Dealing with Internet Credit Card Fraud?

Where's My CreditCard asks: "Recently There has been a large increase in the amount of press relating to identity theft and the related crimes. I have recently been subject to several fraudulent transactions on my credit card and debit card through the internet. It has been over a month and my bank is still stringing me along saying it will take up to 10 weeks to get my money back. What have other on Slashdot done in this type of situation. What is the best way to keep things moving forward?"

Comments

Why use debit on the internet?

[Asgard]

My answer has been to never use my debit card on the internet. Why give out something that provides instant access to your bank account, when a credit card should always be sufficient? Credit cards put the primary risk on the credit issuer, not on your bank account.

Re:Why use debit on the internet?

[1967mustangman]

Amen to that. Debit cards are so much more dangerous then a credit card. ON a credit card at least you can cancel the card and dispute the charges. The only thing I ever use my debit card is for getting cash from an ATM machine (and shopping at the one major grocery store I know of that does take credit).

Re:Why use debit on the internet?

[porcupine8]

Well, unless you're like me and your debit card is Visa while your credit cards are Discover and Amex. Which means that not everywhere takes your credit cards. Most places, but not all.

(Yes, I do plan on getting a visa or MC credit card as soon as I can, but b/c of medical bills my credit isn't good enough to qualify for a card without an annual fee etc right now. Trust me, I know this is not an ideal situation - I've had to borrow my boyfriend's visa to pay a vet bill b/c I didn't have the money in my bank account at that moment.)

Re:Why use debit on the internet?

[Old Uncle Bill]

Who do you bank with? My bank provides instant rollbacks on unauthorized transactions on my debit card, just as the credit card companies. I get all the benefits, they take all the risk. And yes, I have had to test this. Some clown in Texas used my debit card to charge $400 in DSL fees. Called the bank and had the money back in my account in 15 minutes.

Re:Why use debit on the internet?

[TykeClone]

Reg E limits the liabilty that you have when using your debit card - as long as you keep an eye on your statements and report fraudulent transactions to your bank right away!

Re:Why use debit on the internet?

[1967mustangman]

Ahh but that would require extra work :-) No seriously though you have to watch any statement. Credit or debit. If you don't you are just asking for trouble.

Re:Why use debit on the internet?

[ebrandsberg]

Uh... Maybe because not everybody HAS credit cards. If you have ever had issues with credit as a result of say... a tech stock downturn, or divorce, you would realize that credit cards are not given to everybody instantly. Many of use are forced to use debit cards. Just like many people will want to use CASH (you know that old paper stuff) for their transactions, don't assume everybody uses credit cards or even checks.

Re:Why use debit on the internet?

[Tricot]

Reg E limits the liabilty that you have when using your debit card

Ahh.. but the fundamental difference between a debit and a credit card is that on a debit while the fraudulent charge is being contested, the money isn't in your account. He said the bank told him it will be up to 10 weeks before he gets his money back. I've heard of horror stories where it takes over 6 months and (cumelatively) 20 or 30 hours on hold before the money is put back in your account. I remember protesting strongly that I didn't want that Visa/MC symbol on my ATM card for that very reason, but pretty much no bank offers an ATM card without it any more. (It's too big a profit center.)

Re:Why use debit on the internet?

[snorklewacker]

Far as I know, Reg E only applies to "recurring charges". The phrase is googlable, but I can't trace it back to the text. Do you know where I can find the text of Reg E online?

Re:Why use debit on the internet?

[MarkGriz]

"Uh... Maybe because not everybody HAS credit cards."

While that is certainly true for some, I know several people that have credit cards, yet actually prefer to use a debit card.
I can't for the life of me understand why, particularly because with a credit card
1) I keep my money for an extra 25 days or so
2) I actually EARN money using it
3) I don't have to keep track of my usage to make sure I have enough money in the bank
4) I don't have to worry about any problems giving people direct access to my bank account

It's true that many banks have gotten better about providing protection of your account when fraud occurs, but I'd rather not worry about it. Besides, #1 and #2 are certainly enough incentive to use credit over debit if you have the choice.

Re:Why use debit on the internet?

[TheWanderingHermit]

There is a fundamental misunderstanding here.

Just because the fraudulent transactions were done over the internet doesn't mean the card numbers were stolen from an internet transaction. Many of the stories of credit card number theft are about institutions that did not secure their computers and had been broken into by someone on the internet. For example, locally, we had a warning about DSW (Discount Shoe Warehouse). Their computer was broken into and many card numbers were taken, but those numbers were ones used by people who shopped in person, not who charged over the internet. I don't know the details, and don't see why they'd need to keep the numbers once the transaction was charged, so it may be someone was able to monitor transactions and steal card numbers as they were sent through, but the stolen numbers were not used by the original card holders over the internet.

I'm no expert, but I've been told that if you use a card through a secure connection, the odds of it being intercepted are less than it being intercepted over an open phone line.

Re:Why use debit on the internet?

[MikeVx]

I remember protesting strongly that I didn't want that Visa/MC symbol on my ATM card for that very reason, but pretty much no bank offers an ATM card without it any more. (It's too big a profit center.)

I have had no problems getting an ATM-only card on those occasions when I needed one. I opened a new account about 6 months ago for buffering in property taxes (my mortage is just about up) and I was duly issued an ATM-only card when I asked for one.

I have a seperate account for the debit card, that is pretty much just for the card. I write the occasional small check on it, but nothing important. That way if the card is scammed, it won't cause bouncing checks on important bills.

Just make the point before signing up that you want an ATM-only card for an account, and make them give you that form first to verify. It can be done.

Re:Why use debit on the internet?

[TheWanderingHermit]

I had an incident about six months ago. I bank through the state credit union. I got a call on my cell from their security company. Since I wanted to make sure it wasn't some kind of phishing scheme, I asked for their number and who they were. I also was not about to discuss credit info over a cell phone. It was late, so the next morning I called my credit union, asked about it, found out it was legit, and called the security company back. THEY had detected the fradulent charges, they warned me, and they told me what to do (go to the credit union and sign papers). The money was back in my account the next day or so.

