PanicStation.org
UK USA
us Money & financial emergencies

What to do if…
your card issuer flags a purchase as suspicious and demands immediate identity checks

Produced and maintained by PanicStation.org Published: Last reviewed: Editorial policy USA guide

Short answer

End any unexpected call, text, email, or app contact, then contact your card issuer yourself using the number on the back of your card or the official app. Do not share one-time codes or approve prompts you did not start.

Do not do these things

  • Don’t keep talking because someone says it is urgent or your account will be closed.
  • Don’t read a one-time passcode or verification code to anyone who contacted you.
  • Don’t approve a push notification unless you started the action and know what it is for.
  • Don’t click a verify-now link in a text or email.
  • Don’t send ID photos, scans, or selfies through a link, text, email, or messaging app you did not independently open.
  • Don’t install remote-access or screen-sharing apps for someone claiming to be card security.
  • Don’t share your PIN, password, full Social Security number, or full card security details.
  • Don’t move money, buy gift cards, buy crypto, or transfer funds to protect your account.
  • Don’t trust caller ID by itself; it can be spoofed.

What to do now

  1. Stop the contact. Hang up, close the message, or leave the chat. Do not reply, click, or approve anything from that contact.
  2. Use a trusted route to your issuer. Call the number on the back of your card, type the issuer’s website address yourself, or open the official app you already use.
  3. Ask whether the alert is real. On the verified line or inside the official app, ask: “Is there a fraud alert or suspicious purchase on my account right now?”
  4. Ask exactly what check is needed. Ask the issuer what identity checks they need and which things they will never ask you to share, such as one-time codes, passwords, or PINs.
  5. Complete checks only inside a channel you opened yourself. If ID is needed, use the issuer’s official app, secure portal, branch, or another method the verified issuer gives you. Do not use the link or contact route from the unexpected message.
  6. Lock or freeze the card if you can. If your official app has a card lock, freeze, or similar control, use it while you verify what happened.
  7. Check recent card activity. Look at recent and pending transactions. If you see anything you did not authorize, report it to the issuer on the verified channel and ask about replacing the card or card number.
  8. Mention any unsolicited code or prompt. Tell the issuer if you received a code, login prompt, wallet-add prompt, or purchase approval you did not request. Ask whether anyone tried to log in, add your card to a digital wallet, or change account details.
  9. If you shared a code, password, ID, or personal information, contain it. Ask the issuer to secure the account, reset online access, remove unknown devices or wallets, and issue a replacement card if needed.
  10. Report after the issuer is contacted. If this was a scam attempt, report it to the FTC. If you suspect identity theft, use IdentityTheft.gov. If the incident involved online account takeover, phishing, or cyber-enabled fraud, you can also report it to IC3.

What can wait

  • You do not need to decide right now whether the alert was definitely real or definitely a scam.
  • You do not need to contact the merchant unless your issuer tells you to.
  • You do not need to place a credit freeze or fraud alert in the first minute unless personal information was exposed or you suspect identity theft.
  • You do not need to make large account changes before you have reached the issuer through a trusted route.

Important reassurance

Real card fraud alerts and scam impersonations can feel very similar at first. Slowing down, ending the unexpected contact, and restarting through your issuer’s official route is a safe and reasonable first step.

Scope note

These are first steps only to reduce harm, avoid irreversible mistakes, and stabilize the moment. Later decisions about disputes, identity theft recovery, credit freezes, fraud alerts, or complaints may need specialist help.

Important note

This is general information, not legal, financial, cybersecurity, or other professional advice. Card issuer policies and verification methods vary, so use your issuer’s verified contact route for account-specific instructions.

Additional Resources

Closely connected guides that may be useful during the same situation or its immediate aftermath.

About this guide

This guide was produced and is maintained by PanicStation.org using its published editorial process. Official and specialist sources are checked where relevant, and AI-assisted tools may be used for drafting, organisation, and consistency checks. The site operator remains responsible for publication, revision, and removal decisions.

Support us