity
CERT-In has long warned about debit-card skimming and ATM tampering as card-fraud risks.

Before Using an ATM

Look for:

• Loose card reader
• Unusual attachments
• Damaged keypad
• Suspicious overlays
• Hidden objects around keypad

Cover the keypad while entering your PIN.

—

PIN Theft and Shoulder Surfing

Sometimes the attack is much simpler than technical skimming.
A criminal watches you enter the PIN.
This is called shoulder surfing.
They may observe:

• ATM keypad
• POS terminal
• Phone screen

If they later obtain the card, knowing the PIN increases the risk.

Protect Your PIN

When entering it:

• Cover the keypad
• Maintain privacy
• Do not speak the PIN aloud
• Never write the PIN on the card
• Do not share it with another person

—

Fake Shopping Website Card Fraud

A fake e-commerce website may look nearly identical to a real online store.
The attacker may advertise:
90% Discount
Limited Stock
Festival Offer
Clearance Sale
The user enters:

• Name
• Address
• Card number
• Expiry
• CVV

The criminal now has valuable card information.

Warning Signs

Be cautious if you see:

• Unrealistic discounts
• Strange domain name
• Poorly copied website
• Unexpected payment page
• Suspicious advertisement
• No credible company information

—

Phishing for Card Details

A phishing message may impersonate:

• Bank
• Card issuer
• Shopping site
• Courier service
• Government department
• Subscription provider

Example
SMS:
“Your credit card has been temporarily suspended. Verify immediately.”
The link opens a fake bank website.
The site asks for:
Card Number
↓
Expiry Date
↓
CVV
↓
OTP
The attacker can collect everything entered.

Important Warning

A website displaying a bank logo does not prove that it belongs to the bank.
Attackers can easily copy:

• Logos
• Colours
• Text
• Page layouts

—

Fake Bank Call and Card Verification Scam

A fraudster may call and claim:
“Your credit card requires verification.”
or:
“Your card will be blocked today.”
They may request:

• Card number
• Expiry date
• CVV
• OTP
• PIN

The caller may already know your:

• Name
• Bank
• Phone number

That does not prove legitimacy.
Example
Caller:
“Your reward points expire today.”
They ask:
“Please confirm the 16-digit card number.”
Then:
“Now tell me the expiry date.”
Then:
“Please provide CVV for verification.”
Finally:
“Read the OTP.”
Notice how the criminal gathers information one step at a time.

—

Card Fraud Through OTP Manipulation

An attacker may already have enough card information to start an online payment.
The final barrier may be the OTP.
They then call the victim and create another story.
For example:
“This OTP will cancel the transaction.”
But the actual message may say:
OTP for purchase of ₹19,999
The victim shares the code.
The attacker completes the payment.

Always Read the Full Message

Do not only read:
482913
Look for:

• Transaction amount
• Merchant
• Purpose
• Warning text

—

Online Card Skimming

Card skimming is not limited to physical ATMs.
A compromised e-commerce website can also steal card information.
Attackers may compromise:

• Website
• Payment page
• Vulnerable plugin
• Third-party script

Malicious code can capture information entered by customers.
CERT-In has specifically documented online skimming, in which malicious JavaScript placed on compromised e-commerce sites can collect customer and card information.
A simplified example:
Customer Visits Compromised Store
↓
Enters Card Information
↓
Payment Still Appears Normal
↓
Malicious Code Copies Information
↓
Card Data Sent to Attacker

—

Fake Customer Support Card Fraud

Suppose your card payment fails.
You search:
“ABC Bank credit card customer care”
A fraudulent phone number appears somewhere online.
You call.
The person says:
“We can fix the issue.”
They ask for:

• Card information
• OTP
• PIN
• Remote-access installation

Because you called them, the interaction may feel legitimate.
That can make the scam particularly convincing.

—

Remote Access and Screen-Sharing Fraud

A criminal may claim:
“Install this application so we can fix your card.”
The application may allow screen sharing or remote control.
The attacker may then observe:

• Banking app
• SMS
• Card information
• OTP
• Payment process

Remote-access applications can be legitimate tools.
The danger comes from granting control to an untrusted person.
CERT-In has warned about scams where fraudsters persuade users to install remote-access applications and then obtain card or banking information.

—

Contactless Card Fraud

Many modern cards support contactless payments.
This allows small purchases to be completed by tapping the card against a compatible payment terminal, subject to issuer and transaction controls.
This is convenient, but a stolen contactless card may potentially be misused until it is blocked.