If it's taken that long to get your bank to do anything, you're with the wrong bank. Let them know. I'd also talk to the state regulators, since they may be interested in the bank's lack of action (and it might scare the bank).

Re:Why use debit on the internet?

[Anonymous Coward]

Forgive me because I'm stupid, young, and have only had a debit card, but how do you earn money with a credit card?

Re:Why use debit on the internet?

[greechneb]

http://www.fdic.gov/regulations/laws/rules/6500-31 00.html

Enjoy the reading...

Re:Why use debit on the internet?

[E_elven]

Er, no. Regulation E pertains to Electronic transactions.

http://www.bankersonline.com/regs/205/205.html

Re:Why use debit on the internet?

[TheWanderingHermit]

I replied once and it never showed up.

Why is this rated insightful when the statement is ignorant?

Just because some fraudulent transactions were made over the Internet, this poster and the person writing the original question assume (and you know the word play you can do with that word) the card info was stolen over the internet. That is not necissarily so, and likely not true -- or rather it is likely not true the card info was stolen as the result of it being used over the internet. (I can't believe that on Slashdot, of all places, this assumption has gone unchallenged.)

For example, a few weeks ago there was a news story about DSW (Discoount Shoe Warehouse). A number of credit card numbers were stolen from their system. The cards were not used over the internet (just try finding a website for them that you can order from!), but by people in line at checkout registers. I don't know if the numbers were stored while waiting to go through, or obtained as they were sent through, but it was made quite clear all the numbers were from in person transactions.

I had a problem with my number being stolen about six months ago. I found out that almost all such theft takes place when someone breaks into a merchant's computer system and takes a list of numbers, names, and expiration dates. It has nothing to do with whether you used the card in person, over the phone, through a fax order, or on the internet. The only thing that makes a difference is if your card number is in the computer someone breaks into.

So whether you use your card over the internet or not hardly matters at all. It's whether you've used it at a merchant or service that gets broken into. I'm really surprised that important fact was missed in the original question and in the parent post.

BTW, I deal with a credit union, they told me what to do, and the money was replaced almost as fast as the fraudulent charges came through.

I'm not an expert, but I hear the chances of a cc number being stolen over an open phone line are greater than it being stolen over a secure transaction on the internet. If anyone has more info on that, I'd be interested in hearing it.

Re:Why use debit on the internet?

[duffbeer703]

Unless you have really crappy credit, you can get credit cards that give you 2-5% of every purchase back in the form of points, rewards or frequent flyer points.

If you aren't smart or disiplined enough to avoid buying everything in sight on credit, don't bother.

I bought a notebook computer & lawn tractor from Amazon.com and got about $125 in Amazon Gift Cards because I used the Amazon credit card. When I travel, I tend to frequent Hilton or Hampton Inn hotels and use their american express card, or use an AMEX blue card to get membership points for various places.

There's alot of good reasons to use credit cards:

- Use the bank's money for a month
- Affinity programs (like I described above)
- The ability to get chargebacks from the credit card if the merchant provides you with poor service
- Extra warranties at no cost on anything you buy
- Free car rental insurance

Debit cards are a crappy deal... if there is a billing error or fraudulent activity, the onus in on you to keep track of your checking account. If someone charges hundreds of dollars on your debit card and your rent check bounces, fraud protection isn't going to pay for the fees and the hassle.

Re:Why use debit on the internet?

[It doesn't come easy]

Ah, but I have NO credit cards and likely will never have one. No credit card debt means I don't work for money grubbing credit card companies (a serious problem for many Americans).

Re:Why use debit on the internet?

[Tricot]

Just make the point before signing up that you want an ATM-only card for an account

I bank with Wells Fargo. I've had my account long enough (10 years) that debit cards didn't exist when I signed up. One day when I got my replacement ATM card, it had a M/C symbol on it. I called to complain, and after arguing with the customer service rep for about 20 minutes, I was given the definite impression that getting an ATM card without debit card link wasn't possible. I was tempted to close my account and move on, but I didn't want the hassle of changing all my automatic deposits and payments.

My parents bank at US Bank, and they also called to complain and request an ATM only card, and were also told that they had to take it or close their account. This was about 8 years ago, and they didn't close theirs either for similar reasons. About the only places that I've heard of that offer ATM only cards any more are small credit unions.

-- Mitch

Re:Why use debit on the internet?

[duffbeer703]

"I'm not an expert, but I hear the chances of a cc number being stolen over an open phone line are greater than it being stolen over a secure transaction on the internet. If anyone has more info on that, I'd be interested in hearing it."

That's true -- if you are talking about someone trying to intercept your communications by tapping into a network.

The real dangers in internet commerce are in the backend systems. Online merchants may be using insecure means to store cc information (like text files and easy to exploit databases) or may keep transaction logs on easily accessible web or ftp servers!

Also consider that smaller online merchants don't always own or physically control their equipment. Workers or intruders at a hosting company can easily access all of the vendors records!

Re:Why use debit on the internet?

[TheWanderingHermit]

The real dangers in internet commerce are in the backend systems. Online merchants may be using insecure means to store cc information (like text files and easy to exploit databases) or may keep transaction logs on easily accessible web or ftp servers!

But since many merchants are being broken into and having cc numbers stolen from their systems that handle point of sale transactions, it seems that the risk of having an internet backend or a POS backend broken into are both bad. Of course, storing logs on open ftp servers is just plain stupid. I think if a firm is that careless, people should be able to sue them if their number is stolen because of such idiocy.

Re:Why use debit on the internet?

[bornholtz]

3) I don't have to keep track of my usage to make sure I have enough money in the bank

Ya, and neither does my wife! *That's* why I force both of us to use debit cards.

Re:Why use debit on the internet?

