How I learned that my credit card number was stolen

Update: Some offers mentioned below are no longer available. View the current offers here.

Data breaches, identity theft and other forms of fraud are rampant these days. I've been fortunate to avoid any potential issues along these lines — until today, that is. My Chase Freedom Unlimited account number somehow fell in the wrong person's hands. And here's how Chase let me know about it.

At 10:33 a.m. on Tuesday morning, I received this email from Chase:

"We've sent an important communication to your Secure Message Center, available on Chase Online or on the Chase Mobile app.

The subject is: URGENT: Action needed to confirm activity on your Chase Freedom Unlimited account."

Not one to ignore an alert from a verified source with "URGENT" in all caps, I immediately logged into my account and accessed my secured messages. This is what awaited me:

I immediately called the number on the back of my card and was prompted to enter the last four digits of my account. After a few recorded messages, I was connected with an agent who quickly pulled up my account. I let her know about the message I had received and that the call was most definitely not from me, nor had I authorized anyone to call on my behalf. In an abundance of caution, I asked for the card to be cancelled and a new one sent.

She verified several pieces of information to ensure that it was (in fact) me this time, and then let me know that a replacement card would be sent via UPS to my home address with overnight shipping at no charge. She asked me if there was anything else she could help me with and then thanked me for my loyalty to Chase.

Total call time: 3 minutes, 56 seconds.

Just 32 minutes after the fraudster called Chase, my (apparently stolen) card number was cancelled, all because Chase's system flagged an unknown phone number from someone that was in possession of my 16-digit account number.

The Freedom Unlimited is my go-to card for everyday spending and a key part of what I consider to be the perfect quartet of Chase cards. While it's a bit inconvenient to need to update that card with the various providers that have it on file, it's a small price to pay to prevent unauthorized use of my account.

Daily Newsletter

Reward your inbox with the TPG Daily newsletter

Join over 700,000 readers for breaking news, in-depth guides and exclusive deals from TPG’s experts

Email address

Sign up

By signing up, you will receive newsletters and promotional content and agree to our Terms of Use and acknowledge the data practices in our Privacy Policy. You may unsubscribe at any time.

How to protect your credit card accounts

Here are things you can do to protect your accounts, many of which may have saved me this time:

1. Enable two-factor authentication wherever possible

For any online account — be it a bank, credit card or merchant — you should always take advantage of two-factor authentication. This prevents someone from accessing your account with just your password, instead requiring an added authorization via a text message, phone call, email or third-party verification app. Chase, for one, sends a temporary verification code whenever I try to log in to my account from a browser it doesn't recognize.

The extra step may seem like a hassle, but it's far better than having your account compromised.

2. Update your email address and phone number(s)

Setting up two-factor authentication may only work if you have the right email address and phone number(s) on your account, so you want to make sure those are accurate. This has the added ability of getting quick notification of possible fraud, like I did this morning.

Speaking of fraud alerts ...

3. Ensure alerts are sent where you want

Many companies allow you to specify where you want to receive notification of potential fraud. For example, American Express has an Account Alerts section of your online profile that allows you to specify the kind of alerts you get and where you get them — including the ability to customize the threshold of a "large" purchase.

An email alert isn't of much use if you're traveling abroad and have turned your data off while roaming, but a text message may reach you.

4. Regularly monitor your accounts

Many TPG readers probably don't have the 20+ credit cards to monitor that I do, but even if you only have one or two, get in the habit of logging in at least a couple of times a week to note if there are any pending (or posted) charges you don't recognize. Fraudsters may start small, spending $5 here and $10 there, hoping you'll overlook them before making a massive purchase. Even though most credit cards offer fraud protection coverage, it's better to identify possible problems sooner rather than later.

Bottom line

I have to commend Chase for identifying this potential vulnerability on my account, not only for the speed in which it was done, but how it was done. It's the first time I've heard of an issuer flagging an unauthorized phone number that had my full card number, and I'm hopeful that my quick action has squashed any chance that Mr. or Ms. XXX-XXX-1835 could use my card. While there's no foolproof way to prevent fraud entirely, you can at least reduce your risk of it by taking a few simple steps to add additional layers of security to your accounts.