What Can Be Done About Security of Debit Cards?

JumpDrive writes "I have been the victim of (Visa) debit card theft. I do not know where they stole or got the number, but it was used one day on the other side of the country and the next day it was used in Europe until they cleaned out my account. I had been monitoring my account online and immediately went to the bank and filed a claim. I was told at that time it would be 3 to 5 weeks for them to investigate the claim before they could return my money. Recently I tried to make a purchase with a debit card and was told that they couldn't use the card since it wasn't a Visa or MasterCard check card; this led to a discussion of why I no longer have a Visa or MasterCard check card. Which then led to the question of 'What can be done about it?' Currently I have a separate account for debit usage for my personal safety. But I also think that those producing these check cards should be required to advertise the hazards of having one of these cards (not in small print and maybe required in advertisement of these cards, similar to what is required with pharmaceutical drugs on television) and/or that if a debit or check card is issued a separate account should be required for its use, and users informed of the issues of placing all of their money in the same account that their debit card has access to. What other precautionary measures should be required or taken?"

Comments

What can be done? Nothing.

[plover]

The short answer? The banks will do nothing for you today.

The long answer: Nobody will do anything for you tomorrow, either.

Why? Because Visa does two things, only one of which makes money. First, they are in charge of defining financial card security through the PCI council, and they own and operate the secure network VisaNet, which carries authorizations from retailers to banks. Guess which one makes them money?

If Visa were to design and offer a cryptographically secure solution, one based only on smart cards for the customers and Hardware Security Modules (HSMs) at the banks, then I could safely route my charge authorizations over the plain ol' Internet. I wouldn't need to use the charge-per-transaction VisaNet. Visa would stop making money.

So instead of offering a secure solution, Visa and the PCI council say, "Merchants must lock down their systems, protect this data, follow these 12 steps, acknowledge that you are powerless over alcohol (oh wait, wrong 12 steps), and if you don't, we'll loudly blame you for allowing someone to see our non-existent security."

Visa owns the protocols used between merchants and banks. They could strengthen the protocols. They could prescribe encryption. They could require the deployment of chipped banking cards. But they do not, and have not for many, many years, despite a pathetic track record of security.

If you want the banks to be safe with your money, you ironically have to take charge of your own security. If you switch to using the green paper stuff, your losses will be finitely limited to what you carry on your person. If you want a more achievable answer in today's plastic world, DO NOT CARRY DEBIT CARDS. Debit cards do not offer you protection against loss. Credit cards are limited by U.S. law to a maximum of $50 liability to the cardholder. Debit cards losses are usually covered by the bank, but they are under no legal obligation to do so. For ATM access, most banks will honor your request for an ATM-only card instead of accepting their default ATM/Debit card. Of course, the use of credit cards requires personal discipline to always pay the debt on time, but otherwise you would see little difference.

Re:What can be done? Nothing.

[Master Moose]

I suggest everyone reading this with a debit card transfer all of their money to my account. I do not have a debit card so it will be free from this sort of attack.

Re:What can be done? Nothing.

[stonewallred]

I hate to say this, but use cash. I have several credit cards, and I use some of them daily. But unless the interest rates are lower than what I can make by not paying them (seldom if ever) they get paid off monthly. I do not have a debit card. I have a paypal account tied to a bank account I use strictly for buying and selling on ebay(lego if you are interested). My bills I pay with check or cash, and sent via mail or delivered by hand (the HVAC/R supply houses, as it credits immediately to my accounts when paying at the store). If I want something off the internet, I get a buddy of mine to order it using his data, not mine. Plus with cash, there is never a question of bouncing a check or overdraft fees or charges. Will probably get modded down for suggesting such an anti-tech idea as using cash, but oh well. Karma is overrated anyway.

Re:What can be done? Nothing.

[godrik]

Or send your card number to me. I will enter them in the "Debit Card Protection System 2.5" myself !

Re:What can be done? Nothing.

[halowolf]

I just use a credit card with a low limit for shopping both out in the real world and on the internet and just act smart. I have never had any theft from my card by any unauthorised charges yet. I have had one retailer not supply the goods I purchased (on an authorised charge mind you) because he was a lying scum bag, but I got my money back from that and hopefully my complaints to the regulatory authorities will land him in jail, since he was an insolvent trader.

Re:What can be done? Nothing.

[RenQuanta]

Credit cards are limited by U.S. law to a maximum of $50 liability to the cardholder. Debit cards losses are usually covered by the bank, but they are under no legal obligation to do so.

(Emphasis mine).

Actually, I don't think the part about the lack of debit card consumer protections is factually accurate. Here's the blurb from The FTC's Facts for Consumers:

ATM or Debit Card Loss or Fraudulent Transfers (EFTA). Your liability under federal law for unauthorized use of your ATM or debit card depends on how quickly you report the loss. If you report an ATM or debit card missing before it's used without your permission, the EFTA says the card issuer cannot hold you responsible for any unauthorized transfers. If unauthorized use occurs before you report it, your liability under federal law depends on how quickly you report the loss.

For example, if you report the loss within two business days after you realize your card is missing, you will not be responsible for more than $50 for unauthorized use. However, if you don't report the loss within two business days after you discover the loss, you could lose up to $500 because of an unauthorized transfer. You also risk unlimited loss if you fail to report an unauthorized transfer within 60 days after your bank statement containing unauthorized use is mailed to you. That means you could lose all the money in your bank account and the unused portion of your line of credit established for overdrafts. However, for unauthorized transfers involving only your debit card number (not the loss of the card), you are liable only for transfers that occur after 60 days following the mailing of your bank statement containing the unauthorized use and before you report the loss.

If unauthorized transfers show up on your bank statement, report them to the card issuer as quickly as possible. Once you've reported the loss of your ATM or debit card, you cannot be held liable for additional unauthorized transfers that occur after that time.

Re:What can be done? Nothing.

[jr0dy]

On the flip side of that argument, someone stands to make a lot of money by entering the market and challenging Visa with the selling point of increased security. Are there barriers to entry in that market? Sure. Will Visa lobby its butt off to intensify those barriers? No doubt. But it's not impossible. Furthermore, what about the following: a cash-secured credit card. They already exist from what I've heard (no personal experience with them), but I'm not sure if they function in the fashion that I envision, which is basically a system in which the charge initially hits the credit account, but after a predetermined amount of time (enough time to allow for the monitoring of transactions, such as 3-7 days), the credit account automatically debits the user's checking account.

Re:What can be done? Nothing.

[Twinbee]

Perhaps we should let the government control our banks, or at least get them to set up non-profit companies.

Stories like that make me feel ill.

Re:What can be done? Nothing.

[plover]

Thanks, that's good to know, but I still won't carry a debit card. I'm not in the habit of checking my bank balance daily to see if someone's been stealing from me.

For these laughable "protections", I'd be far better off keeping my money under my mattress. It seems to me it should be 100% of the job of the bank to keep my money safe and secure.

Re:What can be done? Nothing.

[Kitkoan]

They could require the deployment of chipped banking cards.

And this is where most of the problem has been caused. The belief that if we put those RFID chips in our bank cards, they must become safer. The problem is, it's the chip that is the biggest security issue since its RFID it's 'always on' and more then willing to send it's information to whomever asks. The banks and credit card companies have invested millions, if not in the billions, of dollars into the technology and its a flop. A massive, expensive flop. And now they have 2 options. Fess up that it's a failed experiment and have very pissed off investors. Or, censor/intimidate anyone who wishes to publicly expose this as the failure it truly is.

Re:What can be done? Nothing.

[Anonymous Coward]

I think American banking laws need to catch up.

In Canada, Debit card fraud is treated the same as bank theft. As in when your bank gets robbed, it's not your money that's stolen. I know a few people who have been skimmed. They received all of their money back.

Re:What can be done? Nothing.

[Anonymous Coward]

Silence, socialist. All Real Americans know that profits are generated by the pure virtue of Wealth Creators, while losses are caused by lazy black people. Any attempt to make corporations responsible for their actions is class warfare.

Re:What can be done? Nothing.

[plover]

Sure, a single bank can stand up their own system. But what retailers are going to sign up and connect to them? What retailers want to take on that expense? And if I create John's Credit Network and Bruce creates Bruce's Credit Network, how would we get cooperative protocols? Finally, who is going to finance and pay to create a system that competes with Visa but doesn't actually generate revenue?

And forgetting the difficulties in creating such a system, think about another hard problem, the human element. It's well-demonstrated that ordinary consumers don't care about security. It's not a selling point. Why not? Even if they cared greatly, the $50 liability limit that the consumer protection laws mandate means that they're not at any real risk for fraud if they stick with their current bank. Where is the consumer appeal for "John's Crypto Credit Card, good at more than two retailers citywide, and your money is mathematically safe!" If I can use John's card at two retailers in town, or a Visa at over 6 million locations worldwide, and I'm only risking $50 to go with the Visa, guess which convenient card I'm going to choose?

Re:What can be done? Nothing.

[Gr8Apes]

Naah - no modding down. Everyone here should be smart enough to distrust debit cards immensely.

As for internet buys - use 1 time numbers. My main credit card has them available, although I'll admit it is a pain in the tukas to get to the screen that gives you one, and it's not exactly advertised. (read that as you have to know what you're looking for and what the specific verbage is on the menus, or you won't find it)

Re:What can be done? Nothing.

[oasisbob]

Credit cards are limited by U.S. law to a maximum of $50 liability to the cardholder. Debit cards losses are usually covered by the bank, but they are under no legal obligation to do so.

That simply isn't true. See Regulation E.

Re:What can be done? Nothing.

[RenQuanta]

In this day and age, with online banking so prevalent, checking your account every few days is only prudent. It's not unreasonable for the consumer to have some burden of identifying the loss, since each of us are the best and most efficient judge as to whether or not the transactions on our accounts are in fact ones we performed. Millions of dollars in software development and analyst training have been spent on helping banks to detect fraud, but those systems aren't fail proof.

In the end, there's no substitute for each of us keeping an eye on our own accounts' transactions.

If we don't take responsibility for our own financial affairs, should we really expect the banks to carry the whole burden on our behalf? No matter how good it is, any security measure can (and likely will, sooner or later) be defeated. (and let's not forget good old fashioned social engineering...)

In the end, the best protection against a breach is constant vigilance. (Or, said another way, prevention only goes so far, detection is still requried ;-)

Re:What can be done? Nothing.

[failedlogic]

I think this is brilliant. I try to use cash (withdrawl x amount) and spend that only. The problem is, counterfiting is likely as easy as Visa/Debit fraud. So when you start paying cash for things, you're made to feel like a bloody criminal - they look at you a few times too often, scan the bills under UV light and yadd yada. I'm usually buying stuff in well-dressed attire (not that that matters), but I'm not a homeless guy trying to pass a $100 at a till to buy smokes. This unfortunately are for both large or small purchases (I can certainly understand POV of retailer regardless of amount).

I plan on paying off my VISA soon and once that is done, I'm going to keep a small separate debit account with a different bank, get an ATM only card and use credit for everything else.

Re:What can be done? Nothing.

[dissy]

For these laughable "protections", I'd be far better off keeping my money under my mattress. It seems to me it should be 100% of the job of the bank to keep my money safe and secure.

To be fair, for those of us that just keep money at a bank, they DO keep it pretty safe and secure.
(Barring the bank going out of business in a tragic way or something of course)

The problem is, as you hinted at in your first post, that by asking for a debit card (Or by not refusing one) you are basically instructing the bank that anyone using this set of 25 digits* has the ability to take money from the account.

*(30 digits if zip is required, but I didn't think that one was enforced by the bank, just CC# CSV2 and exp date.)

As you mentioned, they fully have the ability to use a more secure process and ditch the current system, but they clearly haven't, nor will for the very reasons you gave.
So since that current method to access my money is not secure, it is not an option to me.

People blindly accepting this poor insecure option when they don't need to is also a problem. Of course the banks not even trying to fix things is also a problem. It's just that fixing only one of those two will keep your money safe and secure at the bank, and since only one option is even under your control, it's the only one we can use. (However we can bitch about both still heh)

I fully agree with your stance, and I too do not have a debit card on my main checking or savings accounts. I have one on a spare empty savings account with no overdraft coverage (if it does not have the funds to cover it, it rejects the charges. You have to specially ask for that one these days) that I can transfer money into for the rare time I need such a use.

Although instead of under a mattress, I would have to highly recommend a small fire/water proof safe that fits _under_ the bed and mattress ;}

Re:What can be done? Nothing.

[timmarhy]

I've never understoof why the hell anyone would use a debt card. i guess there is a section of the market with no self control, and hence can't own a credit card.

they could end all this by implementing one time CC numbers, but that is probably more costly then covering the fraud at this point.

Re:What can be done? Nothing.

[socsoc]

We should control the banks in the US, since we basically own them via bailouts anyway.

Re:What can be done? Nothing.

[JesseMcDonald]

However, for unauthorized transfers involving only your debit card number (not the loss of the card), you are liable only for transfers that occur after 60 days following the mailing of your bank statement containing the unauthorized use and before you report the loss.