[MarkGriz]

"Unless you have really crappy credit, you can get credit cards that give you 2-5% of every purchase back in the form of points, rewards or frequent flyer points."

Rewards programs are nice, but for those who prefer cold hard cash (myself included), get a Discover card (up to 1% back). They send you a nice check at the end of the year. I'm sure there are other cards offering it too now, but Discover was the pioneer. You can even split the money up into part cash, part rewards if you want.

Re:Why use debit on the internet?

[duffbeer703]

Yeah, but you need to spend like $7,000 to get 1%... Most good reward cards give you at least 3%.

Re:Why use debit on the internet?

[cdrudge]

It also can be a bank policy. A year or two ago, my locally owned credit union happily "loaned" me the disputed amount while it was investigated. It was only about $40 or so (double charged at a Wal-Mart I beleive) but they had no problem crediting my account. It did end up being in error, so I kept the money. If it had not been in error, they would have debited the money back out.

Re:Why use debit on the internet?

[Skalizar]

I have an Amex that gives actual cash back on every purchase (2% at the end of the year). I don't have great credit, but lots of history, good and bad. It's a credit card, but we pay it off religously every month to avoid any interest charges. I use it for everything I can possibly charge on it (that I need, or would have purchased anyway). At the end of the year we get a nice little check for several hundred dollars. Also no fees. I don't recall what the interest rate is, it's not very good, but we never use it for that. Also, you must pay the minimum payment every month, on time, or the rebate is forfeit. But of course, if you use it a lot and carry a balance, you'd end up losing money anyway.

Re:Why use debit on the internet?

[bluGill]

The credit card companies work for me. I pay off my credit card every month, and they pay me 1% for using their card. I also pay my bill after the first of the month, which means the money has earned a little interest sitting in my savings account in the mean time.

If you are like the millions who use the credit card for credit, you are stupid. (there are some exceptions, but they are rare) If you use the credit card as I do, - I have the cash for the purchase in the bank, and pay it off when the next bill comes - then it the credit card companies work for you.

There are cards that give a better deal than 1%, but they have restrictions on the deal so I don't personally use them. The restrictions might work out better for you though, depending on your needs.

Re:Why use debit on the internet?

[eht]

I can not get a credit card at all, I don't have bad credit, I just have no credit, so I'm forced to use a credit card, which doesn't help my credit rating at all to enable me to get a credit card.

All those prequalified ones? they're either not Visa or Mastercard credit cards (some kind of club where the only thing you can buy is their overpriced junk) or I wasn't really prequalified.

And everytime I apply for a credit card (gas, Sears, Visa, anything that isn't one of those scammy club ones) I get denied which goes right on my credit report, which I do review regularly, but there is nothing "bad" on there except multiple denieds, no late payments, no defaults, no bankruptcies, I'm in a grey area and pretty much screwed, I even got turned by one credit card where I had to put a deposit down.

And my one experience with a credit union I even got turned down for a debit card.

So debit card is the only way I can pay for things on the internet or in case I forget to hit an in bank ATM.

Re:Why use debit on the internet?

[TykeClone]

The loan was called a "provisional credit" and is called for if the bank (or credit union in your case) can't determine the validity of the claim in a short period of time.

This is also called for in Reg E.

Re:Why use debit on the internet?

[Anonymous Coward]

Then stop fucking buying things online until you can afford to pay for it with a method that is secure! Despite what marketing assholes say, credit is a privilege, not a right. If you don't have a credit card, then you shouldn't be using a debit card to buy things that typically require a credit card. Get over it and get offline until you get a credit card. And then, pay it off monthly instead of accumulating debt! It's not that difficult if you make it a priority...

Re:Why use debit on the internet?

[budgenator]

There is something seriously wrong if your credit report shows nothing, but your getting turned down everytime. Weird stuff can get into your report, there is a lady with the same name as my wife, ssn one digit different, license number one digit different who like to get tax liens on her property, bounce checks ect., how do I know about this? It's because it ended up in our credit report, the state had a lien on our property instead of her's, and along the way we've probably paid a couple of her hospital bills too.

Re:Why use debit on the internet?

[budgenator]

I've heard of porn sites just sending numbers at random hoping for a hit; which given the high amount of charge-backs, and false numbers they are send by lusers, it's not that far-fetched.

Re:Why use debit on the internet?

[budgenator]

The transaction houses don't help, I spent a couple hundred hours programming, programming around missing functions (everybody has a different idea of which functions are a security hazard) in the host's php for a website, only to get everything working so I did not have to store anything related to the CC info on my server, then the transaction house turns off the API i was using.

Next time around everything goes into a database with a good password, and if it gets cracked I play stupid; doing things wrong is on a par with state-of-the-art anyways.

Re:Why use debit on the internet?

[david duncan scott]

You still may be overthinking the problem.

Watch yourself the next time you eat at a sit-down restaurant. End of the meal, smiling waitress brings you the check and what do you do? Hand her the card, that's what, and wait for her to come back.

Skills for her to steal your number (including the magic little number on the back)? Nothing more technical than pencil and paper.

Not that I'm suggesting that waitresses, per se, are the major source of stolen CC numbers, just that I'd wager that more numbers are stolen and used through such simple means than more elaborate Internet schemes. Sure, I know that "millions of card numbers stolen by teenager in Yonkers" is the scary headline, but how many of those numbers are ever actually used? I suspect that, as technical people, we'd like to think that we're the danger, but I'd bet that ignorant thugs stealing wallets put all the actual high-tech crime to shame.

Re:Why use debit on the internet?

[TheWanderingHermit]

Good point -- about how theft can occur at that point. Thee are other times like that where the same thing can happen.

1) Someone doing that has to use the card in a physical location or have purchases sent somewhere. They still need the skills to figure out how to dodge discovery there.

2) One breakin will result in tens of thousands of numbers stolen. Compare that to one at a time being stolen at a restaraunt. People doing breakins often have wasy of automatically rotating through cards and using as much as possible on each card, so I'd still put my money on a breakin vs. a waitron.

