A guide to small-charge credit card fraud and how to protect yourself

I’ve been earning rewards on travel credit cards for nearly two decades, and I’ve had my fair share of close calls when it comes to credit card fraud. However, by monitoring my credit report and frequently checking my 20-plus card accounts, I’ve been able to avoid any major issues thus far (knock on wood).

Recently, my diligence paid off mightily, as I noted that one of my credit card accounts had been compromised by a common scam known as small-charge fraud.

Here’s what you can learn from my experience — and how you can prevent it from happening to you.

Credit card fraud can mean a variety of things, but it typically involves scammers gaining access to your credit card information in some way. It could be a physical credit card skimmer at a point-of-sale machine or a hacker who’s gained unauthorized access to a merchant’s systems and grabbed your card number.

We’ve also seen BIN attacks, where scammers use the first six digits of your credit card account (the bank identification number for the issuing institution) to then effectively guess your full card number using the power of computer programs. It could even be an unscrupulous employee snagging your card details during the purchasing process.

Related: How a 10-minute call reversed $2,300 in fraudulent charges on my credit card

However, just because someone has your credit card number doesn’t mean they can use it successfully. After all, card issuers employ a variety of fraud prevention techniques that can flag questionable purchases.

That’s where small-charge fraud comes into play.

Instead of immediately taking your card information and going on a spending spree, a scammer will start small and make little test purchases to see if they go through. If they do, the scammer can scale up to larger ones — or sell your card number for a higher price on the black market — since the card has now been verified as legitimate.

Daily Newsletter

Reward your inbox with the TPG Daily newsletter

Join over 700,000 readers for breaking news, in-depth guides and exclusive deals from TPG’s experts

Unfortunately, I fell victim to this very scheme last month.

However, I noticed two odd items on my Chase Sapphire Reserve.

Both of these purchases were with websites I had never heard of (let alone visited and purchased anything from), and both were less than $1.50.

When I searched for the sites on Google — which I did by adding a space before the domain suffixes so as not to risk visiting a potentially fraudulent site — both came up with the same message: “No information is available for this page.”

I then called the number on the back of my card, and the agent quickly came to the same conclusion I had: My card number had been compromised. She immediately froze the account and issued a new card, which thankfully would be sent via priority mail (a relatively common service for premium travel credit cards).

The charges were reversed, and less than 48 hours later, I received my new card from UPS.

Sure, it’ll be a hassle to update the online merchants where I frequently use this card — most notably airlines and hotel loyalty programs, given that the card earns 3 points per dollar spent on all travel purchases and includes a variety of trip protections if things go wrong. Nevertheless, it’s a small price to pay to prevent further fraud on the account.

Related: Chase Sapphire Reserve credit card review: Luxury perks and valuable rewards

• Use a password manager. It may seem odd, but one of the most important things you can do for your points and miles strategy is to use a password manager and set up unique, hard-to-guess passwords for every single account you have. If you currently use some version of the word “password” as the password for any of your card accounts, stop reading now (no, seriously) and change it. Using a randomly generated password like “@rh&EP9Dk4!lm8yT” (which I just pulled directly from LastPass, the program I use) is significantly more secure than something like “Password123.”
• Enable alerts from your card issuers. Ensure you have the proper alerts enabled on your credit cards, authorizing issuers to contact you when something looks fishy. Each one is slightly different, so check your online accounts’ security or communication section to set up the alerts you want.
• Check your accounts regularly. Once you have a secure password, check your accounts regularly for unfamiliar transactions. I usually access my most frequently used accounts daily, but even logging in once a week or every other week can go a long way toward flagging unauthorized purchases and taking steps to resecure your accounts.
• Sign up for credit monitoring. Many companies will monitor your credit report and send you notifications when there are major changes (like a hard inquiry for a new line of credit). The most in-depth services charge a subscription fee, but many free ones still offer decent protection. Most issuers have their own versions as well — like Chase Credit Journey — that you should enable if you’re an existing customer.

Again, though, these aren’t foolproof. These two transactions still managed to get through, though by staying on top of my spending activity, I was able to quickly notify Chase, which (in turn) immediately took steps to resolve it.

Related: Credit card fraud vs. identity theft — how to know the difference