You don't have to check your bank balance daily—just make sure you don't lose the physical card, and review your monthly statements. You would have to do just as much for a credit card.

Re:What can be done? Nothing.

[Fjandr]

This really is a good answer. Not necessarily the low limit, but credit cards have far more protections than debit cards and are used in an identical manner (well, except for signature vs pin). If it's a credit account with the same bank your checking or savings account is with, it's usually pretty simple to transfer the money from your bank account to pay off the credit account monthly. Doing so incurs no additional cost. If the card is charged maliciously, you still have all the money in your bank account, and once the investigation is complete you don't pay interest on the balance that was on your card. It's a win-win.

If you absolutely have to have a card, there is no additional hardship doing it this way. Even if you have bad credit, you can get a secured card through your bank.

Re:What can be done? Nothing.

[masshuu]

Why not? Most banks offer free online banking so you can see every transaction, possibly minutes after the transaction occurs.
I'm not going to go into the "but the internet is insecure" or "i might have a virus" because this is Slashdot, i assume the common geeks and nerds know how to keep their rig secure from password stealers.

I know my dad checks our account at least twice a day(i share a joint account with my dad), and when i look at it, i spend maybe a minute to login and look at it.

Saying "I'm not in the habit of checking my bank balance daily" is the worst thing you can say in this day and age. 30 years ago it would of been fine, hell 10 years ago it would of been fine.
You brush your teeth every morning and night, why not check your account at the same time.

Re:What can be done? Nothing.

[JWSmythe]

    There was a little noise about doing better security for a while. A few companies were embedding chips in the cards, either smart cards with a contact chip, or a contactless smart card with a RFID chip.

    The problem is, these cards require the physical presence of the card holder at the point of sale. At least one bank was selling (for like $99) a contact smart card reader for online purchases. That died off.

    Magnet strips and the ability to use your number online are too embedded in the retail market.

    I've opted to use Green Dot cards. They are available through Walmart as the Walmart Money Card at a lower rate. Get one, or a stack of them. Put as much money as you're willing to lose, and then you can use them liberally. If you put $300 on a card, and spend $250, there's only $50 to lose. Reload it at any Green Dot or Walmart location if your card is safe. If the card is compromised, pull out whatever is left, and stop using the card. You can contact them, which isn't the easiest to attempt a refund on the stolen money. If (big if) you get your money back, pull it all out at the nearest ATM, and cut up the card.

    There are other options, but this works for me.

    Paypal had a nice feature for virtual credit cards through their (Windows only) plugin, but that's no longer available. I don't know of any other services that let you get a one-time use credit card number for any cards that you may have. If someone knows of one, I'd love to know about it.

 

Re:What can be done? Nothing.

[itlurksbeneath]

CitiBank or Capital One cards (at one time, at least - I haven't had one in a while) had a one time CC number generator. It was pretty neat. You could set a limit to how much could be charged, amount of time the number was valid for, etc. They had a desktop widget for it, online web page access, etc.

Re:What can be done? Nothing.

[plover]

Did I say RF? No, I said "chipped", although once the security is done correctly RF might not matter as much as you might think.

The correct protocol is for the merchant to tally the merchandise, and present the customer's card with their merchant ID and the transaction amount. The cardholder then has to see and approve that amount by entering a PIN in order to generate an authorization. (The cardholder needs to enter that PIN into a trusted device, which is best met by a smart card with a built-in keyboard and tiny display, or alternately by a trusted keycard device issued by the bank.) The card uses the PIN to generate a one-time approval code, which is forwarded by any means to the bank, along with the card data (account number or whatever), the amount, and the merchant ID. The bank returns an approval code to the merchant, who gives the merchandise to the customer. All this is digitally signed, of course, and the protocols need to be well laid out to avoid potential problems with respect to money laundering, man in the middle attacks, etc.

Note that the customer's account number is only usable for identification. It's only the chip-generated authorization combined with the user entered PIN that carries the value. Something you have plus something you know.

The authorization data is carried by the merchant and delivered by whatever means to the bank. The Internet would work fine. The merchant can see your account number, but they cannot charge you anything other than the value included in your approval. The authorization code is accepted by the bank for one time only use, and they will pay only the merchant ID indicated in the transaction.

Note that in this case, the card is issued by the bank. The certificates and keys are created and injected in the card by the bank. That means it's 100% bank-owned-and-provided hardware from customer to bank and back again. The bank is 100% in charge of security. All you have to do as a customer is not to lose your chipped card AND keep your PIN secret.

An RF based card would make only a minor difference in security. Sure, someone could ping it, but they couldn't get it to emit an authorization token unless they had it in their hands and pushed the tiny buttons. Protections would have to be taken to prevent RF based man-in-the-middle attacks between the merchant and the customer's card, otherwise the merchant might not get paid. But the customer's money is never at risk except when they are entering their PIN, and are staring at the tiny screen that says "PAY WALMART AMT=$34.56".

Re:What can be done? Nothing.

[c_forq]

Why wouldn't you trust a hundred dollar bill from a homeless man? Sure it might be stolen or gained through illicit methods, but do you really think a homeless person has the equipment required to counterfeit? And you think a counterfeiter will trust homeless people with exchanging fake money for the real stuff?

Re:What can be done? Nothing.

[tibit]

If you use citicards, the URL you're looking for is
here.

Re:What can be done? Nothing.

[archmcd]

I work in bank security, and I just wanted to offer some clarification on your rant:

If you want a more achievable answer in today's plastic world, DO NOT CARRY DEBIT CARDS. Debit cards do not offer you protection against loss.

A debit card can be used in two ways. It can either be used with a PIN in what's commonly called a debit transaction (or at an ATM), or it can be used as a "credit" transaction and processed through the Visa or MasterCard network. There is little to no protection against loss for the former of these transaction types, except keeping your PIN secure. The "credit" style transaction, on the other hand, is protected by a zero liability guarantee (at least Visa cards... not sure about MasterCard). Yes, your bank account may get cleaned out (or depleted up to the daily spending limit of your debit card), and outstanding checks may bounce, and you may have a freeze on your account until it gets resolved. However, this zero liability guarantee means any transactions found to be fraudulent will be reimbursed by your bank. The bank then goes after the merchant that processed the transaction to recoup their own losses. If you have a good bank, they'll also refund your overdraft fees. Debit or ATM transactions, on the other hand, are not covered by the same guarantee, so having your card skimmed and PIN captured is far worse - UNLESS your bank offers a guarantee on these types of transactions as well.

See http://usa.visa.com/personal/cards/debit/visa_check_cards_faq.html

Credit cards are limited by U.S. law to a maximum of $50 liability to the cardholder. Debit cards losses are usually covered by the bank, but they are under no legal obligation to do so.

Losses due to fraudulent transactions processed through the Visa network are actually covered by the merchant that accepted the transaction, not your bank. Your bank only covers "Debit"-style losses they agree to cover if they offer protection against Debit or ATM transactions, but that's not a standard program.

For ATM access, most banks will honor your request for an ATM-only card instead of accepting their default ATM/Debit card.

An ATM-only card means you will have to use ATMs more frequently, thereby potentially exposing yourself to skimmers, as well as use of your PIN in public. Since there's no zero-liability coverage with most banks for skimmed ATM transactions, you're putting your money at greater risk by doing this. Oh, and by the way, the skimmers have this one figured out too. You no longer have to worry about the shady looking person loitering near the ATM watching you enter your PIN. They install a tiny camera painted to match the fascia of the ATM, and they aim it at the keypad.

Re:What can be done? Nothing.

[Roger W Moore]

I'm not in the habit of checking my bank balance daily to see if someone's been stealing from me.

You don't have to - the time starts counting after you have NOTICED the loss/theft, not from when it occurs. So if your card is cloned and you don't notice unauthorized transactions until you get your statement then that is when the 2 days starts. What amazes me is that the US still has magnetic-only cards. Canada, UK, France and Switzerland now all have chips in the card (at least my bank cards from those countries do) so it is amazing that the US is so far behind.

Re:What can be done? Nothing.

[Kral_Blbec]

We can't all have a friend buy stuff for us...

Re:What can be done? Nothing.

[Anonymous Coward]

Maybe you should lobby your government to mandate foreign-style debit cards such as the ones used in Canada that are part of the Interac Network. While by no means entirely secure, they at least have SOME security in that you must enter in your PIN for each purchase. Signatures are essentially useless as a security measure. PINs are much more effective. Stop the stupid idiotic US (and maybe other country) model of using signatures for authorization...most countries are moving to a PIN model for credit card purchases, too. Complain and promote chip cards that require PINs for both debit and credit transactions and you will massively reduce (but certainly not eliminate) the chance for fraud.

Re:What can be done? Nothing.

[plover]

You don't have to check your bank balance daily—just make sure you don't lose the physical card, and review your monthly statements. You would have to do just as much for a credit card.

You are liable for the amount (on a sliding scale) if you don't report the theft within two days. If some waiter skims your debit card's stripe at a restaurant, you will not even know a copy was made, but you are just as liable as if the card were physically stolen. If you check it monthly, that gives the thieves up to 28 days to steal from your account; more than enough time to drain it dry. The only realistic chance you would have of noticing it early is if you get an unexpected NSF while using your card.

Re:What can be done? Nothing.

[Neoprofin]

The problem with that is that is if you drop or have your wallet stolen. Having to fight with a bank over $20,000 is a pain in the ass but I'd rather deal with that than losing my wallet with $200 in it.

Re:What can be done? Nothing.

[Kral_Blbec]

I got a better RFID security solution. A cover
Pretty much anyone that is going to issue you a RFID card is going to also offer a sleeve to put it in that will block signals.

Re:What can be done? Nothing.

[darkpixel2k]

I hate to say this, but use cash.

Agreed.
No more overdraft fees either. If you don't have the cash, you can't make the purchase.

Also, if you're going to carry your entire paycheck on you, consider getting your own 'Federal' deposit insurance...

Re:What can be done? Nothing.

[dwillden]

Actually if your debit card has a Visa or Mastercard logo on it, it has the exact same protections on it as a credit card. If your bank is giving you the run-around on getting your money back, start complaining and look for another bank. The moment you noticed a problem and reported it, the card should have been shut off, and all transactions starting with the first questionable one you pointed out reviewed with you.(just like with a credit card) Your bank may take a day or two to restore your money, but longer than that is worthy of a complaint to VISA and the BBB.

Re:What can be done? Nothing.

[Anonymous Coward]

The short answer? The banks will do nothing for you today.

The long answer: Nobody will do anything for you tomorrow, either.

Congratulations - you know PCI but banks are not required to following PCI. The simple fact is that using a card directly tied to your checking account is a BAD IDEA. Regardless of the controls in place. Banks will take every step to restore your money. And they do because they have an incentive to do so. But it takes time to do so. So don't use debit cards. Use a credit card. The worse case scenario is that you lose 50 bucks if your card is misused but you still have money in the bank to pay your rent or mortgage.

Re:What can be done? Nothing.

[Recovery1]

Great idea. But my bank doesn't offer me such a system.

In its place though I have a credit card issued from the bank. It is linked to only one account and I have to transfer money into it before I use it for any transactions so otherwise it is mostly empty. Try to withdraw any more then is in it, the transaction is automatically rejected. Seems to work for me so far with online transactions quite well.

Re:What can be done? Nothing.

[IntlHarvester]

On the flip side of that argument, someone stands to make a lot of money by entering the market and challenging Visa with the selling point of increased security. Are there barriers to entry in that market? Sure.

Except, the potential customers for such a system (banks) are actually the owners of Visa.

Re:What can be done? Nothing.

[Lord Byron II]

Exactly. Why anyone would use a debit card is beyond me. Get a credit card and learn to manage your finances and you'll never have a problem (or if you, federal law will be on your side).

Re:What can be done? Nothing.

[exasperation]

Who said anything about RFID? Debit cards in Canada have a public key encryption chip built-in. They also require physical contact with the reader to work. I suspect that is what the parent was talking about.

Re:What can be done? Nothing.

[anza]

Yes, that was quite an informative post. I'll do that right away. Either that, or the mods have a wonderfully dry sense of humor.

Re:What can be done? Nothing.

[bdwlangm]

Not that many retailers are using the chip readers yet here in Canada... Guess the USA isn't that far behind us after all.

Re:What can be done? Nothing.

[shemp42]

So if your buddy follows this advice, How do you buy things online? The answer is that nothing is safe. No matter what it is in life it has risks. You just have to do your best to mitigate those risks and hope for the best.

Re:What can be done? Nothing.

[Anonymous Coward]

i think the previous poster was talking about regular contact chips, such as are everywhere in europe. these cards have metal contacts exposed which interface with a reader, and require a PIN to decrypt the account number on the card. they are not RFID and are not subject to any remote attack.

try making a multi hundred dollar credit purchase in europe at a non tourist spot, they will look at you like you're a caveman trying to pay with a magstripe only card. you might as well be trading seashells.

Re:What can be done? Nothing.

[Skreems]

Not according to the FTC, as quoted in the very thread to which you're replying...

However, for unauthorized transfers involving only your debit card number (not the loss of the card), you are liable only for transfers that occur after 60 days following the mailing of your bank statement containing the unauthorized use and before you report the loss.