I'm not saying you that waitrons are all safe. I know there are some involved in what you're talking about (and also in padding bills), but I cant' see counting them as the primary threat.

Re:Why use debit on the internet?

[david duncan scott]

As for point 1, having spoken to a cop about this after I was a victim, it's not terribly hard. Vacant apartment, big screwdriver. You know, thug skills -- the brazen effrontery to stand there and sign for it with a fake name. Part of the reason the thief was able to use my card this way is that BlueLight.com didn't concern itself with address verification (even after I called the dumb bastards within two hours of the transaction) -- they just blithely shipped it off.

Yeah, I know that Bad Guys can max out cards in rotation, and I don't doubt that it goes on. I'm just betting that actual losses, as distinct from "I bagged 10,000 credit card numbers last night", are more from low-skill, ballsy punks who have the nerve (and stupidity) to do shit we'd never seriously consider. We're geeks -- we'd busy ourselvers drawing up "Mission Impossible"-style schemes with 900 steps involving precise timing and filing our fingertips and whatnot, while old-school professional criminals have boosted 16 liquor stores with pistols and baseball bats and are already smoking the proceeds. Sure, they get caught, which is why we don't do it (well, that and morals), but before they get caught they commit huge amounts of crime, and after they get caught their friends and relations are still committing huge amounts of crime.

I just think we grossly underestimate the cumulative effect of stupid, violent people. It hurts us to think that they're scarier than we are even after high school.

Re:Why use debit on the internet?

[jeffkjo1]

Uh... Maybe because not everybody HAS credit cards.

However, it's not too difficult to get a credit card, even if you've been in bad financial situations. If you cannot get a card through typical means (applying via mail order stuff and on cc websites), there are other avenues.
First, you can try and apply for those in-store Visa cards. Target has a Visa card (it's valid everywhere, not just Target).
A second possibility is secured credit cards. To get one of these, you basically send 500 or so dollars to the CC company, and they give you a card with a 500 dollar declining balance. In practice, it's like a debit card, only it functions as a credit card. It's very much like those credit cards with declining balances being marketed to parents as gifts for their children.

Dump your Bank

[crstophr]

I use a technology credit union.

http://www.1sttech.com/

If I have a problem I call them and fax in a chargeback form. The money is returned the next day. I've only had to do it twice but it was very easy.

--Chris

Don't use a debt card on the net...

[(H)elix1]

Your debt card should never be used for anything other than cash withdrawal at the ATM. I pay my credit cards off each month, so I treat it as a convenient version of my checkbook. As a credit card, I am protected from fraudulent use - a maximum $50 liability without any special 'identity protection' program. Your debt card has none of this... In practice, my wife had her credit card number nicked. She audits our account each statement and caught it right away. (One of the advantages of on-line statements, btw) The credit card company canceled the card, issued a new one, and reversed all the charges. The longer delay between the time you figure out the theft and report it, the more you will pay out of your own pocket.

Re:Don't use a debt card on the net...

[TykeClone]

Check out your bank's Reg E disclosure - if you catch fraudulent activity in a timely manner, your liability is also limited to $50 for the debit card.

Re:Don't use a debt card on the net...

[cmiller173]

and in either case most banks will waive the $50 if your a good customer.

Re:Don't use a debt card on the net...

[Anonymous Coward]

you are, not your

when it's sorted

[martin]

change cards to someone.

Vote with you feet. If they don't provice a decent service move.

Also you say what country you're from so we can't give any legal advice.

Virtual Credit Card Numbers

[bofh31337]

Several Credit Card companies, including CitiCard, will allow you to generate a one time use only virtual credit card number. CitiCard's is especially nice, because you can set a limit to how much can be charged to that number.

In the case of unauthorized use of your card, you should report the fraud to one of the major credit bureaus:

TransUnion: 800-888-4213
Equifax: 800-525-6285
Experian: 800-397-3742

While you're at it check out http://www.ftc.gov/ for more information about your rights in resolving credit card problems.

Re:Virtual Credit Card Numbers

[maxume]

This seems nice from a fraud prevention point of view, but as a cc user, I would hate it if I had to do this to use my card. If the credit card issuer wants you(me) to use thier product, they damn well better make it secure, easy to use and limit my liability for others actions. The user shouldn't have to jump around like a trained monkey just to make a purchase, remember they are trying to loan you money, that is the point of the thing. Of course, you are safer, you feel safer, and thus you are going to use your card more. I'm personally not interested in going through such shenanigans to save $4 on a book. I guess I should go to the library more...

Re:Virtual Credit Card Numbers

[bofh31337]

Sure, it's not something I do all of the time. When I do, it only takes about 30 seconds to generate one. Mostly I use it on sites that I've not delt with before or have a not so positive history. Of course, i'll try to go somewhere else first; but that is not always possible.

Sure, they do need to make their products more secure and limit our liability, but until that happens I find this a good work around.

Is there some sort of Ombudsman you can use?

[the_xaqster]

In the uk, you can threaten them with going to the ombudsman if you think that things are taking too long. http://www.adviceguide.org.uk/n6m/index/your_right s/civil_rights/how_to_use_an_ombudsman/index/your_ rights/civil_rights/how_to_use_an_ombudsman.htm Shows you how they are used in the UK. Looks like an ombudsman is a lawyer, so if you cannot find one, maybe a Lawyer will do.

My Own Experience

[the darn]

I have a MasterCard type debit card. Late last year, someone got ahold of it's info (including the 3-digit code form the back). I suspect that it may have been related to an insecure form I submitted for an online purchase. I noticed 2 charges that I didn't recall making on my (online) statement; they totaled a bit over $200. After contacting my bank, they suggested I first try to contact the businesses that charged the card, then come back to them if I had any difficulty. They assured me my maximum liability was $50, and issued me a new card with a new number. So, armed with a pair of phone numbers, I called the two businesses: one was a phone-card seller, and the other issued prepaid debit cards. In two weeks, all my funds had been returned. A few weeks later, my bank's investigations unit contacted me to ask if I knew anyone in Lansing, MI, where the charges had originated. I answered "no," as I'm not sure I've ever known a Michigander (or whatever). And that was the last I've heard of it. Scary, but not as awful as it might have been.

