February 13, 2006 2:19 PM PST

Banks scramble on debit card theft

Several large banks and credit unions have replaced about 200,000 debit cards in the wake of a security breach at an unidentified retail chain and Sam's Stores, owned by Wal-Mart Stores.

Multiple law enforcement and banking sources have told CNET News.com that unauthorized charges have shown up on the accounts of many OfficeMax customers, but the company has denied suffering any security breach.

Readers have asked about whether they're liable if they're victimized by hackers. Here's what we found.

Q: Can I ever be held responsible for unauthorized charges on my account?
Yes, you most certainly can be. Consumers must report fraudulent charges within 60 days after receiving their bank statement. The law makes allowances in certain situations, such as a trip abroad or an illness. Save receipts and review your statements often and carefully as soon as they arrive. The government also requires consumers to notify their banks within two business days after discovering an unauthorized charge in some way other than through a statement (if, for instance, they find out by accessing their account online, or if they know their card or PIN has been stolen).

Q: If I'm held liable, how much would I have to pay?
Actually, you can be held accountable even if you notify your bank within 60 days. The law allows you to be on the hook for a maximum of $50. If you fail to give notice within 60 days, you may be responsible for any theft that occurs between the end of the 60-day period and the time you notify the bank, as long as it doesn't exceed $500. The bank must prove that the charges wouldn't have occurred had it been notified.

The same process works for the two-day period. Consumers can be held accountable for unauthorized charges in the period that begins two days after they find out about the problem and before they notify the bank.

Q: Does every financial institution follow these rules?
No. Some banks may choose not to hold an account holder responsible for any unauthorized charges. For more information, see the federal regulations for electronic-fund transfers.

Q: Why would anyone steal my debit card number? Don't they need the PIN?
Crooks buy their own ATMs, some of which are available on eBay for less than $1,500. Others set them up around gas stations or retail outlets. They are used to steal debit card information including PINs. Thieves also rig card readers onto legitimate ATMs to grab data while training cameras on the ATM's keypad to learn PINs, a technique known as "skimming." Another way to pilfer PINs and debit card information is to buy them from unscrupulous retail store employees.

To protect yourself, cover the keypad as much as possible when punching in your PIN. Try to limit your use of iffy-looking standalone ATMs, and never use one that has funny wiring or cameras attached. Use common sense, says Gary Kishner, a spokesman for Washington Mutual. "If your gut tells you the place doesn't feel right, go to another ATM," he said.

Q: Is it safer to use my credit card rather than my debit card?
No. Both are safe, according to representatives from many financial institutions. The amount of fraud committed using a debit card is a tiny fraction compared with the overall number of times you use the card yourself or compared to other payment forms. "A criminal will always find a way to commit fraud," Kishner said. "It's up to the banks, customers and law enforcement to work together to stop the criminals."

See more CNET content tagged:
debit card, ATM, bank, security breach, Bank of America Corp.


Join the conversation!
Add your comment
Article is inaccurate and misleading
Consumer liability for debit cards, as restricted by federal law, is clearly detailed in the Federal Reserve Bank's Regulation E. ( <a class="jive-link-external" href="http://ecfr.gpoaccess.gov/cgi/t/text/text-idx?c=ecfr&#38;sid=f9b4f5d9ec9d9bd84cc49dae5ec779e9&#38;rgn=div8&#38;view=text&#38;node=12:;idno=12" target="_newWindow">http://ecfr.gpoaccess.gov/cgi/t/text/text-idx?c=ecfr&#38;sid=f9b4f5d9ec9d9bd84cc49dae5ec779e9&#38;rgn=div8&#38;view=text&#38;node=12:;idno=12</a> ) Some banks wont hold you to the standard stated in Regulation E; but most do and doing so can be most onerous.

The article is wrong to say that your liability is limited to $50 if you notify the bank within 60 days - that statement is clearly false. If you fail to notify within 2 business days of a loss, you can be held liable for up to $500 of the loss. The article also says that you are liable for $500 if you report after 60 days. Again that's wrong. After 60 days, your liability is 100%.

Credit card liability is limited by the Fair Credit Billing Act. ( <a class="jive-link-external" href="http://www.ftc.gov/bcp/conline/pubs/credit/fcb.htm" target="_newWindow">http://www.ftc.gov/bcp/conline/pubs/credit/fcb.htm</a> ) Your liability on a credit card is at most $50 if you report the fraud within 60 days of the bill's cycle date. And under certain circumstances or if the dispute is handled incorrectly by the lender, you may end up owing nothing. Also, unlike many banks, lenders routinely waive the $50 liability requirement.

As for needing a PIN, most banks are pushing debit or check cards that also function as a credit card  requiring only a signature. While these cards are processed by the traditional credit card payment processing mechanisms, they do not enjoy FCBA protections. Instead, all these transactions are covered under Regulation E  which is favors the bank much more than the FCBA. So if you think youre safe just because no one else knows your PIN  think again.

As a technicality, the last Q/A is correct. Credit and debit cards run essentially the same risk of fraud and that risk is relatively low as a percentage of total transactions. However, the cost (potential repercussions) associated with having bounced checks and your account frozen while the bank investigates far out-weighs any convenience that debit cards offer.

The reason banks want you to believe that debit cards and credit cards enjoy essentially the same protections is simple: With a debit card, the bank gets to make money on every transaction and your checking account is held hostage bearing most of the risk of fraud. With a credit card, the bank is risking its own money. So while debit cards may typically turn less profit per person for a bank, they do so at a significantly reduced risk  for the bank, not you.

- Joel
Posted by joelcorley (15 comments )
Reply Link Flag
Debit vs. Credit Cards
Good work, Joel!
Also, on a contested Credit Card charge, you get credit right away (although it will reappear if not "solved"). Debit card fraud is "real money" you may not have for a while.
Additional charges apply to debit card usage as well (like ARCO in California charges an additional 45 cents, liquor stores may go up to 1 dollar). By law, there can't be surcharges for Credit Card usage.
Posted by Radu_LA (1 comment )
Link Flag
Lies inside of mysteries inside of misdirection, sounds normal to me.
Lies inside of mysteries inside of misdirection, sounds normal to me.

There should be a plain speaking law that says what it means and means what it says. Pundits say the laws less protect assets on savings using debit cards and protects more fully credit that isn't anywhere. Shouldn't the assets on deposit as our earnings and income at least get the same protection as credit which is a debt that the governments always reorganize but which we small people cannot do and must suffer. Jeepers creepers. That's what I think. Ciao now.
Posted by Iohagh (54 comments )
Reply Link Flag

Join the conversation

Add your comment

The posting of advertisements, profanity, or personal attacks is prohibited. Click here to review our Terms of Use.

What's Hot



RSS Feeds

Add headlines from CNET News to your homepage or feedreader.