According to them you have up to 60 days to report from the time they mail you the statement containing the fraudulent withdrawal before you start losing your own money.

Re:What can be done? Nothing.

[statusbar]

One thing can be done:

http://www.my-spy.com/

A service which will notify you via email or text message whenever any transaction occurs on your accounts.

--jeffk++

Re:What can be done? Nothing.

[shentino]

Unfortunately human nature will put self interest in charge of personal decisions.

The vast majority of people will only give up an asset or incur an expense if they have no other choice.

Basically, no sticks means no carrots.

Re:What can be done? Nothing.

[Runaway1956]

GGP is on the mark, when he says "Use cash". But, in today's world, it seems a necessity that we are able to make purchases online. So, I have exactly what Recovery1 has - a plain debit card. I put money on the card, make my purchase, the card is dry, and no one can make any more withdrawals. Doesn't much matter if someone around the world gets my number, they can ONLY steal the money that I have put on the card that day, and if I've already made my purchases, the balance is zero, they can't steal anything at all.

But, their attempts to do so will trigger alarms, and the bank knows that security has been compromised!! In theory, the bank will contact me, and ask about those attempted purchases.

Re:What can be done? Nothing.

[kobaz]

My business debit card number (and my business partners number) were hijacked somewhere somehow. We've only used the cards at select merchants we've been dealing with for years, along with newegg, dell, and some local trusted shops.

My card is generally used for online purchases, and my partners card is generally used for offline purchases. Both card numbers were used in south africa to ring up 15,000 in charges in under 24 hours.

M&T Bank reversed every single last charge, but holey @(#&$!!! that was a ride.

Check your bank balances OFTEN

Re:What can be done? Nothing.

[EvanED]

Actually if your debit card has a Visa or Mastercard logo on it, it has the exact same protections on it as a credit card.

Only if it's run as if it were credit and not a PIN transaction.

Re:What can be done? Nothing.

[Surt]

Taking out a debit card has no impact on your credit score. Taking out a credit card does.

Re:What can be done? Nothing.

[networkBoy]

you've obviously never dropped your wallet then.
I have. I'd gladly pay $200 cash in exchange for all the time spent straightening out my finances.
I would come out ahead big time (Vs. lost income from normal hourly pay where I work).

I use a debit only card for ATM and a Low limit Visa for internet/day to day purchases ($1K). I have another account that can charge an obscene amount of money, but I try not to use that for anything, and don't carry the card with me as a day to day thing.
Worst case scenario is I lose $400 cash from the ATM (daily limit) before I can notify the bank to freeze my account. The credit card purchases are not my problem beyond $50, and if they push the issue I simply refuse to pay ;)

-nB

Re:What can be done? Nothing.

[rtb61]

One thing to watch out for is being fobbed off by banks. Standard law for credit or debit cards is the onus is upon the seller to prove that you made the purchase not upon you to prove you didn't. If your bank wants to take a few weeks to resolve it immediately complain to your regulatory authority, the bank can take a few weeks to resolve it with the seller, not with you. Once you have made the formal claim for a stop payment it should be resolved in a couple of days, if your bank does not support you in this, it is time to change banks.

The reality the person who used your credit or debit cards details, did not steal from you, the seller with the assistance of the credit or debit card company stole from you, they should be required by law to prove that charge in fact did occur, that they were defrauded and that they attempted to defraud you in error.

The lie being spread by mass media, to suit their advertisers the credit card companies and the merchants is a lie, that the money was stolen from your by the thief that used the card details. Your money was stolen by the merchant who claimed you made the purchase, once you have made the complaint, the police should pursue the merchant who by law should prove they did not just attempt to defraud you, that someone defrauded the merchant has absolutely nothing to do with you and at no time should be considered your problem.

Re:What can be done? Nothing.

[Throtex]

In fact, not only is it a good answer, it's the only correct answer. Credit is better than cash is better than debit. Why? If you have a dispute with a merchant you paid in cash, you need to sort it out with them directly before you can get your money back. If you have a dispute with a merchant and you paid with credit, and you're in good standing with your credit card provider, then you can just have them fight it out for you and reimburse you immediately. No hassle, no worries.

I pay credit for everything I can. Absolutely everything. I have no shame whipping out a credit card for a $3 purchase if the merchant will accept it. Why should I care?

Oh, and of course, all of this requires the very simple discipline of paying off your bills every month, and thereby incurring no fees. As a bonus, you get points/miles/whatever. Sure, you're paying for it because the merchant builds the card fees into the price of whatever you're buying, but by and large paying cash won't get you a better rate these days.

Debit? Never use it. Unfortunately my ATM card HAS to also be a debit card, and there's no way to deactivate its debit usage. It's a shame. There is literally no point, whatsoever, to using a debit card. Unless, I suppose, you lack discipline, and well in that case you've got bigger problems.

Re:What can be done? Nothing.

[shentino]

Thankfully however, we have the FDIC.

Re:What can be done? Nothing.

[epee1221]

And you think a counterfeiter will trust homeless people with exchanging fake money for the real stuff?

The exchange can happen on the spot. The counterfeiter offers the hobo $100 for a fraction of that amount in small bills. The hobo might be suspicious, but he knows he'd be turning down a huge payoff. The counterfeiter isn't getting as much as he could for his "product," but he still gets far more than it costs to produce. He also filters it through someone who's unlikely to be willing/able to identify him to the authorities.

Re:What can be done? Nothing.

[Zironic]

Uhmmm, that's not what a chipped card is. This is a chipped card http://en.wikipedia.org/wiki/Smart_card and it's way

Re:What can be done? Nothing.

[TheSpoom]

There's no need for a chip on the card; simply have banks do PIN verification remotely, and lock (and mark) the card after a few attempts. Use public key cryptography to both identify valid PIN pads and encrypt data (i.e. the PIN and transaction details) so only the bank can read it.

This avoids any possible crack on the chip itself, which has already been cracked at least once, and cracking the bank's remote systems is probably harder than simply breaking into a branch.

The real reason banks are pushing chip-and-PIN is because they all have a little clause in their contracts that states that if a PIN is entered, the transaction is valid if the card hasn't already been reported as stolen. It's a liability shift that they hope will fly under the radar, since, for them, it means losing less money refunding stolen funds, and making more money from the overdraft fees that result. This could be changed with regulation, but who's counting on that?

Re:What can be done? Nothing.

[plover]

You need the chip on the card, because you can't trust the PIN pad at the retailer, and you can't trust anything short of a chip to prevent duplication.

That PIN pad sitting on the counter might *look* like a real PIN pad, but it might not be on the inside, and from the outside as a customer you have no way of verifying it.

Re:What can be done? Nothing.

[Anonymous Coward]

i guess there is a section of the market with no self control

That's why he was modded flamebait.

Re:What can be done? Nothing.

[AegisFang]

I suggest everyone reading this with a debit card transfer all of their money to my account. I do not have a debit card so it will be free from this sort of attack.

Hello Sir, I currently have over 3000000$(3 million) US dollars in account from my late uncle (Nigerian Royalty). If I could, please, to be put this inheritance in your account for 1 month to avoid Nigerian Tax Liability, I would gladly pay 10 percent to you in 1 month time. Please to send me your account number as offered and PIN. I will deposit funds forthrightly. Thank you God Bless! Kindest regards, Eeaye Eeayeou

Re:What can be done? Nothing.

[Anonymous Coward]

Kind of interesting, Here in Japan, there are:
1. "Cash Cards" - These almost always have an IC chip, and can be set up for fingerprint or palm print authentication easily. They don't usually have mag stripes anymore.
2. "Credit Cards" - These sometimes have an IC chip but can be used without one in most cases.
3. Combination cards - contain the functions of both above.

Almost nobody offers the Debit cards using the credit networks (i.e. Visa debit). I had to search really hard to find a place that did (eBank).
You can get "Debit Service" on your cash card, which allows you to buy stuff at the stores, but it's like the normal debit service in the US where you enter a PIN code, and it doesn't go through Visa or anyone.

Anyway the ATM and Debit network is supposedly very secure. I have never heard of any fraud involving it. The credit.. well is someone has your number they can use it.

Re:What can be done? Nothing.

[glodime]

You should read John Whitley's comment. Why can't you see the inefficiency of every individual verifying transactions compared to a central processor of transactions baring the burden.

Re:What can be done? Nothing.

[xero314]

Hey let's not compare what I proposed in one short little sentence fragment with what Stalin took years to destroy.

Why, because if you provided for all my needs, then I wouldn't need to work.

Then I put your ass on a boat and drop you off in the middle of the pacific with a bologna sandwich and life vest.

Others would see me not working and decide to follow suit.

I imagine most people would rather be productive than have die of exposure.

This trait is called greed and you will never be able to take it out of the equation.

Greed only exists because there is incentive to do so. Remove the incentive and you remove the greed.

And this is where someone goes on about how no one would have the incentive to invent new things, but that's only because we assume the only motivation in monetary gain. While in reality most true inventions happen because the inventor actually wants to use his invention.

Re:What can be done? Nothing.

[Famanoran]

All valid points.

However:

> You brush your teeth every morning and night, why not check your account at the same time.

Do you want to clean toothpaste out of your keyboard morning and night?

Re:What can be done? Nothing.

[xero314]

Basically, no sticks means no carrots.

A better lifestyle (for all people) is one hell of a carrot, and future is one hell of a stick.

Re:What can be done? Nothing.

[Wog]

[Sweet, you go do that so I can retire and have my needs met while I do nothing.]*n

Where n=the population of the planet.

Re:What can be done? Nothing.

[InvisiBill]

Actually, I don't think the part about the lack of debit card consumer protections is factually accurate. Here's the blurb from The FTC's Facts for Consumers:

ATM or Debit Card Loss or Fraudulent Transfers (EFTA). Your liability under federal law for unauthorized use of your ATM or debit card depends on how quickly you report the loss. If you report an ATM or debit card missing before it's used without your permission, the EFTA says the card issuer cannot hold you responsible for any unauthorized transfers. If unauthorized use occurs before you report it, your liability under federal law depends on how quickly you report the loss.

For example, if you report the loss within two business days after you realize your card is missing, you will not be responsible for more than $50 for unauthorized use. However, if you don't report the loss within two business days after you discover the loss, you could lose up to $500 because of an unauthorized transfer. You also risk unlimited loss if you fail to report an unauthorized transfer within 60 days after your bank statement containing unauthorized use is mailed to you. That means you could lose all the money in your bank account and the unused portion of your line of credit established for overdrafts. However, for unauthorized transfers involving only your debit card number (not the loss of the card), you are liable only for transfers that occur after 60 days following the mailing of your bank statement containing the unauthorized use and before you report the loss.

If unauthorized transfers show up on your bank statement, report them to the card issuer as quickly as possible. Once you've reported the loss of your ATM or debit card, you cannot be held liable for additional unauthorized transfers that occur after that time.

The problem is that "not being responsible for the charges" and "having your money while things get sorted out" are two separate things. While you might get every penny back in the end, you might not have access to your money for quite a while during the investigation.

Unfortunately, the best solution is to get a credit card. The liability is about the same, but if something happens, you're out credit which you can't be forced to repay during the investigation, rather than losing the cash you actually had in your bank account for two months while they figure it out. It requires some self-control to put everything on a credit card instead of a debit card and pay it all off every month, but if something does happen you lose (access to) imaginary money rather than real money. Depending on the card you get, you may even make some money from their rewards program. I recently had Discover deposit $200 into my checking account from my Cashback. Since I always pay it off fully, there were no charges of any type on the purchases that earned me the $200.

Re:What can be done? Nothing.

[Ubergrendle]

"If Visa were to design and offer a cryptographically secure solution, one based only on smart cards for the customers and Hardware Security Modules (HSMs) at the banks, then I could safely route my charge authorizations over the plain ol' Internet. I wouldn't need to use the charge-per-transaction VisaNet. Visa would stop making money." Charge per transaction over VISAnet is a service charge VISA levies to banks, for using their network. VISA doesn't 'own' the transaction when its debit, so they need to generate operating revenue somehow. If the banks wanted to create their own network (like, Interac which is debit-only in Canada) they could, but most American banks are lazy in this regard.

As for your end-to-end HSM valid secure solution, it exists today -- the EMV standard (Europay/Mastercard/Visa) has been extraordinarily successful at eliminating card and transaction fraud...where deployed. Two problems though exist -- 1) the US in the midst of a deep recession hasn't even started deploying the technology nationally, and 2) until a nation is (mostly) EMV complaint all the way down to the terminal level, fall back transactions to magstripe still occur. Its the magstripe transactions that are the source of fraud.

To my knowledge, there is no direct copy ability or open hack for an EMV secured card. There are some theoretical man-in-the-middle and compromised HSM hacks discussed, but none have been used in practice.

More detail can be found here: http://en.wikipedia.org/wiki/EMV

Re:What can be done? Nothing.

[man_of_mr_e]

Have you looked at the fees for this? A reload pack is $4.95, regardless of how much money you put in. if you put $100 on, it's 5% of the cost. That's not even beginning to count the inconvenience of having to go to the store all the time to reload the things.