Re:My Own Experience

[coolcold]

the address they found could possibly be fake anyway. Some people buy some random stuff to random address to test if the owner discover of the fraud. In my case, I have own a credit card for 3 years in total. I have used it to apply for paypal in the first year and purchase NOTHING, nor did I ever use the card at all. In my third year of owning the card, someone actually being able to use it to buy a CD. This card have always been in my wallet without being used but I don't see how people can get my numbers either.

This might possibly be what had happened in you case too but of course insecure transition is more probable.

Banks SUCK

[mekkab]

I had this happen to me. My debit card is also a some-time credit card. I used it for a web purchase in 2000. I found out that charges (for "male enhancement pills", no less!) had been made to my card.

My bank was USELESS. The same 10 weeks, no protection, we don't really care, and are actually rather annoyed that we have to find these forms for you to fill out.

The online company got wind of it (I presume through the bank), CALLED me, said "hey, where you ever in Khazakstan? No? Okay, this is obviously fraud. We'll credit you back right now."

Weeks later I received a letter from my bank saying "we are dismissing your claim because the money has been returned." Yeah, thanks for nothing!

Contrast that with my credit card*:
A week after I rented a Budget rental truck (in MD) I notice a $5 charge from Budget in Colorado. Total red flag. I call the credit card company and they said "we'll take care of it." They did.

*-note, this could have been dumpster diving or internal Budget fraud; not necessarily online fraud. However I did book the truck online which is why I assume its internet fraud.

My story

[It doesn't come easy]

This happened to me about 4 years ago...

I had a bogus $400 charge show up on my checking account debit card. I saw the charge almost immediately (about two days after it happened) because I routinely monitor my checking account from online daily. I contacted the bank and the police. The police told me that they couldn't take the report unless the bank initiated it. The bank said they would start an investigation, which they did. In the meantime, they put $400 back in my account.

My statement to the bank was as follows:
My debit card has never been missing
My debit card has never been used by anyone other than myself
No one else knows my pin number (not even my wife)
I had never used the ATM where the charge was recorded (the bank sent me a statement from some third party bank showing the address of the ATM and the transactions that had been attempted. There were 8 tries late at night for different amounts, starting at $1100 and going down until the $400 transaction worked).

About 4 months later (after bugging them about once a week to find out what was going on), the bank came back and said the transaction was valid because a debit card had been used to make the transaction and so they were taking their $400 back. This is actually what they said, even after I had told them that I had not used my card for the transaction and the pattern of transactions obviously showed that someone was fishing for an amount that would be accepted.

As far as the bank was concerned, case closed. Fortunately for me, I had the foresight to marry a lawyer. Being a personal injury attorney, my wife was somewhat familiar with the rules the bank had to follow in a situation like this and luckily for us one of their duties was to perform a timely investigation, which had been defined in our area of the world as within 45 days. So, only because they took so long we were able to make them hand us back the $400.

However, in the course of our investigation, we learned a number of things I found quite fascinating. First, we found out many (if not most) ATM cameras are no longer maintained. So, a lot of the time there is no visual record of who is using the ATM machine. Second, the bank didn't consider the pattern of tries to be significant, as they felt it was only an attempt by me to fool them into thinking it was someone else(and obviously ignoring the fact that by the same logic if I was trying to defraud them, I would have also said my card had been stolen or lost). Third, the only place I had EVER used my pin prior to this transaction was at the local grocery store. I mean EVER. I am very careful about where I use my pin and up to that point I had only ever used it at the local grocery store (I had never even used it at the bank's ATMs). This probably means someone at the store saw me enter the pin (probably using the store's surveillance cameras) and had enough access to my bank's debit card information to create a new card using my account number and pin. This last part is speculation but I don't know of any other way they could have used a real debit card to make the withdrawal. Unless, of course the bank was lying to us and their computers had been hacked (but in that case, why the multiple tries?). In any case, we concluded something out of our control was wrong at the grocery store and/or the bank, so we stopped using the store and changed banks.

Since then, we keep two checking accounts at our current bank: One for the money and one for the debit card. We keep a minimum balance for day-to-day purchases (gas, food, etc.) in the debit card account and we plan big purchases and ALL online purchases in advance by transferring the money from the money account to cover the purchase right before we make it. At least that way the debit card has a lowered risk because the balance is always very low and the other account is only accessed through the bank's computer. Yes, I know it isn't perfect, but it is better than having all of our cash exposed.

Re:My story

[duffbeer703]

Why would you go through all of that hassle when you can just use a credit card? Then the bank's money is exposed!

Re:My story

[It doesn't come easy]

By your logic (avoid the hassle by using a credit card), the only way to avoid the hassle in this case is to never have a debit card to begin with. Remember, I didn't use the card, someone else did (and it wasn't even my card, assuming a physical card was even involved).

Re:My story

[duffbeer703]

"Remember, I didn't use the card, someone else did (and it wasn't even my card, assuming a physical card was even involved)."

Sure you did. Unless the thief somehow conjured up your card number & pin, they obtained your information from some sort of rigged device somewhere.

I use my ATM card at banks only -- I don't use random ATMs in malls and such. Many banks consider pin-based transactions inviolate, so I treat my ATM card with care!

Re:My story

[It doesn't come easy]

Actually, I understand what you mean and agree. I no longer use my pin at any institution other than a bank, and even then sparingly. That was another lesson I learned from all of this.

Re:My story

[It doesn't come easy]

And besides, although not directly related to this incident, I don't actually have a credit card :)...and probably never will...

