Loading page
Tripwire is a private demonstration page, not a bank, card issuer or monitoring service, and is not affiliated with any company named on it.
Fraud protection
The charge that costs you is rarely the first one
Card fraud almost always opens with something small and forgettable — a few dollars at a merchant you half recognise — to check the card still works. The window between that and the real charge is where everything is decided, and the free tool that catches it is an alert you can turn on in two minutes.
The statement below is an illustration. Nothing on this page connects to any account, and no bank or card issuer is named.
How it starts
One of these is not yours
This is what a card test looks like on a statement: small, plausible, and sitting between two real transactions. It is the only line here you could have acted on.
Corner Market
$41.86
Transit Authority
$2.75
DIGITAL SVCS 8829
$1.09
Small, odd hour, unfamiliar name. A test charge exists to confirm the card is live before anything larger is attempted. If a charge you do not recognise appears — however trivial — treat the card as compromised and have it replaced rather than watching to see what happens next.
Riverside Pharmacy
$18.40
Utility Payment
$96.12
Nothing about that row is technically detectable by you in advance. What is available to you is the alert that puts it on your phone at 03:47 instead of on a statement three weeks later.
The alert setup, for the accounts that matter
Which alerts to turn on, the thresholds that are actually useful, and why the default settings on most accounts miss the charge that matters.
If it has happened
The first 48 hours, in order
Deadlines here are statutory and they are shorter than people expect, particularly on a debit card.
Immediately
Contact the bank on a number you already had
Use the number on the back of the card or in your own records — never a number from the message that alerted you. Ask for the card to be blocked and reissued, not merely flagged, and ask them to log it as fraud rather than a disputed purchase.
Same day
Write down the times
When you noticed, when you called, who you spoke to, and what you were told. Almost every subsequent step asks for this, and reconstructing it later is how claims stall.
Within 2 business days
The debit-card deadline that matters most
For an unauthorised electronic transfer, reporting within two business days of learning about it caps your liability at a low statutory figure. Wait longer and the cap rises sharply, which is the single most expensive delay on this page.
Within 60 days
The outer statement deadline
Errors must generally be reported within 60 days of the statement showing them. Past that window, protection for a debit account can fall away entirely — the reason to read statements at all.
After the money
Report it, then check your credit file
Report to the FTC and, for anything online, to the FBI's IC3. If your details were used to open something rather than to spend, freeze your credit at all three bureaus — that is a different problem from a stolen card number.
The distinction that decides it
Unauthorised is protected. Authorised is mostly not.
This is the line almost every loss falls on, and it is the one thing worth understanding before anything else on this page.
Strong protection
Someone used your card without you
An unauthorised transaction. Credit cards carry a statutory liability cap and most issuers apply zero liability in practice; debit cards are protected too, on the tighter deadlines above. This is the case the law was written for.
Weak protection
You were persuaded to send it
An authorised payment, even though you were deceived into making it. Bank transfers and person-to-person payment apps generally treat these as instructions you gave, and recovery depends on goodwill and speed rather than on a right.
The tell
“Move your money to a safe account”
No bank asks this, ever. It is the standard script of the impersonation scam precisely because it converts a protected unauthorised transfer into an unprotected authorised one — with you pressing the button.
What helps either way
Speed, and a number you already had
Funds can sometimes be recalled within hours and rarely after days. Hanging up and calling the number on your card — not the one you were given — costs a minute and defeats the entire script.
Straight answers
Questions people actually ask
- Is a paid fraud-monitoring service worth it?
- For card fraud specifically, usually not — your bank's own alerts are free, instant, and watch the same account. Paid services earn their cost on the wider identity picture: new accounts opened in your name, which your card issuer cannot see.
- Credit card or debit card for online purchases?
- Credit, where you have the choice. The protections are stronger, the deadlines more forgiving, and a disputed charge is the issuer's money while it is investigated rather than yours missing from your account.
- They knew my name and last four digits. Was that not proof?
- No. Those details circulate widely after breaches and are exactly what makes an impersonation call convincing. Knowledge of your data is evidence of a breach somewhere, not evidence of who is calling.
- Can I get money back from a payment app?
- Sometimes, and it depends entirely on whether the payment was unauthorised or authorised. Report it immediately either way — speed is the main variable you control.
- Should I cancel the card for one small charge?
- Yes. A test charge means the number is in circulation. Replacing the card costs you an afternoon of updating subscriptions; not replacing it costs you the charge that follows.
- What alerts should I turn on?
- Every card transaction regardless of amount, any change to contact details, and any new payee. The low threshold is the point — the charge worth catching is the one small enough to ignore.
Go straight to the source
Official references, none of them selling protection
- ReportFraud.ftc.govThe FTC's reporting front door for fraud and scams.
- FBI IC3For anything that happened online, especially wire and transfer fraud.
- CFPB — disputing a chargeYour rights on card billing errors and unauthorised charges.
- CFPB — electronic transfersThe debit-card deadlines, from the regulator that enforces them.
- IdentityTheft.govIf accounts were opened rather than existing ones used.
- Equifax security freezeFree, and the right step when your identity rather than your card was used.
One email, then we leave you alone
Turn the alerts on before you need them
Which ones, at what threshold, and the settings most accounts ship with that quietly miss the charge that matters.
The alert setup, for the accounts that matter
Which alerts to turn on, the thresholds that are actually useful, and why the default settings on most accounts miss the charge that matters.