Re:What can be done? Nothing.

[failedlogic]

I would trust the bill as long as it passes the tests. But (my point in making the statement), will a cashier or the store manager? Its all a matter of psychology. Wether or not it appears as though you can't afford to have a bunch of twenties or hundreds in your wallet, which used to be perfectly normal before debit cards, cashiers tend to make extra sure your cash is good.

Re:What can be done? Nothing.

[neonmonk]

Communism is the very definition of FAILURE!

Re:What can be done? Nothing.

[Anonymous Coward]

Read this.

Re:What can be done? Nothing.

[RenQuanta]

So...it's more efficient for the central transaction processor (bank) to try and verify the legitimacy of transactions, rather than each individual? Let's break that down.

Let's just take an imaginary small consumer bank, with 10,000 customers in a local community. If we assume that, on average, their customers all have debit cards and use them to the tune of 20 times a week, that brings us right away to 200,000 transactions that the bank has to review and analyze per week. In the course of a month, it's 6,000,000.

So, how can the bank determine fraudulent transactions? Well, they can try and baseline everyone's average buying habits (stores, categories of purchasing), but that could cause false positives as people very often do unusual things. They can try and flag transactions based upon the use of the card in unusual places, but with so much interstate and even international commerce thanks to the Internet, that's not such a sure sign either, now.

Let's not forget that with a small bank, they don't have big and fancy computers with trained analysts to throw at the problem. I would think such small institutions have a staff on the order of a couple of hundred people, at best?

Of course, the big banks certainly have the money to throw at the problem to buy proper computers, software, and hire enough analysts, but the complexity is now far, far worse, as they service millions of customers all over the country (and possibly/probably international). Now we're talking probably in excess of billions of transactions for the same time period, and I think it's safe to say the complexity rockets up at an exponential rate, as you're now dealing with the rich, the poor, and everyone in between, all with their own buying patterns, habits, life changes, etc.

So, it's easier for the banks to be responsible for analyzing EVERYBODY'S transactions, which are complete black boxes to them?

Or, is it easier for us to log into our online account once or twice a week, scan our virtual checkbooks of 20(ish) transactions and say, "Yup, I remember buying all that stuff"...?

Whatever happened to taking a little personal responsibility?

For my part, I've been using Quicken for almost 5 years now to track every single account I have in my name, from mortgage to checking to retirement funds and all the rest. I'd venture to say nothing happens in my accounts without me noticing it in a few days. (It's a nice feeling to have such total understanding of your complete financial situation at any given moment. ;-) Sure, it takes some discipline, but after a while, it becomes habit.

About that comment you linked? Interesting, and he makes a good point about identity theft - but that's not what we're talking about here.

The case of the original poster was simple theft. Yes, the debit card number was lost, but it wasn't his SSN or some other critical piece of Personally Identifiable Information that allowed the thief to then take out a loan in the guy's name and walk off with the money, never to be heard from again and ruining that victim's credit rating in the process while leaving him personally liable for a debt he probably could never cover.

I'm not sure I see what liability for identity theft has to do with the efficiencies of who should be ultimately responsible for monitoring an individual's banking transactions for fraud.

Re:What can be done? Nothing.

[Lorien_the_first_one]

Thanks for some fine reasoning with experience. I've had mixed feelings about this so here is what I do:

I have a debit/ATM card. I use it like a credit card on the internet. When I make purchases in person, I use it like a debit card. The idea is that when I want cash, I get it at the market or some other place where I buy stuff. That way, the terminals are supervised and I'm in a bright, well lit area when I get my cash.

I have also heard that the fees are lower for debit card transactions than for credit card type transactions. I feel like I'm giving the place of purchase a break when I do this.

I've been doing this for years and have never had a problem with it. I also have a separate account where the majority of the funds are kept so I can't be completely cleaned out.

Just my $0.02.

Re:What can be done? Nothing.

[RenQuanta]

Very valid points, and I agree with you completely.

As a matter of fact, I follow the same practices myself, including the rewards program...all those credit card purchases add up quickly! ;-)

And yes, as you said - always, ALWAYS, ALWAYS pay off your credit card completely every month!

Those interest rates will quickly eat you alive and put a person in dept for years .

Re:What can be done? Nothing.

[scdeimos]

It's a liability shift that they hope will fly under the radar, since, for them, it means losing less money refunding stolen funds, and making more money from the overdraft fees that result.

You're kidding yourself if you think that the banks are losing that money. They do a chargeback on the merchant.

Re:What can be done? Nothing.

[JWSmythe]

If you use the Walmart card, it's $3 at the register to reload. You just hand them the cash (+$3) and tell them you want it on the card.

    It's all in how much you're willing to lose. If you have $2k in the bank, and your debit card is compromised, you could be out $1950. If you put $500 at a time on a prepaid card, you're out $12 for the fees and possibly the $500 if you just refilled it.

    $512 < $1950.

    To each his own. I know using cash to get gas is a pain in a lot of places. I did a road trip recently, paying exclusively in cash. Being that I didn't know the neighborhoods I had stopped in for gas, the risk was higher that walking away from my car it may not be there when I got back. Sometimes I didn't have the luxury of saying "This doesn't look like a safe place, I'll stop at the next exit", when the car is on E, and the next exit is 40 miles away.

Re:What can be done? Nothing.

[j0uSt]

I have fell victim to this from a hotel in Rio Grand de Norte in Brazil where when I checked out with my debit card used my pin (covered my hand) and fly back to Rio de Janeiro. By the time I had arrived my account was cleaned out as someone had made a duplicate card and bought shoes, jewelry and even hit the ATM machine and withdrew cash. I showed my airline ticket and the money was returned.

The second time I used my CHIP and PIN card from my UK bank account thinking I was safe. Well guess what the CHIP and PIN is a dog and pony show! I used a UOB ATM machine and someone was able to duplicate my card and use my PIN with a new NON CHIP and PIN card and wipe my account out. Meaning the system doesn't verify if the CHIP is in place it only uses it assuming one is on the card. Once again some fancy new sneakers, jewelry, cash from the ATM and even had a movie at my expense.

I will tell you it took well over a month to get the money back but in each instance the money was returned.

I now rarely use my DEBIT cards for anything and I make damn sure there is no money in the account (second non-linked account) and if I want to make a large transaction I just move the money make the transaction and be done with it. My other option is good ole american express.. I can pull up to a 1000 pounds a day and while it can be expensive as long as you pay promptly its not too bad.

Just my 2 cents!

Re:What can be done? Nothing.

[Anonymous Coward]

The EFT services know this. But the problem is that such a scheme would make the EFT services unnecessary since with this scheme payments could be negotiated over the Internet or even over a telephone line without compromising security. Therefore it will not be implemented until the law changes. And if that would happen EFT services might go bankrupt, which means that trying to get such a law passed would be an uphill battle against a well financed lobby.

Re:What can be done? Nothing.

[Raptoer]

One of the basic concepts in physical security is having the 'key' be in two parts, something you have and something you know. The idea of the debit/credit card is that it needs to be physically present in order to make the transaction, but that has gone away with online purchases.

There are two major fixes that could solve a lot of these debit / credit problems. One is to have the number on the card be different than what is stored on the magnetic strip. This way, when the thief gets a hold of the data on the strip, they have to make a new card and can't make online purchases. It's not difficult to make a new card with the data off the strip, but it just makes it that much more difficult, especially when the thief goes to use it and the merchant refuses because it's a generic card and not one from a bank.

The other major fix is to put a time changing number into the card. I can't think of the right word, but it would be a digital display with a number that changes every so often, anywhere from 5 minutes to a day would easily work. The bank knows what that number should be at any point in time and that particular card knows, so now you really do need the card in order to use it online.

Re:What can be done? Nothing.

[Anonymous Coward]

Be careful about bank accounts that reject charges with not enough funding. A bank likely can charge you $30-$50 for an overdraft fee, and the person who made the withdrawal might be able to ding you up to $50 just like a bounced check.

Re:What can be done? Nothing.

[mjwx]

The short answer? The banks will do nothing for you today.

The long answer: Nobody will do anything for you tomorrow, either.

As much as I appreciate good sarcasm, you're not helping.

What you can do.

Open a second account under the same account number with no card access, in Australia most banks call this a "special savings account" and a few even have a high rate of interest on it. Keep all of your money in this one account, only keep $50 to $100 on the card for emergencies. Use internet banking to transfer between the two accounts.

This is damn good card security as they cant take money if there is none on the card. I have a Visa Debit card and use this system. As a bonus, the cash I have in the bank is accumulating about 3.25% interest at the moment. Secondary beneficial effects are that it cuts down on impulse purchases (no you really don't need that fluffy Yoda to hang from your rear view mirror).

Re:What can be done? Nothing.

[xero314]

And what exactly does that have to do with my prior statement? I'd like to know because maybe the words I wrote don't mean what I think they mean.

Re:What can be done? Nothing.

[xero314]

Communism is the very definition of FAILURE!

Really? I assume you have some computer simulations somewhere that prove this. I mean they would have to be simulations since it's never been tried in reality.

And more importantly, what does that even remotely have to do with the comment you are responding to?

Re:What can be done? Nothing.

[kd5zex]

There is literally no point, whatsoever, to using a debit card. Unless, I suppose, you lack discipline, and well in that case you've got bigger problems.

My credit union gives me a dime each time I use my debit card.

Re:What can be done? Nothing.

[nacturation]

Interestingly enough, your post highlights a potential risk in the way Slashdot shortens the square bracket preview of long URLs. Example of what I mean

Re:What can be done? Nothing.

[Neoprofin]

I've lost two wallets. 1) Call Wells Fargo, cancel debit card and order replacement. 2) Call Chase, cancel credit card and order replacement.

Re:What can be done? Nothing.

[lazy_playboy]

LloydsTSB have returned all money I have had stolen from me via Debit Card fraud within 2-3 days.

Perhaps the answer is: change bank.

Re:What can be done? Nothing.

[evilviper]

Credit cards are limited by U.S. law to a maximum of $50 liability to the cardholder. Debit cards losses are usually covered by the bank, but they are under no legal obligation to do so.

This is totally and completely untrue. The laws which protect you from debit card fraud are only a couple years younger than the laws protecting you from credit card fraud, so I have no idea how this idiotic idea got started. The only way you can actually lose the money, legally, is "if you fail to notify the bank within 60 days." Otherwise, call the bank, and send it in writing shortly thereafter, and you'll have your money back in no time (do NOT omit the in-writing part!):

"The law limits consumer liability for credit card fraud to $50. For debit card fraud, your liability is $50 if you notify the bank with 2 days of learning of the fraud, and $500 or more after two days"

Andthe claims that maxing-out your credit card due to fraud doesn't affect the consumer, is also nonsense. If you've got a bill pending on your credit card, it'll be rejected, just as it would if it was on your debit card. How is there any difference there? You're screwed either way.

Re:What can be done? Nothing.

[Anonymous Coward]

Strange. In Estonia my Visa debit card has:
- a chip, it is essentially a smart card. All the transactions between the merchant and the bank is encrypted using open protocols and routed through the plain ol' internet
- a strict limit(that I set myself) to the amount that can be debited in a day and in a week

Re:What can be done? Nothing.

[evilviper]

checking your account every few days is only prudent.

Not unless you're unemployed and therefore have a lot of extra time on your hands...

Honestly, if I have to watch my bank account like a hawk to have a debit or credit card, I'd stick to cash exclusively, and the good old monthly statement... I don't know about anyone else, but the "convenience" of a credit/debit card is pretty damn small to me.

Re:What can be done? Nothing.

[blindseer]

I suggest everyone reading this with a debit card transfer all of their money to my account. I do not have a debit card so it will be free from this sort of attack.

Sure, I'll do that. Please post your routing number and account number so that I can complete the transaction.

Re:What can be done? Nothing.

[stephanruby]

You had me until you said you used paypal. Paypal is not cash, not even close. Also as to the buddy, you just seem to be pawning the risk off to him, so your advice doesn't scale. If I unload my risk to my buddy, and if my buddy unloads his risk to another buddy, the chain will eventually break when the last person figures out they've been taking on the risk for everyone else.

Re:What can be done? Nothing.

[thinusp]

Visa afaik is rather secure. They mandate the use of hsm hardware, at least here in South Africa. Also it is up to the bank to prove that you spent the money when you query a transaction.

Emv, Aka smart cards, offers a level of protection, although it's not perfect. Those guys in the uk broke the chip and pin system.

I guess the point i'm aiming for is to NOT LET THE FRIGGEN CARD OUT OF YOUR SIGHT. Always walk with the attendant when paying by card. Over here we have wireless card machines to be brought to your table.

Observe the way your card is handled by the waiter etc. All he really needs is the cvv2 on the back of the card. The other info required for a transaction is printed on the merchant receipt. So be vigilant.

Or use cash. But we all know what a pain in the arse it can be to find an ahatTIehat is run by your bank.

 

Re:What can be done? Nothing.

[DirtyCanuck]

Yes, in Canada we have chipped cards EXACTLY as per the link you posted.

http://www.td.com/privacyandsecurity/tdctcard.jsp

I have the same chip on my credit card. I begged for a non-chipped card because they are slightly slower to use.