Re:My story

[Anonymous Coward]

After reading this story and the other comments here I think one thing most people forget about is if your CC or debit card has been used fraudulantly, CALL THE POLICE. That may not go over well with the tinfoil hat crowd, but I had a similar story as the parent poster. The bank said we made the charges end of story. I was extremely skeptical, but called the police out of desperation. Man was I suprised our local sheriff's office was able to trace everything and even finger a suspect in ROMANIA. We sent the police report to the bank and what do you know, very sorry sir here is your money back.

The most frustrating part about the whole ordeal was during the approximatly 6 weeks it took to get the money back I kept seeing the damn commercials about 100% fraud protection if you use your Visa/MC you won't be liable for any of it. Each time I saw the ads I wanted to break the TV.

By the way the card number had been stolen using non internet methods. A waiter had jotted down the info from the card, created a free email address using my wife's name then looked up our address using internet phone directory. They used a site called epassporte that claims to be a rival to paypal. They offer internet only credit cards. The perpetrator set-up an account under my wife's name with our address but their email address. All epassporte did was verify that the address given was the same as the billing address on the card. They verified the account and the thief immediately transfered the money from our account (it was a debit card) onto there online "only" visa card. Neat feature of there online "only" cards you can get an actual card and use it to withdraw your money at any atm. Well their accomplice withdrew the money in Romania.

paypal is my way

[infonography]

I have had a paypal account for a long time, I know almost instantly what's happening on it just by hitting the website. They do have credit and debit cards as well. If I don't like a charge I am on the phone to them and they deal with it. Also a lot of online sellers are taking paypal directly.

- Disclaimer, I don't work for Paypal.

Re:paypal is my way

[It doesn't come easy]

Paypal is way too dangerous to trust with your debit card (and almost too bad to trust with a credit card), which you will find out if you ever have a problem with a bogus transaction. The reason? Paypal is NOT a bank and consequently has much fewer regulations and controls. If Paypal wants to, they can declare any transaction valid and YOU would have to sue them to prove otherwise.

Re:paypal is my way

[Anonymous Coward]

Paypal is far too dangerous to trust, period. Unfortunately, everybody expects you to accept Paypal to do online business (at least on that auction site). So, I accept it. I also wait until the funds are actually in my bank account (and transferred over to my non-Paypal-entangled bank account before sending the package. Screw me once, shame on you. Screw me twice, er, shame on you!

Re:paypal is my way

[TykeClone]

If it walks like a bank, talks like a bank, and acts like a bank - it should be regulated like a bank.

Re:paypal is my way

[infonography]

I hear these complaints trotted out every now and again. But in the 6 years I've been using it it's worked as promised. It's tied to my savings and web transactions are pulled directly. If I don't have enough in the account it will not do regular card transactions. If I do a web transaction to another paypal users it will pull the needed funds out of my account. Plus your complaint that paypal is not a bank is old data. Please consult their website and stop rehashing old rumors. http://www.paypal.com/cgi-bin/webscr?cmd=p/gen/fdi c-outside

Re:paypal is my way

[nacturation]

Plus your complaint that paypal is not a bank is old data. Please consult their website and stop rehashing old rumors. http://www.paypal.com/cgi-bin/webscr?cmd=p/gen/fdi c-outside

Now which part of that page says that PayPal *is* a bank? All I see is things like "PayPal is an agent for an unaffiliated bank ... money market funds are not FDIC insured ... balances held in other currencies are not FDIC insured ... FDIC pass-through insurance does not protect you against PayPal's insolvency ..."

So if, for whatever reason, PayPal itself goes under, you're SOL.

Report them

[E_elven]

Your financial institution is required by law (in the U.S.) to either resolve any EFT (debit or credit) dispute within 10 business days or, if it has not been able to resolve the dispute, provisionally credit your account with the amount in question until it is able to do so.

IAAB.

Debit cards are insane

[HalWasRight]

I'd never get a debit card! A Visa hose for a clerk at a store to steal? Jeez, you asked for it.

Re:Debit cards are insane

[Skater]

First, a clerk would be better off stealing a credit card - higher limits.

Second, as others have pointed out, you aren't liable for more than $50 anyway, although there's more hassle with debit since it's your checking account.

Third, what clerk actually takes your card these days? I can't remember the last store I was in that didn't have the scanners that I used, so the card never even leaves my hand. (Exception: restaurants. But even there #1 and #2 still apply.)

Get real!

[fm6]

It has been over a month and my bank is still stringing me along saying it will take up to 10 weeks to get my money back.

Like so many Ask Slashdots, this one revolves around somebody's misperception that the world revolves around them. Ten weeks is not "stringing along". It's a reasonable period to investigate a serious fraud. You don't mention how much money is at stake, but I assume it's a substantial amount, or you wouldn't be so pissed off. In effect, they're handing that money over to you, money they're probably never recover. Do you really expect anybody to do that without checking everything out carefully?

Put yourself in their shoes. Suppose somebody called you up and said, "You owe me $1000 because ..." Never mind the "because", it's a reason that might or might not be valid. Are you immediately going to write them a check? No, you're going to carefully examine their claim, check the facts, maybe talk to a lawyer. Why should your bank be any less careful? Because they have lots of money? They soon won't have any money at all if they give it away to anybody who claims they deserve it.

Re:Get real!

[alyandon]

In his defense, some banks will issue an "emergency" credit almost immediately for the amount in dispute and later take it back if needed.

My advice - Only use your credit cards online. Fraud on your checking account via debit card is usually far more painful than fraud on a credit card.

Re:Get real!

[Skater]

What's a lot of money to you and me isn't a lot to a bank. I might find $500 to be a tough loss, but to a bank it's probably the bright spot in their day. They probably have cases where thousands are missing, and those will probably get a higher priority.

Re:Get real!

[fm6]

Not everybody has a credit card. If you're in credit counselling, the first thing they do is make you give up all your cards, so you can only spend ready cash.

You can now plunk down some cash and buy a debit card that's only good for the amount you put into it. That might be a good alternative. Expensive though.

But all these strategies require common sense and caution. I suspect this guy has neither, since he's dealing with several alleged frauds on more than one card.