Protection

If your card is lost:
Do not wait.
Freeze or block it using your bank’s official channel.
Some banks also allow customers to:

• Disable contactless transactions
• Set spending limits
• Disable international transactions
• Disable online transactions

These controls can reduce unnecessary exposure.
—

International and Online Transaction Controls

Many banking applications allow different card capabilities to be enabled or disabled.
Depending on the bank, controls may include:

• Domestic transactions
• International transactions
• Online transactions
• ATM withdrawals
• Contactless payments

If you never use a particular capability, consider keeping it disabled where your bank supports this.
Example
You never make international card payments.
Keeping:
International Transactions = OFF
may reduce unnecessary exposure.

—

Credit Card Fraud vs UPI Fraud vs OTP Fraud

These Series 2 topics are connected but not identical.

They can also overlap.
Example
A phishing website steals:
Credit Card Number + Expiry + CVV
Then the criminal calls and steals:
OTP
The final financial incident includes both:
Card Credential Theft + OTP Fraud

—

Warning Signs of Card Fraud

Be suspicious when:

Someone Requests Your PIN

Do not share it.

Someone Requests an OTP

Do not share it.

Someone Requests Your CVV Over the Phone

Stop and verify.

You Receive an Unexpected Transaction Alert

Check immediately.

You Receive an OTP for a Purchase You Did Not Initiate

Do not reveal the OTP.

A Bank Caller Creates Extreme Urgency

Verify independently.

A Website Offers Unrealistic Discounts

Check the merchant before entering card details.

An ATM Looks Tampered With

Use another ATM.

Someone Requests Remote Access to Your Phone

Do not install unknown software.

Small Unknown Transactions Appear

Do not automatically dismiss them.
A suspicious small transaction may still require investigation.
—

How to Use Credit and Debit Cards More Safely

Protect the Physical Card

Do not leave your card unattended.

Protect the PIN

Cover the keypad when entering it.

Never Share OTP

An OTP is an authentication secret.

Protect Your CVV

Do not casually reveal it to callers or messages.

Use Trusted Websites

Avoid entering card information into suspicious websites.

Avoid Links in Unexpected Messages

Open your bank or merchant directly.

Use Transaction Alerts

Review SMS, email and app notifications.

Set Appropriate Limits

Use your bank’s available transaction-control features.

Disable Unused Capabilities

Where supported, turn off:

• International transactions
• Online transactions
• Contactless

when you do not need them.

Review Statements

Regularly inspect:

• Credit-card statements
• Bank statements
• Recent transactions

—

What to Do If Your Card Is Lost or Compromised

If you suspect card fraud, act quickly.

Step 1 — Freeze or Block the Card

Use:

• Official banking app
• Official internet banking
• Verified bank support channel

Step 2 — Review Recent Transactions

Identify transactions you did not make.
Record:

• Amount
• Merchant
• Date
• Time
• Transaction reference

Step 3 — Report Unauthorized Transactions to Your Bank

Contact the issuing bank immediately.
Follow its official dispute and fraud-reporting process.

Step 4 — Secure Related Accounts

If card information was entered into a suspicious website:

• Change relevant account passwords
• Remove suspicious applications
• Review email security
• Check for other unusual activity

Step 5 — Preserve Evidence

Keep:

• Transaction alerts
• Statements
• Screenshots
• Fraudulent website address
• SMS
• Emails
• Phone numbers
• Chat messages
• Transaction references

Step 6 — Report Cyber Financial Fraud

For cyber financial fraud in India:
Call 1930
and report through:

CERT-In’s current public guidance also directs citizens affected by cyber financial fraud to the National Cyber Crime Reporting Portal or the 1930 helpline.

—

Summary

Credit and debit card fraud occurs when criminals misuse:

• Physical cards
• Card information
• PINs
• CVVs
• OTPs
• Compromised payment systems

Card fraud can happen both:
OFFLINE
through methods such as:
Card Theft → ATM Skimming → PIN Theft
and:
ONLINE
through:
Phishing → Fake Shopping Sites → Credential Theft → Online Skimming
One of the most important concepts to remember is:
Your Card and Your Card Information Both Have Value
You should therefore protect:
CARD NUMBER + EXPIRY + CVV + PIN + OTP
and regularly monitor your transactions.

—

Useful Links and References

SanchitGurukul Static Resources

Official External References