Can't take out money that's not there ;)

Re:What can be done? Nothing.

[j_sp_r]

When my bank pass was copied and mis-used I was called by my bank that something was wrong (My withdrawals where higher and in a wrong place then normal) before I noticed it myself.

Re:What can be done? Nothing.

[protodevilin]

By bank actually offers such a service, free of charge. The way it works is, I specify a dollar amount associated with one of my accounts, and anytime a purchase exceeds that amount, I am immediately notified by e-mail. I currently hold a savings, debit, and credit card account with the bank. I simply specified a purchase amount of $1 for each of them, so now I get notified anytime anything happens with any of my accounts. This method has thwarted two unauthorized transactions thus far, which were both resolved/reimbursed within 48 hours. Can't be too careful these days.

Re:What can be done? Nothing.

[Anonymous Coward]

Sorry, I dont think so...

Re:What can be done? Nothing.

[Anonymous Coward]

Naah - no modding down. Everyone here should be smart enough to distrust debit cards immensely.

Agreed. I refuse debit cards. Credit cards okay, fraud is their problem not mine. ATM cards okay, at least a PIN is needed. A debit card that can clean out all of my money and force the burden of getting it back on me? No way.

I have accounts with 2 different credit unions. One of them sent me an unsolicited VISA debit card once. I destroyed it, told them I didn't want it and that they should cancel it, and asked for them to never send me one again. They were understanding.

The other credit union also sent me an unsolicited VISA debit card. Except they informed me that they would be canceling my ATM card, and that I had no other choice if I wanted access to my account without a teller. I took the card to the credit union, physically returned it to them, asked for all of my money, and closed my membership.

So I guess I should now say that I have an account with just 1 credit union.

Re:What can be done? Nothing.

[mikael_j]

Actually, that just proves that the early american colonists clearly did not understand the concept of solidarity. You also need to factor in that if someone is already starving it's a lot harder to make them work hard to supply for others. This is actually one of several major flaws with going from capitalism to communism via a revolution, I can't recall if Marx mentioned it but his contemporaries definitely did. The suggested alternative was to wait until there was an abundance of food and other resources before attempting communism, but so far every attempt at communism has involved the "speed things along with a bloody revolution" method.

Re:What can be done? Nothing.

[kiddygrinder]

your solution only works for people at each end of the scale, people who have a job flipping burgers have no incentive to move up to a better paid (but just as thankless) job doing something more productive to society. No-one has any incentive to do anything other than the bare minimum to not get marooned, and greed is currently the only really feasible leverage to get the 95% of the population not directly motivated by altruism to do there part for society. I would recommend you look at the history of countries like Cuba etc who have tried this kind of thing and failed before you suggest we tear down capitalism ( even though America could do with a little less extremist capitalism at the moment )

Re:What can be done? Nothing.

[nosferatu1001]

And that clause does ntohing (if it even exists) as it is both unconscionable AND violates the Banking Code.

Banks will try to pretend otherwise, but that doesnt make it true...

Re:What can be done? Nothing.

[Cimexus]

Yep this is a good idea.

I do a sorta similar thing. I have two banks. One is my 'regular' bank that I keep most of my funds in, get my salary deposited into, withdraw from at ATMs etc. I have both a debit and credit card with this bank, but I tend not to use the debit card online.

My other bank has only a debit card linked to a single account that never has more than a few hundred dollars. This is the debit card I use for online transactions, and is also the account linked to my PayPal account (via EFT). So if my number gets stolen or I get phished via PayPal or whatever, the maximum money I am going to lose is the small amount in that account. If that account gets too low I just EFT a bit more over from my 'main' bank (takes 24 hours).

You can of course acheive the same effect with a single bank. Have a transaction account accessible via the debit card, and a linked savings account that is not directly card-accessible (i.e. that money has to be transferred back to the transaction account via online banking or in person at a branch before it can be used - as far as the debit card is concerned, that money doesn't exist). That is a fairly standard way of doing things here in Australia anyway, since most people prefer to keep their money in a savings account earning 4% or 5% interest, than in an everyday transaction account earning close to zero).

Re:What can be done? Nothing.

[Anonymous Coward]

The chip and pin system is broken by design so that you don't actually need to know the pin-number to authorise a payment, you just need to fake the "the pin you just typed is correct" answer the card gives the terminal. See for example http://www.lightbluetouchpaper.org/2010/02/11/chip-and-pin-is-broken/

Re:What can be done? Nothing.

[FuckingNickName]

I applaud your ideal, but:

1. Why is it better for a friend to use his CC than you? Do you pay him some % to manage the risk of potential CC fraud?

2. YOU GIVE YOUR BANK DETAILS TO PAYPAL?! SOMEONE COULD CLEAR OUT YOUR ACCOUNT. Or, if you get a chargeback, Paypal will just withdraw money from your account to prevent making a loss.

Seriously, 2, dude. Don't ever give your bank details to Paypal.

Re:What can be done? Nothing.

[jandersen]

Well, there is an option available - I don't know what they are called, but it is basically a pre-paid (and anonymous, AFAIK) debit-card. You charge it with the amount you want to use, and that is then all you risk losing. Visa probably offers them as well - I have seen them targeted at those who for some reason can't get a bank account.

But you are right; the banks are ripping us all off and they are allowed to get away with it too. Example:

In UK they routinely charge a punitive fee for unauthorise overdrafts; but they have made the debit card system so that it is very difficult to avoid. It doesn't take a lot of cynicism to imagine that they are fully aware that this setup is likely to make them a lot of money. Before I changed from Barclay's Bank, I got hit in a particularly vicious way: I accidentally made a minor overdraft, this was punished with a 30GBP fine. Since there was not enough money available to pay the fee, surprise, suprise, this generated another fee, and so on. There was a limit of three fees - even they could see that there had to be some sort of limit - but it meant that even a small transgression was guaranteed to cost 90GBP.

I could go on, but it is too depressing.

What I don't understand is that there are people who still talk with a straight face about "the freedom of the market", and that we have to deregulate. This kind of thing is the direct result of following that ideology; we all know what it is that flows to the top of a stale pond, and what it does to everything living there - it pollutes the water, chokes the fish and blocks out the light. And the rots and starts to stink - it seems an eerily appropriate description of the current Western society.

Re:What can be done? Nothing.

[Cimexus]

Hehe I noticed that as a foreigner visiting America.

Obviously I didn't want to use my debit card from my home bank for every transaction since I would incur a currency exchange fee every time. So I generally used cash (and this was mostly in large denominations like 50s and 100s, since thats what they give you when you get your money changed at the airport).

The first thing I noticed was the signs at various shops saying "we don't accept 100s". This was 'new' to me. At home, money is money, and has to be accepted for a payment (it's legal tender after all). I don't think the retailer has a right to refuse you paying with particular denominations (although I suppose they can refuse to trade with you altogether which has the same effect). Having said that, I suppose the reason for this might not be related to counterfeiting at all - it could simply be that they don't like to count out a large amount of change (slows down the line etc).

The second thing I noticed was the weird looks they gave you paying in 100s, or in some cases, even 50s. Wtf...

The third thing I noticed was all the weird little things they did to check for forgeries ... running it between their fingers, the UV light, etc etc. Some places even had little machines to check the bills. At home (Australia FWIW), I've NEVER seen anyone check a bill for authenticity (not even in a cursory fashion) ... hell they barely even glance at it. Probably mostly because Australian bills are considered among the most secure in the world (they are polymer rather than linen/paper, and virtually unforgeable).

I think it's just one of those cultural things though. At home people use $50s and $100s all the time and it's not considered unusual at all. Noone even raises an eyelid. 50s are especially common since Australian ATMs dish out both 50s and 20s (so you can make withdrawals of 20, 40, 50, 70, 80, 90, 100 etc).

Of course it's not as bad as in Europe. Last time I travelled there the currency changer gave me a 500 Euro note. I'm sure dishing out change for that annoyed whoever I ended up giving it to.

Re:What can be done? Nothing.

[aj50]

The whole point of that article is that the chip and pin terminal was cracked. I.e. something which is outside of the user's control.

The GP's suggestion avoids this type of vulnerability because the user doesn't have to trust the retailer's terminal at all. One of the key elements in the attack reported in your argument was the use of a cracked chip & pin terminal which showed the £20 restaurant bill while actually charging the customer for the £2000 jeweller's invoice.

In the GP's method the transaction details would be displayed on the card itself. The card will create an authorisation for the given transaction and display that transaction to the user. To conduct a similar attack you would have to somehow induce my card to display one transaction and generate an authorisation for a different one. This means you have to somehow crack my card, while it is still in my possession, in the very short period of time while it interfaces with your system. This is in contrast with the system in the article where a chip&pin terminal was carefully dismantled and cracked so that it could then be used to scam the cardholder.

Re:What can be done? Nothing.

[Anonymous Coward]

The problem with this is that the authorisation is broken by design, all you have to do is fake the unencrypted "pin number you entered is correct" reply the card gives the terminal and you can pay without knowing the pin number. See for example http://www.lightbluetouchpaper.org/2010/02/11/chip-and-pin-is-broken/

Re:What can be done? Nothing.

[glodime]

So, it's easier for the banks to be responsible for analyzing EVERYBODY'S transactions, which are complete black boxes to them?

Or, is it easier for us to log into our online account once or twice a week, scan our virtual checkbooks of 20(ish) transactions and say, "Yup, I remember buying all that stuff"...?

You've illustrated the cost to the bank(s) but not the total cost to the public. Without even valuing individuals time or other costs, you could simply multiply the annual cost of Quicken by the number of customers to get a number that is far less than the amount of money that a small bank would have to spend to reduce the cost of fraudulent transactions more than the increase of internalizing the cost now born on victims of bank fraud.

About that comment you linked? Interesting, and he makes a good point about identity theft

Maybe you misread the quote from Bruce Schneier that said:

The actual problem to be solved is that of fraudulent transactions.

...the costs in time, stress and hassle are entirely borne by the victims.

I'm not sure I see what liability for identity theft has to do with the efficiencies of who should be ultimately responsible for monitoring an individual's banking transactions for fraud.

Because it is the fraud that is the problem. The banks role is to enable the fraud; yet they share the cost with the ultimate victim.

Whatever happened to taking a little personal responsibility?

I'm all for personal responsibility. However, since it is the bank's and possibly the merchant's mistake for processing fraudulent transactions why should I be responsible for cleaning up their mess? Obviously, I will because it is my money (and possibly credit record), but only because I have limited recourse with the people that made the mistake.

Re:What can be done? Nothing.

[Cimexus]

There is one reason to use a debit card, at least where I live.

Some credit cards incur interest immediately (there's no interest-free period at all ... you start getting charged interest the moment the transaction occurs). Sure you could literally drive home and pay off the amount straight away, but there'd still be a cent of interest or something annoyingly hanging around at the end of the month.

In fact for most of the last decade my credit card has been that way - immediate interest incurred. Why would I choose such a card? Well, the credit cards that DO have interest free periods (usually 55 days) here also tend to have annual fees (which you incur whether you use the card or not). For the couple of times I needed to use a credit card per year, the little bit of interest I incurred (maybe $5 a year) was far far less than the annual fee would be (typically $25-100 depending on the card), assuming I paid purchases off immediately (which I always did, via internet banking).

I've now switched to a different bank that offers a card that has an interest free period AND no annual fee. But I only qualified for that card because I'm married and both of us have a good income. When I was a poor-ass student, things were different.

Re:What can be done? Nothing.

[Cimexus]

I think the problem is not necessarily the lack of a chip, but the fact that it's not compulsory to use that chip.

I'm not American (and don't live in America) so I'm not sure of the situation there. But in my country, although my debit card DOES have a chip, have a choice of magnetic swipe + sign, or using the chip and PIN number. When I use it in a store, they ask me "do you sign or PIN?" (even though all stores have the necessary equipment to use the chip/PIN).

Plus, whether the card is magnetic-only or has a chip is kinda irrelevant for online transactions. All you need is the number, expiry date and CVV number.

Re:What can be done? Nothing.

[Anonymous Coward]

Oddly enough, the service I use to get that feature is called "the bank".

Yet, I do live in europe and I do use debit cards for the past 15 years without a single problem ever affecting me.

Re:What can be done? Nothing.

[dzfoo]

+1 Funny!

I was about to post the same thing, you bastard!

        -dZ.

Re:What can be done? Nothing.

[Anonymous Coward]

I don't have to do anything!
Since I have no money they can't steal any!
Thanks a lot wall street!

Re:What can be done? Nothing.

[Anonymous Coward]

Ermmm... Excuse me, but what is the difference between debit and credit card on technical level? I just grabbed my wallet and the only difference is that credit card is embossed, which doesn't make it any safer...

Re:What can be done? Nothing.

[icebraining]

Same here.

My bank also offers me free virtual credit cards, they're great for online shopping.

Re:What can be done? Nothing.

[icebraining]

Debit cards in Portugal and Spain require a PIN for every transaction, even in shops. Shops have a little device where you swipe your card, insert your PIN in a numeric keypad, and the machine itself will call the bank and request authorization.