10 weeks?!

[nilbog]

10 weeks?! Who is your bank, paypal? Because if so, paypal is not a bank, and will not act like one - especially when it comes to your rights pertaining to fraudelent transactions.

I believe for real banks there is a federally imposed time limit for adressing fraudelent use of your account, and it certainly isn't 10 weeks.

I had my credit card attached to my paypal account, and someone broke into my paypal account and emptied it (thereby cleaning out my credit card and bank account). I called paypal who wanted me to fill out tons of forms, get them notorized, snail mail them in, and wait 90 days for a judgement. And this AFTER they admitted it was due to their lowsy security.

So I called my bank and said "paypal ripped me off." The bank had my money back in my account the same day, and they went after paypal to get paid back.

If you're bank is really going to make you wait 10 weeks, you need a new bank. You can always deal with Visa or Mastercard or whoever directly and they're pretty good about getting your money back.

Gift Certificates = Virtual Credit Cards

[mindaktiviti]

I know this is getting a little off topic but I don't have a credit card, and yet purchasing books saves you a TON of money (30-70%) if you buy online. So how do I do it? Of course I could get someone to buy it and I would pay them back - OR - I could go into a store and put money on the gift card, and then I could go home and use that gift card's # to purchase my books, and I end up saving a lot of money. So if you're so paranoid that you don't even want to use a credit card or a bank card, try to look for other ways to pay for stuff, because it's possible you can do it with gift certificates.

Need clarification

[Michael Spencer Jr.]

(I work for a major credit card processor, First National Merchant Solutions. We represent businesses on the other side of these kinds of disputes -- we process cards for merchants, and we must *answer* chargebacks like this one.)

I'm a little confused by whether this is a Visa/Mastercard issue or a debit network issue. Debit networks (Interlink, Maestro, AFFN, Shazam, Cash Station, Tyme, Star, Mac, NYCE, Pulse, Accel, Honor, etc.) require both the card and the pin number be present at the point of sale, so if these were Internet merchants then these are not debit sales.

(If someone else has more information about debit cards, please reply. We are trained to believe that these debit networks are only available card-present with pin. If that's wrong -- if people can take debit network account numbers over the Internet -- cards which are not also Visa/Mastercard/Discover/AMEX/JCB/International Diners/Novus etc. -- please let me know.)

So in the absence of more information, I would say because the transaction is over the Internet, and the original poster seemed to indicate it was also a debit card, it's probably been processed either as a Visa or a Mastercard.

If that's true, here's the flow of events:

1) Customer notices a fraudulent charge. They notify their bank, and their bank issues a chargeback with a reason code of something like M85 (Fraudulent Transaction - No Cardholder Authorization)
2) Along with the chargeback, the bank who issued the customer's card sends a debit to the merchant's processor (a company like us). So in accordance with the rules, the bank now has the customer's money back in their hands.
3) The bank provisionally credits those funds to the customer. This isn't risky (in case the customer was lying) because if regulations say the bank must pay the merchant back, the bank is responsible for collecting those funds from the customer. (So if the customer closes their account and flees to Mexico or something, the bank still has to pay.)
4) The merchant's processor (again, a company like us) usually then bills the merchant the amount of the chargeback, and notifies them that a chargeback has been filed against them. The merchant then has some time (30 days? 45 days?) to prepare their case, and submit documentation defending their charge.
5a) If the merchant doesn't respond, or the documentation they provide is obviously faulty ("But this gentleman from Nigeria sounded so honest!"), no response is sent. The time to respond to the chargeback case expires, and the bank (and customer) get to keep the money. STOP
5b) If the merchant does respond, with documentation which proves the charge really was authorized, the merchants processor (a company like us) sends the documentation back to the bank, along with a debit which takes money back from the bank and gives it back to the merchant.
6) The customer's bank now has documentation which explains both sides of the story. I don't know what really goes on here, but I assume the bank consults with the customer and tries to get more information from them. The bank is then given some time (30 days? 45 days?) to respond back.
7a) If the customer sees the documentation and says "oops, sorry, I guess I did authorize that one, never mind" then the bank just doesn't respond, and the chargeback drops. STOP
7b) If the bank talks to the customer and finds out the charge really *is* unauthorized, the bank debits money *again*, and things go back to the merchant for the last time.
8) The merchant's processor consults with the merchant, and they decide what they want to do. If the merchant wants to dispute the bank's second decision:
9a) If the charge is a Visa, that second chargeback is actually a "pre-arbitration notice", where the bank is stating that they're prepared to go to Visa for a (costly) independent arbitration. They're *sure* they're right. If the merchant (and their processor) are also *sure* they're right, and no agreement can be reached, the case goes to arbitrati

Re:Need clarification

[Victor_Os]

That was a very interesting read. Thank you so much!

Re:Need clarification

[gutterandthestars]

That was extremely informative and well explained. Thanks.

My experience...

[mOoZik]

My debit number was stolen and $600+ of vitamins and other drugs were charged to my account. I tracked down the company, though they were in another country. Before I could call my bank, they called me first, saying they suspected fradulent activity. I called them back, launched an investigation, and the funds were returned to my account almost immediately. That's how a bank should work: to protect its clients and resolve all problems immediately. This is the reason I am nervous about smaller banks and credit unions, because I'm unsure whether they could provide the same level of service.

As for using cards online, I now make sure that the website is absolutely secure and reputable. I still don't know how my number was stolen, but that's history now! :)

OK To Debit

[Anonymous Coward]

If you have a Visa/MasterCard debit card (or check card) you are protected from fraudulent charges as long as your report them within 60 days. In fact, money should be back in your account within 2 business days.

Visa/MC Debit Is Safe

[Anonymous Coward]

There are a few ways to use a debit card.

Straight debit cards don't have MC/Visa logos. They are basically ATM cards. They have 2 uses...