Here, debit cards are considered completely safe, unlike credit cards.

Re:What can be done? Nothing.

[xaxa]

In the UK the option to sign still exists, but the banks have changed their contracts so the liability for fraud rests with the merchant if the customer signed. The bank is liable if the PIN is used. No one gives an option to sign, and PIN is used unless it doesn't work for some reason. (And I assume a cinema would risk the fraud, it doesn't really cost them anything, but a jewellery shop probably wouldn't).

I don't know if the "security of debit cards" is at all relevant to non-Americans.

Re:What can be done? Nothing.

[xaxa]

AFAIIA, if you get a RFID credit card in the UK it doesn't come with a cover. It is only valid for transactions up to £10 though.

Search: PayWave OR PayPass

Re:What can be done? Nothing.

[xaxa]

It's a liability shift that they hope will fly under the radar, since, for them, it means losing less money refunding stolen funds, and making more money from the overdraft fees that result.

You're kidding yourself if you think that the banks are losing that money. They do a chargeback on the merchant.

In the UK they can't, if the PIN is valid (I'm not sure if this is a law, regulation or industry agreement).

They can if the merchant ignored problems with the PIN and accepted a signature. I'm not sure what they do for "cardholder not present" transactions (i.e. online, over the phone).

Re:What can be done? Nothing.

[DigitalDeviation]

John said it as plain as it can be. Debit cards offer 0 protection from Visa/Mastercard. I too had my card number stolen. They racked up about $1800 worth of charges. I noticed it day 1 and my bank told me they couldn't do anything util the charges fully cleared and it will take a few business days after that. Meanwhile I'm left stranded with $0. I also had an issue with the bank staff as well (@&$%# PNC). More about that issue over here. The solution is two fold: get an ATM card and a credit card. Use cash where possible and where its not, use the credit card. All major cards offer protection from this sort of issue (Discover/AMEX/VISA/MC). Do NOT link your regular bank account to Paypal. I have seen people get cleaned out that way as well. All you need is an account that has a couple bucks in it for verification. You should only use your credit card if you have to pay via Paypal. Time to retrain yourself. It has taken me some time to get used to not having a debit card with me. But it will help with budgeting your money as well. Giant mega-banks all suck. Best of luck to you.

Re:What can be done? Nothing.

[Anonymous Coward]

> a potential risk in the way Slashdot shortens the square bracket preview of long URLs

Thankfully every graphical browser shows the URL in the status bar anyway...

Since one has to move the mouse over the URL or tab onto it to activate it, why pay any attention to the Slashdot bracketing?

Re:What can be done? Nothing.

[Anonymous Coward]

"a trusted keycard device issued by the bank."

that is where the whole clever plan falls down. These things have already been broken and customers blamed by the banks for giving out their PIN as "there could be no other way for it to be taken"

Re:What can be done? Nothing.

[osgeek]

That's kind of why I bank only with the Bank of Nikolai

I sleep well at night.

Re:What can be done? Nothing.

[nahdude812]

A debit card where you transfer money into that account just before each transaction has a similar effect if your bank doesn't offer one-time cards.

Personally I have a credit union (I know not everyone is eligible to join one). When a similar thing happened to me as happened to OP, my CU refunded the missing funds the same day I filed the police report (over a certain dollar value a police report is required to file a dispute), which also happens to be the day I found out about it. I found out about it because my CU called me about suspicious activity. This was not credit card fraud prevention services (who honestly has no real motivation to really provide much in the way of fraud prevention - they get their cut either way). The transactions had already completed, once they posted to my CU, the CU is who called - specifically Linda, a kind teller who knows my name and can pull up my account even though I only see her a couple of times per year.

In the time the funds were missing, one payment did incur overdraft. My CU's overdraft is nicer than a normal bank's overdraft too - it's a line of credit, and there is no charge for dipping into that LOC, there is just an interest charge for any remaining balance 30 days later (basically if my checking account runs dry, my debit card turns into a normal credit card). Linda told me that it's possible there were other transactions working their way through (even though my card was now canceled, it can take up to 24 hours for some charges to post to the account - particularly if they are foreign in origin), and assured me that any true overdrafts (the sorts which with a charge) which might occur as a result would have their fees reversed.

So like I said, I know not everyone has a credit union as an option. But when your bank is actually watching out for your interests, there are better options out there without even needing to invent something new.

Re:What can be done? Nothing.

[Sandbags]

The bank is under legal obligation to cover faulty transactions on my Visa Debit card because they PUT IT IN MY CONTRACT with the bank. Further, the bank, and the merchants, involved in the transactions are further bound by the VISA merchant agreement, and have very specific time lines for charge backs and re-credits if a charge is disputed (by either me, or preferably by the bank saving me the trouble).

3-5 weeks is bullshit. OBVIOUS fraudulent charges should go back on your account within 24 hours. Its very easy for the bank and VISA to make that happen.

My bank goes a bit further than basic protection, not only guaranteeing availability of funds within 24 hours, but actually pro-actively checking the debits as they come in and validating them against behavioral purchase history and location data/time differences between transactions.

My last trip north, about 2 years ago, I got 2 calls from the bank on the way up, cross checking my activity. The first was that i made it about 500 miles before filling up, and it was a weekday afternoon while I'd typically be at work. They called to inquire why someone might be using my debit card 2 states away. They had pre-authorized the transaction, but asked if I wanted them to call the police and block completion of the transaction. I let them know what was going on and they cleared the transaction, and noted I was on vacation and said I'd not get another call. Had I not answered, they would have left me messages and e-mails and approved transactions until such a time as i called back, not stopping me from spending money, but keeping an eye on it, and "questionable" transactions would not be deducted from my account until I confirmed (though they would retroactively).

Later that day I got a second call.... When i inquired as to why, I was told that they called a restaurant I had apparently stopped at to inquire as to why I might have spent $70 for a dinner on a pre-authorized $35 bill. Turns out the waitress penned in a much larger tip... They called me to confirm i had not done that, which i had not, and told me police had already BEEN dispatched and that I'd not be charged at all for the transaction that had been rung.

Yes, if a bad transaction gets through, it may very well be a pain in the ass. But, it's no more or less secure than your credit card or a check book. (in fact, quite a bit less secure than checks, and people need only whats on the face of a check to make fake ones).

You should have a savings account, and only enough cash in checking for say 6 weeks of bills. You and your spouse should have separate checking accounts bound to 1 or 2 savings accounts. You should also have enough cash in savings to support your family for 2 months jobless (if not more). If you do not meet these metrics already, you are living beyond your means, and a simple inconvenience of moving money around and a few bank calls becomes a "you can't buy shit" major problem. Don;t blame the card for your own faults.

yes, it can be more secure, but not much. Yes, we can mandate better protections, and we should. Fact is, Visa's own agreements with the merchant give you fairly good protections, and give the merchant good reason not to process questionable transactions. Keeping an eye on your bank account works well too. Using a bank that offers more than the mandated-by-law $50 coverage is also completely within your power.

Re:What can be done? Nothing.

[StormReaver]

Once you have made the formal claim for a stop payment it should be resolved in a couple of days, if your bank does not support you in this, it is time to change banks.

This is the most sensible advice I've seen on this thread. When my Commerce Bank debit card details were compromised, and several unauthorized charges started appearing on my bill, I called the number of the back of my debit card to report the losses. The bank immediately reversed all the charges and offered to send me a new card through overnight delivery.

I told them to cancel my compromised card, and to send me a new one. They told me I would be without access to my funds via debit card until I activated the new one, but that it should be here within 24 hours (it was at my house in less than 12 hours). I was responsible for $0 of the unauthorized amount, and life went on normally.

Bottom line: the debit card is only as risky as the bank with which you choose to do business. Get a bank that doesn't suck, and your debit card is a safe financial instrument.

Re:What can be done? Nothing.

[StatureOfLiberty]

This is what I do. I just use an ATM card. Countless times, my bank has sent me a Visa debit card to replace my ATM card.. I always cut it up, ask them to cancel it and send me another ATM card. When I go to a branch to do this, I always get the strangest looks from the person helping me (you don't want a debit card?). I tell them every time that my mortgage check is not going to bounce because some crook captured my debit card information. I do have a debit card on a second account. But, that account never has more than $250 in it. So, I can get the benefits of a debit card and minimize my exposure if something goes wrong. The day debit cards came out, it was clear to me that I didn't want one on my main bill paying account. -- Richard

Re:What can be done? Nothing.

[Anonymous Coward]

I can tell you from having worked in retail and grocery for years, that they really aren't doing it to be rude.

It's honestly just the sorry state of American culture that we have so many people out to defraud others, without a concern at all for the person who may get fired for it.

Myself, personally, I've had people try to short-change me (constantly swap money in an effort to confuse me into giving them more than they gave me. "No can I get two tens, actually make that four fives. Okay, I'll keep these two fives and give you this fifty if you give me a twenty, and three tens.")

I've had lots of people scratch off one digit on a personal check's account#, cleverly sign their name over the missing digit, and attempt to give that to me. They're usually stolen checkbooks, but the banks don't care even if not, they won't honor the check.

I've also had lots of fake currency handed to me. The most pathetic case was the asshat who gave me a $5 bill that was xeroxed, and if you flipped the bill over, it was copied upside down.

So yeah, sorry about your experience. The thing is, our managers will fire us if we take bad money, and there are an absolutely huge number of fraudsters out there. It's also hugely embarrassing. I fell for one trick exactly one time (I was 15 and still under the impression that people were generally "good" -- hah), and I swore to never let that happen again, which made me ten times as scrutinizing as before.

Re:What can be done? Nothing.

[Anonymous Coward]

If we don't take responsibility for our own financial affairs, should we really expect the banks to carry the whole burden on our behalf?

If someone represents themselves as me to the bank, and the bank gives them money, that's not my financial affair. That's between the fraudster and the bank. If the bank attempts to hold me liable for it, they should be treated by the law with the contempt that they deserve.

If the law acted this way, then banks and credit card companies would start requiring more verification for transactions, until a new equilibrium was reached with a lower level of fraud. Under the current system, though, they have no such incentive.

Re:What can be done? Nothing.

[natehoy]

Yes, your bank account may get cleaned out (or depleted up to the daily spending limit of your debit card), and outstanding checks may bounce, and you may have a freeze on your account until it gets resolved. However, this zero liability guarantee means any transactions found to be fraudulent will be reimbursed by your bank. The bank then goes after the merchant that processed the transaction to recoup their own losses. If you have a good bank, they'll also refund your overdraft fees.

Meaning no offense, but why in the hell would this make me want a debit card?

Maybe the bank would give me back my fees and losses, but I've still bounced checks with God-knows-who and caused them all manner of hassle and had them incur fees and lost trust with them. If my bank account gets cleaned out the day before my IRS check hits, do you seriously think they'll just chuckle and say "oopsie, well, we'll clear it again". No. I'm going to spend hours on the phone with everyone I sent a check or made an automated payment to, trying to dig my way out of the hole that used to be my bank account.

I've had an account cleanout happen (account was cleaned out by lawyers suing my parents, and I stupidly left my mother's name on my bank account). My mortgage and car payment checks were in the outgoing mail the same day I received the "summons to trustee" notice, and all my money was gone. It worked out, but I had to take two days off work (lost vacation time) to make all the necessary phone calls, and I still had a black mark on my credit rating for several years afterward, even though none of the bounced checks were determined to be my fault. I worked for a bank service company at the time, and they routinely pulled credit ratings (since I handled account details on a lot of people). I had to spend a couple of hours explaining the whole situation at work, and it's possible I could have lost my job over it. Fortunately I didn't. Net result was an absolute nightmare, and my bank was actually pretty nice and helpful about the whole thing.

I also had my credit card number compromised once (Hannaford breach, and my card was actually used overseas). Visa called me, said that the card had been suspended but that any automated payments I had set up would work for another week to give me time to transition to the new card number, went through the outstanding charges over the phone to verify that they were all valid, apologized for the inconvenience, and I never even saw any of the fraudulent charges at all. I spent 15 minutes on the phone with them, 10 minutes entering the new card on my automated payments, and another 5 minutes cutting up the old card when the new one came in. Impact to my credit rating: none.

"Yes, the debit card can be almost as secure as the credit card if you use it as a credit card, and if your bank is really nice the resulting damage to your account and credit rating can be built back to almost new after a lot of effort!"

Thanks, I'll use a credit card. If it gets used fraudulently, the onus is on the credit card company to help me out, because my money is not gone. A credit card does not have access to my checking account. That's a very important distinction to me.

Re:What can be done? Nothing.

[jonbryce]

It is the same in Britain, but a lot of the chip & pin pads get replaced by fraudsters posing as bank technicians, and they have the ability to copy the details of the card, keylog the pins and send them via an internal gsm modem to the fraudster.

Re:What can be done? Nothing.

[BVis]

Unless your name is Glenn Beck, you won't reach this one. Don't waste the effort.

Re:What can be done? Nothing.

[Anonymous Coward]

Minor issue/addition with what you are saying. While Visa may not be prescribing better security measures, they are supporting them and companies issuing Visa debit cards ARE. Specifically, chipped cards that tie to HSMs. I work for a company that processes transactions for multiple associations (Visa, MC, Amex, etc) and we just turned up support for the chipped cards on our HSMs to support where our customers what to go. Most, if not all, of the other transactions for non-chipped cards also hit the HSMs in the authorization process.

Cheers

Re:What can be done? Nothing.

[archmcd]

And then you pay your credit card company with a ... CHECK!? That's the least secure payment method of them all!

The point is be as conscientious about access to your funds as you can possibly be. I'm certainly not trying to sell you on Debit Cards, so I am sorry if I came off that way. There is a false sense of security in assuming any one method of payment is more secure than others. Check Cards, ATM cards, checking accounts and even cash all have their associated risks, and no matter how secure you feel, your money is exposed somehow. And thanks to fees and the liability structure we have in the United States (other nations have figured this out somewhat - smartcards), there's no rush to change things. Trust me, if your bank were liable for fraudulent charges, you'd already have a smartcard in your hand with 3 factor authentication (card, PIN and fingerprint), but as long as they can recover their losses from the merchants, and Visa continues to get their merchant fees from those fraudulent transactions, and banks continue to charge NSF fees, they are in no rush to make your money secure. Everyone in control of the payment systems profit from fraud, and that's a fact.

Re:What can be done? Nothing.

[MarkGriz]

Meaning no offense, but why in the hell would this make me want a debit card?

Mod this up. Why anybody would use a debit card instead of a credit card is beyond me. I've heard people argue that they'd rather use a debit card so they don't get into credit trouble.
If you have the money in your checking account, just use it to pay the credit card off at the end of the month. You wouldn't use a debit card to buy more than you can afford, so how is it any different with a credit card.

Credit cards give you the advantage of excellent fraud protection (ok, maybe you are screwed out of $50 max), you get a 25 day float of your money, and in most cases earn rewards of some type or even cash back with the credit card.

Re:What can be done? Nothing.

[Yamata no Orochi]

Except you can see the target of a hyperlink in most browser's status bar at the bottom. The brackets are for citation alone, basically.

Re:What can be done? Nothing.

[SparkEE]

Does anyone really rely on what's in the square brackets or tooltip window? In most browsers (The three I use anyway) hovering over a link displays the URL in the status bar.

Re:What can be done? Nothing.

[Anonymous Coward]

Here, my account number is 123456789012 and my pin is hunter2, but it will just look like a bunch of stars to you.

Re:What can be done? Nothing.

[jeremymooer]

Smart cards would be AWESOME. They've had them in France for flippin' 15+ years. But Noooo -- short term profits are more important than long term gains (that would benefit both banks and banks' clientelle).

Re:What can be done? Nothing.

[mcgrew]

If you want a more achievable answer in today's plastic world, DO NOT CARRY DEBIT CARDS. Debit cards do not offer you protection against loss. Credit cards are limited by U.S. law to a maximum of $50 liability to the cardholder. Debit cards losses are usually covered by the bank, but they are under no legal obligation to do so.

I had my debit card and some checks stolen a few years ago; the thief had watched me punch in the PIN, so she was able to use the card. When I discovered the card missing I went to the bank and reviewed transactions, and there had been checks that were obviously forged; the signature was nothing like my own. The bank made good on the checks, but not the debit card transactions under the premise that if you know my PIN you're authorized to take all my money. I wound up losing a couple thousand dollars.

Needless to say, I no longer use debit cards.

Re:What can be done? Nothing.

[Simulant]

Debit cards losses are usually covered by the bank, but they are under no legal obligation to do so.

My debit card #s have been stolen & misused twice. In the first case, the bank noticed before I did and called me about it. In both cases, my money was returned/reimbursed by the bank with very minimal hassle and within a few weeks. I am no fan of big banks, but I can live with this. Just don't keep all your money in the same account and you should be able to weather most debit card losses.

Re:What can be done? Nothing.

[tarius8105]

Thats what I pretty much do. Most of my money gets moved into a savings account that is not linked. I make sure that my bills are paid through an account that I do not carry the debit card regularly. That account is fed by direct deposit. I keep the card so as needed if I have to go to the bank to do some sort of transaction, which having the card is easier than remembering account numbers (since BAC and Citi use debit cards for transactions at tellers).

It's a little over kill but I havent had a problem yet.

Re:What can be done? Nothing.

[Foolicious]

Will probably get modded down for suggesting such an anti-tech idea as using cash, but oh well. Karma is overrated anyway.

If Karma is overrated, why did you try to preempt getting modded down by making this statement? I hate when people do this. Please stop doing this. You made a fairly insightful post. Don't wreck it by using the "I'll probably get modded down..." thing.

Re:What can be done? Nothing.

[pmcc]

Two words: Credit Union.

Traditional banks find all sorts of ways to fuck you with fees, interest rates, interest accrual periods, minimum balances, inactivity penalties, and all that nonsense, and then on top of that, they're very picky (these days) about who gets the pleasure of being fucked by their credit cards.

My credit union has no fees, no minimum balances, no inactivity penalties, low (relatively) interest rates, high spending limits, and a very wide non-accrual period on new charges (something like 45+ days depending on how the billing cycle falls). And my credit union is not at all unique in this regard.

Shop around for a credit union and drop your Bank of America, Wells Fargo, Chase, or whatever account. It'll be the best financial decision you've ever made.

Re:What can be done? Nothing.

[eth1]

I have my credit card through a smallish credit union. They don't handle card themselves, they outsource it (to FIA, in this case).

They don't need to profile individual usage patterns, for the most part, because fraudulent use tends to fall into easily recognizable patterns, so they can just look for that.

In fact, they can detect it so quickly, that my cell phone rings less than 20 seconds after they swipe the card, and I'm (or they're) still at the POS.

Re:What can be done? Nothing.

[adonoman]

Given that I have 0 liablility on my credit card, (a no-fee card that pays me back 1% of every purchase) I almost never have any cash on me. If I lose my wallet / get mugged, I just call can cancel the card and get a replacement in two days. I've lost my wallet twice in the last 10 years - the second time I had someone use my credit card before I noticed it was gone and had it canceled. It took less than 5 minutes for me to cancel the card and get the excess charges refunded - they asked me when the last time I used the card was, listed off a couple of new charges that weren't me, I told them those weren't me, they said "Ok" and sent me a new card. My debit card is protected by a PIN so I've never had that used by anyone, but otherwise, it's the same process.

Re:What can be done? Nothing.

[siride]

You have time to write a Slashdot comment, but you don't have time to log in to your bank's website for a few minutes once a week and look over recent transactions?

Re:What can be done? Nothing.

[TheCarp]

Actually, I have used a few hundreds recently, and never had anyone give me a second look.

My wife works at a cash register sales/service company. Amusingly, many people wanted to reprogram their registers for the new hiked sales tax rate here, before the official deadline. This lead to many heated conversations about how "You can't do that, its not legal". Now, apparently, they seem to get many requests for new registers.... without cash drawers.

When asked why, increasingly the response is "We don't plan to accept cash, plastic only". Of course, this leads to more explanations about how you can't have a store front business and not accept cash. Interestingly, it doesn't seem to be the immigrant store owners who want to not accept cash, it seems to mostly be the people who are actually from here that want to do it.

-Steve

Re:What can be done? Nothing.

[hesaigo999ca]

Or....!
Here is what I do, with so far no problems, and even when someone has clones my card, i end up being ok anyways, with a few days to get a new card, usually a few hours if a branch is open...

I have 1 account checking (savings can do) which is associated to my atm card
I have one account line of credit(any other will do), second account which is NOT associated to my atm card
I have 1 credit card emergencies, but very small amount as limit on card, in case fraud, easily recoverable
in case someone gets number and visa wants to be biatchy...

In most cases i keep enough money in my checking for a purchase, if i need i call it in with my phone banking to transfer from one to another, then i have enough for a transaction, if any clone happens, they notify me, as they see it, and i end up using my cc in the mean time until i get my new atm card, as they cancel your card for you without waiting.

I so far have yet to get nabbed (knock on wood) with any fraud or scams in this nature, i even change my cc every 5 transactions in case, as i do sometimes us it on the web....or restaurants with shady characters, so on the safe side, it's all good.

Re:What can be done? Nothing.

[adonoman]

My credit card gives me 1% every time I use it, and my bank charges me for each debit card use after 25 uses. Having 1% back on cycling debt adds up real fast, and cycling through debt (always paying it off in time) pumps up your credit rating.

Re:What can be done? Nothing.

[pnutjam]

wow my password is ******* also!

Re:What can be done? Nothing.

[Heian-794]

Thanks, that's good to know, but I still won't carry a debit card. I'm not in the habit of checking my bank balance daily to see if someone's been stealing from me.

For these laughable "protections", I'd be far better off keeping my money under my mattress. It seems to me it should be 100% of the job of the bank to keep my money safe and secure.

Check anyway; your bank could be the one stealing from you. I had a nice stash of money at a certain big American bank (whose name I won't reveal, but it alludes to that location), and they once charged me an $18 account maintenance fee out of the blue for no reason at all. (The account had to have over $5k to avoid such a fee, and at no time did my balance ever drop below that.)

Keep in mind that at today's interest rates, on a $10k balance, that was about a year's worth of interest.

I discovered this two months after it occurred, and they basically said, "too bad; we took your money and you're not getting it back". Seems they want you checking your balance regularly even though the whole point of a savings account is to keep your money there and not manage it daily.

My mattress is looking safer and safer!

Re:What can be done? Nothing.

[Anonymous Coward]

There are cheaper prepaid debit cards, and you can still use Green Dot if you like. Check out upsidecard.com

Re:What can be done? Nothing.

[Anonymous Coward]

it seems a necessity that we are able to make purchases online

From the context, it looks like you mean "a necessity that we BE able to make purchases online". Please, learn about the difference between the indicative and the infinitive - the meanings are very different.

Re:What can be done? Nothing.

[natehoy]

No. I pay my credit card company with an ACH transaction. I log on to my credit union's web site and authorize transfer of the funds every month. No paper checks, and the only people who have access to that information are my credit union and my credit card company.

And the only account authorized for ACH and checks is one I keep a limited amount of funds in. So even if my checking account was compromised, they could only take what I had deposited in it to cover the bills outstanding against it at the moment.

Plus, even if I did pay them with a check, that's one transaction per month I am taking a risk with. I pay for nearly everything with my credit cards, so I am using them multiple times PER DAY with various and sundry vendors.

I'd rather have my bank account with my real money exposed for one transaction per month than many. And even that is a "front" account with little funds in it.

In other words, I use the technique most people here espouse to make debit cards more secure - keep only a small amount exposed to the card.. except I use that as a SECOND layer of defense, not a primary one.

Credit cards may not be absolutely secure, but in terms of their ability to drain my actual money from my actual accounts, they are as close as we're gonna get.

If someone uses my credit card for fraud, I may have an uncomfortable time with the one creditor (my credit card company), but my cash in my bank/credit union accounts cannot be compromised by that. That means that any other payments I might make are unaffected by the fraud, my checks clear, and all of the people I am honestly paying will get paid.

To me, debit cards represent the worst of all possible worlds. I am exposing my actual bank account in each transaction, I am not receiving any float on my funds, I am not receiving any cashback or awards for my purchases, and the vendor I am doing business with is still paying a transaction fee.

For someone disciplined enough to pay off a credit card every month, I have yet to hear of any benefit to using a debit card. There are lots of disadvantages, and not a single advantage I've ever heard of.

Re:What can be done? Nothing.

[Rastl]

The problem is, counterfiting is likely as easy as Visa/Debit fraud. So when you start paying cash for things, you're made to feel like a bloody criminal - they look at you a few times too often, scan the bills under UV light and yadd yada.

Fight back. Get yourself one of the pens they use to check money (they're legal) and whenever they hand you back money to the same thing to them. It's quite amusing to see their faces when you check the money. Honestly it's not just being a dick - you're on the hook if you get a counterfeit bill and you can't pass it along if you know it's counterfeit. *

* You're also supposed to turn it into Secret Service and then you can claim it on your taxes as a loss. Oo. Regardless you're out the money if someone passes you a dud bill.

Re:What can be done? Nothing.

[2obvious4u]

Not an issue in chrome. When you mouse over the full URL is displayed in the bottom corner of the browser, this keeps you from getting pwned if you pay attention.

Re:What can be done? Nothing.

[TheSpoom]

Sure, which is why I said that the liability has to be on the banks in case your PIN is stolen. There's absolutely no way to be fully secure with that, and if everything is standardized on one system (i.e. chip-and-PIN), one successful attack spreads the vulnerability to everyone with that card. Not so with externally verified PINs.

Re:What can be done? Nothing.

[Rastl]

Exactly. Why anyone would use a debit card is beyond me. Get a credit card and learn to manage your finances and you'll never have a problem (or if you, federal law will be on your side).

Because my ex could never understand when I told him "Use it as a damn credit card. Sign your name! Get the protection of buying with a credit card!"

He just couldn't fathom that it was better to do the extra work of signing his name than to punch in a PIN. Then again he also couldn't seem to grasp the idea of "live within your income and don't spend more than is in your bank account" either. Yet another reason he's an ex.