1) ATM - withdraw cash, use to access account for deposit, check balance, etc.
2) Point of Sale - Stores with those PIN Pads where you swipe the card yourself, you can usually use them there.

Either way, card and pin must be used. The network being used in the case of a point of sale is going to be something like NYCE, Star, Honor, MAC, Maestro, or Interlink.

With the check card, or Visa/MC branded debit card, things are different. The ATM method is still useable, but the POS option divides:

1) Debit / PIN Based - you swipe the card yourself, and enter a pin on the pad. No signature. This is through the network like like NYCE, Star, Honor, MAC, Maestro, or Interlink. Funds are withdrawn immediatly (like that second).

2) Credit / Signature Based - like a credit card, the card is swiped or keyed in (by you or the clerk), and then you sign the reciept / sign the signature box with a stylus. Now, the network here is Visa or Mastercard. The funds are "held" by the bank, and appear withdrawn, but are actually taken out a couple days later (usually).

Either way, you are paying for what you bought.

The only difference is that the Visa/MC option means you can use your card at more places (places without PIN pads, restaraunts, online, etc.) It also means you don't have to know your PIN (there are people with check cards who don't know their pin, but use them since you can just sign... kind of dumb because you won't be able to use an ATM without a PIN, but hey...)

Now, the real difference between credit and debit choice is protection.

Yes - debit is faster in some cases (no signing), and you can get cash back... but you lose protections you get with the Visa/MC transaction

1) *ZERO* Liability for fraudulent charges: This includes lost/stolen card, card number stolen, if the clerk skimmed the card, etc. You do not have to pay $50 under the current Visa/MC regulations. You pay 0.
2) Fund replacement - you get the money back within 2 business days. Some banks do it in 1 business day.

Now you may have to agree to sign something stating that you are not lying about your card stolen, and that you'll help the bank prosecute whoever stole / used the card fraudulently if they are caught. That's not a big deal (besides, wouldn't you want to help get the person who stole your card punished?)

Personally, I am confident in using my Visa Check Card, online and offline, because of the zero-liability policy.

Offline, though, I always use credit (unless it is a place like Walgreens, Supermarket, etc, where you can get cash back with debit and I actually need to do this. Using credit is just safter to do.

The problem here is that using credit, a fraudster can easily use the card.

SIGN YOUR CARD[S] - this means if it is stolen the thief can't just sign it. Writing "see id" is not acceptable (they can REFUSE your card... don't believe me, check the Visa website.)

Re:Visa/MC Debit Is Safe

[AussieVamp2]

as far as signing cards goes, was my experience they barely ever bothered to check signatures in the USA for credit cards, whereas it is pretty much done all the time in Australia, at least cursorily

has that changed?

Bank of America SUCKS

[Sooner Boomer]

First of the month, I received a BoA credit card statement. Problem is, I don't HAVE a BoA card! I immediatly called their customer service phone number. Woman on the line wanted to know all of my personal info - SSN, mother's maiden name, etc. Which I refused to give out; I've never had one of their cards, never applied - there is NO WAY they could verify this information. The woman refused to help, refused to allow me to speak to a supervisor, refused to give me contact info for their legal dept., and refused to identify herself. Immediatl upon hanging up on this useless individual, I wrote a letter to BoA and contacted my lawyer. This was over two weeks ago and I haven't heard anything yet. Tuesday, certified letter documenting all this go out to the Better Buisiness Bureaus and the State attorney generals of the related states, the credit bureaus, as well as one to BoA demanding followup.

Re:Bank of America SUCKS

[Katrina48]

I agree with you - I have had experience with this bank and they are not very user-friendly. I have continued my relationship with them but I constantly monitor my accounts online and when there are issues, I contact customer service immediately, jump through all their hoops to get the problems resolved, etc. One particular issue to watch for is if you lose a BOA credit card or it's stolen and the account has to be closed and they set up a new account, they will charge you a balance transfer fee in the process of setting up the new account. I have never run into that with any other bank.

Safe way to shop online

[Anonymous Coward]

Why not use a virtual account number from Citi? With this you do not have to give your card details when you shop online - they let you generate a virtual credit card number to make purchases online - you can also set a limit for the transaction if you want to reduce your exposure further. I think MBNA and Discover have something similar.

The other side of this...

[jafo]

My company has a merchant account, which allows us to process credit cards. The number one thing we get fraudulent orders for is Linux based Virtual Private Servers (VPS). Last week we got orders for two VPSs. The orders claimed to be from different people, but used the same root password and were from the same IP address in Russia. The orders were also both placed twice.

I decided to try tracking this down on our end to see where we could lead it. I called our merchant processor with what they call a "code 10", but the result of that call was basically just that they would tell me what bank had issued the cards and what the phone number to that bank was. Both cards were issued by Citibank.

After spend around 30 minutes on the phone with Citibank, all they would do is verify if I had the correct information for the account, and tell me that they wouldn't do anything unless the card-holder called in.

The interesting thing was that on one card the expiration date was wrong. I don't know how my merchant processor authorized the charge with the wrong expiration date. Also, the phone number on both was wrong, but it was correct in the first 6 digits, it was just the last 4 that were different. I wondered if the person making the charge was using VoIP to make it appear that they were in that area when actually they were in Russia.

We ended up reaching one of the actual people by phone that afternoon, and they confirmed that they had not made this charge, the phone number was incorrect, and they also said that they weren't using that card actively at the moment. The other person I couldn't track down by other means, so we sent them a letter.

I find it extremely odd that, as a merchant there is relatively little I can do when I get a fraudulent charge. I guess maybe I should report it to the police and see if there's anything they want to do with it. Citibank couldn't have cared less, no requests for the IP addresses the charges were made from, etc.

If I were to get screwed by a credit card company for charges I didn't make, I'd probably start looking at things like this that make it clear they don't really follow up on this fraud, which could be seen as negligence. Particularly if they had authorized a charge on a card with the wrong expiration date and/or billing phone number, I'd wonder what they're doing to earn their cut in the first place.

Sean