Re:What can be done? Nothing.

[Anonymous Coward]

Except that pinging it and saving the stores, and the lcoations in those sotres gives an accurate location based database. I'm not sure I am in favor of that.

Re:What can be done? Nothing.

[__aajxxt5654]

In europe we have been using Pin Based Transactions (PBT) for debit cards since decades both at ATM's and at POS's.
First with magstripe and since a couple of years only through CHIP cards (with contact and not contactless).

The problem is that card companies in the US finds the cost to equip all merchants with CHIP capable terminals more expensive than to pay for the fraud risk.

So, go to your bank and ask for your money back, it is their lack of pushing payments schemes to go for CHIP & PIN in the US that is exposing all US based cardholders to such kind of fraud.

Re:What can be done? Nothing.

[TooMuchToDo]

I pay credit for everything I can. Absolutely everything. I have no shame whipping out a credit card for a $3 purchase if the merchant will accept it. Why should I care?

Because those fees get passed along to you as higher prices for the goods/services you're purchasing. You think merchants are going to eat the cost? Hell no. It's built into the price.

Re:What can be done? Nothing.

[qwijibo]

If only there were some common device that people just carried with them which could display short text messages and have a number pad or keyboard for a simple response. Perhaps something that could be used for more than just payment authentication so people wouldn't leave it at home.

The technology already exists to solve the problem. Creating applications for a wide variety of mobile phones exists today. However, fraud is not a technical problem, it is a political one. Fraud is political capital. The losses (real, imaginary and potential) are used as justification for the fees and high interest rates.

Re:What can be done? Nothing.

[BobMcD]

Open a second account under the same account number with no card access, in Australia most banks call this a "special savings account" and a few even have a high rate of interest on it. Keep all of your money in this one account, only keep $50 to $100 on the card for emergencies. Use internet banking to transfer between the two accounts.

This is damn good card security as they cant take money if there is none on the card...

Wouldn't the bank just hit you with a ton of overdraft fees?

Re:What can be done? Nothing.

[xero314]

people who have a job flipping burgers have no incentive to move up

Two things to say about that. First we need burger flippers, if we didn't need them we wouldn't have them, but people need to eat. That being said anyone capable of a different lie of work would probably chose it. I don't know about you but I know I would rather do what I do than flip burgers (thought I wouldn't mind pumping gas for a living.

No-one has any incentive to do anything other than the bare minimum to not get marooned, and greed is currently the only really feasible leverage

As much as I believe there are plenty of other positive motivators, besides greed, I don't believe that greed would be taken out of the equation. If there are ten widgets in the world and twenty people want them then there is motivation to make ten more (assuming there is no other viable way to share them). People will still want faster computers, and faster cars, and bigger this and smaller that. The fact that we wouldn't need to exchange money for these resources does not make them any less valuable.

I would recommend you look at the history of countries like Cuba...

I can imagine that any country that has limited natural resources that is the victim of major international sanctions might have some difficulty. And violent human rights violations by the government tends to be difficult of the people of a country. I fail to see what any of that has to do with the removal of monetary need, since cuba has maintained a monetary system for it's entire existence, or the supplying of basic needs to all productive (yes I'm clarifying my original statement) people.

Trust me, what I am suggesting, and has been suggested by others before me, has never been tried. It hasn't been tried because it confuses most people, but that doesn't make it any less viable.

Re:What can be done? Nothing.

[mcgrew]

But, in today's world, it seems a necessity that we are able to make purchases online.

I know a whole lot of people who don't have computers at all, and even though I do, the only online purchases I've made were for a Canadian domain hosting service, and that was several years ago. Yes, it seems a necesity to most of us, but not to most of them; most of them have never bought anything at all online.

Re:What can be done? Nothing.

[ivogan]

I would think such small institutions have a staff on the order of a couple of hundred people, at best?

Speaking from first hand knowledge and experience, a customer base of 10,000 would probably be served by 50-60 employees, tops.

Re:What can be done? Nothing.

[ajlisows]

I've posted this before, but what I do for online purchases is use a Prepaid Debit Card by Netspend. When I want to buy something online I stop at the gas station, load the card with the amount of money I need, go straight home and make the purchase. I'll usually keep $30-$40 on it for small impulse purchases. If my card is compromised and they get my $30....whatever. I'm out $30 and I go get a different prepaid card.

It does cost $3 to load the card so I do end up paying a bit more for purchases but to never have my bank account emptied by hackers, get double charged by a company, or get hit with hundreds of dollars worth of overdraft fees. For me paying the fee is worth it.

Note: Netspend also allows you to create "Virtual" cards for online use.

Re:What can be done? Nothing.

[djdanlib]

One thing to be aware of... If you're doing an in-store merchandise pickup, they will normally want to see your card when you pick it up - for verification of your identity, and their computer systems generally require them to swipe the card. The programmers of said system were lazy enough to make that the only verification method, and the salespeople can't change it. Not the best way to do it, but it will save you a lot of hassle if you DON'T use a one-time number for these particular online transactions.

Disclaimer: I used to work in a store. These one-time numbers caused us endless headaches and hassles because customers would get downright nasty when we simple and unempowered salespeople would have to jump through all these ridiculous hoops (return, refund, repurchase) to make our system handle them. This would take half an hour or so, while the customer did this to "save time"... so just use your actual card number for in-store pickups, or call the store to confirm merchandise availability, have them hold it for you, and buy it at the store.

tl;dr if you need to verify your identity as the purchaser at a later date, especially with physical evidence, don't use one-time numbers.

Re:What can be done? Nothing.

[failedlogic]

It think in Canada (where I reside) and the US, there are a large amount of counterfeit 100's floating around in circulation. That's the reason you're having a hard time using them. That and, if you go to buy a $20 book with a $100, with the popularity of debit now, most retailers don't carry that kind of change anymore.

Canada is supposed to go the polymer/plastic bill route since its seen as the higher(st) security bill anywhere.

Re:What can be done? Nothing.

[colinnwn]

Wow, sounds like they did a crappy implementation over there.

In a properly implemented system, the card would offer up a rolling encrypted account number to the device to send to the bank, so even if they captured your pin, they couldn't use it, because if they tried to supply the same encrypted card number to the bank, it would no longer be the correct account.

But on top of that, when a properly authorized device sends the correct account number to the bank, the bank should reply with a unique and pre-negotiated encrypted passphrase that must be correct before you enter your pin.

So the device would receive the encrypted passphrase, send it to the card that decrypts it using its onboard chip, then sends the plaintext passphrase to the device to display.

You'd see "Bootylicious - Enter your PIN" and enter it. But if you saw "Poopypants - Enter your PIN" you'd know the device was fraudulent and you could cancel the transaction without providing your PIN.

Re:What can be done? Nothing.

[JWSmythe]

    That's a GreenDot card too. :) That's good to know about though, I'll read through their pricing and add one to my collection.

Re:What can be done? Nothing.

[RJFerret]

For ATM access, most banks will honor your request for an ATM-only card instead of accepting their default ATM/Debit card.

An ATM-only card means you will have to use ATMs more frequently, thereby potentially exposing yourself to skimmers, as well as use of your PIN in public. Since there's no zero-liability coverage with most banks for skimmed ATM transactions, you're putting your money at greater risk by doing this. Oh, and by the way, the skimmers have this one figured out too. You no longer have to worry about the shady looking person loitering near the ATM watching you enter your PIN. They install a tiny camera painted to match the fascia of the ATM, and they aim it at the keypad.

I'm an ATM-only card user. I can't tell you how many people I've watched at a checkout use a debit card and punch in their PIN with the entire line of people watching, as well as who knows what cameras.

At an ATM, I block views with my body and cover my PIN entering hand with the deposit envelope or my wallet. I suppose an infrared camera might get around the former?

Why would I be going to an ATM more frequently? If you are you suggesting I'd have more things to deposit--that would be great! (But I'd still only go once a week at most, I tend to accumulate low amounts and deposit them all at once.)

In your first paragraph that I didn't quote, there were a fair number of contingencies. I don't want to use anything that offers, "Yes, your bank account may get cleaned out"... ..."until it gets resolved"... ..."if you have a good bank"... ..."refund overdraft fees".

As other replies to this pointed out, there's little motivation for a financial institution to rectify the problem when they are profiting by charging fees for the transactions. With a credit card, I'm not out any money at all, I'm not charged fees on top of the woes, and the financial institution has entire departments proactively working to prevent fraud since it impacts their bottom line.

You didn't mention that banks tend to charge flat fees for debit cards used with a PIN while they charge the merchant a percentage fee for debit card usage via signature--hence they promote and encourage the later use.

There's also the "wrong hands" issue. If a debit card/number falls into the wrong hands, they can use it. If my atm card/number falls into the wrong hands, they can't use it (without gaining further information).

My subjective evaluation based upon research, experience and comments here:
Debit card: high risk, high loss, high life impact = horrible
ATM card: lower risk, high loss, high life impact = manageable
Credit card: low risk, almost no loss, low life impact = useful

Re:What can be done? Nothing.

[godefroi]

Same thing happened to me that happened to the submitter... my account was suddenly short several hundred dollars one day, and when I looked, there had been two withdrawls at an ATM in my city.

I headed to the bank, they voided all my account-related stuff (cards, checks, number, etc, they call it a "level change" for some reason), and the money went back into my account in a day or two while they investigated.

If your bank sucks worse than this, get a new bank.

Re:What can be done? Nothing.

[b93950]

I suggest everyone reading this with a debit card transfer all of their money to my account. I do not have a debit card so it will be free from this sort of attack.

Hello Sir, I currently have over 3000000$(3 million) US dollars in account from my late uncle (Nigerian Royalty). If I could, please, to be put this inheritance in your account for 1 month to avoid Nigerian Tax Liability, I would gladly pay 10 percent to you in 1 month time. Please to send me your account number as offered and PIN. I will deposit funds forthrightly. Thank you God Bless! Kindest regards, Eeaye Eeayeou

LOL, so you're that guy sending me mail every hour..ha-ha

Re:What can be done? Nothing.

[Anonymous Coward]

Agreed. I work for a medium sized regional bank in central Illinois, and if a customer comes to us and says they did not authorize a charge on their debit card, we file the paperwork, and their account is credited the next day. Their card is blocked, of course, and a new one ordered.

Fraud protections are another big thing here. If our card processor sees suspicious activity, they block the card IMMEDIATELY, and call the customer to confirm the transactions. Lots of fraudsters try a transaction for a couple of dollars, then if that works, they clean you out, so it's good to block it (if possible) after the first try.

(Posting as AC cause I don't have a /. account.)

-Ben from Illinois

Re:What can be done? Nothing.

[Golddess]

My debit card is protected by a PIN so I've never had that used by anyone

Is your debit card also one which you can use like a credit card (and thus avoids the requirement of entering a pin in order to use)?

Re:What can be done? Nothing.

[Fjandr]

Not to mention that typical overdraft fees at credit unions are vastly lower than at most banks. Like half or better lower.

There are lots of ways to protect yourself from bank fees. It just requires some searching and a bit of research for those not already familiar. People who get screwed typically get screwed because they don't know any better and have never done anything about the fact that they don't know any better.

Re:What can be done? Nothing.

[Kiaser Zohsay]

Same thing happens in the US.

http://www.schneier.com/blog/archives/2010/02/another_debit_c.html

Never, never, EVER punch your PIN into a pad that is not attached to an ATM machine that is owned by your financial institution. And even then, pay close attention.

http://www.krebsonsecurity.com/2010/03/would-you-have-spotted-this-atm-fraud/

Cash is looking better all the time.

Re:What can be done? Nothing.

[adonoman]

No, I think that's a US thing only. My debit card can only be used with a PIN.

Re:What can be done? Nothing.

[mattack2]

Why not pay the bills with a credit card, to get the cash back? (or other rewards)

Using a credit card is *cheaper* than using cash, because of cash back. I pay as much as I can with credit cards, and autopay every month. So it's more convenient *and* cheaper. Plus, by law (in the US), there is a $50 risk to the cardholder, and as others have noted, the actual risk is usually $0 to the cardholder. AFAIK, those same limits don't hold for debit cards as they deduct straight from your bank acct.

(I don't use a debit card. The few times my bank has sent me an ATM card with a credit card logo, I cut it up and call them up have them keep my old logo-less card working. I think they finally set something on my acct, since IIRC I haven't gotten a new logoed ATM card for a few years.)

Re:What can be done? Nothing.

[Anonymous Coward]

You talk as though this is some theoretical scenario, but this is pretty much exactly how it's been in the UK since 2005.

Re:What can be done? Nothing.

[Hortensia Patel]

Thanks for the informative post.

Are you able to shed any light on the liability situation re the recently introduced Verified by Visa and Mastercard's equivalent ClickSafe? My bank seems to be pushing this quite hard, and it's sending my paranoia off the charts. As far as I can make out, the CC company persuades merchants to participate by removing their liability for fraudulent cardholder-not-present transactions, and my strong suspicion is that they're going to use it as a pretext for pushing liability all the way back to the consumer.

The scheme itself appears to be almost worthless, offering some protection against stolen cards but none whatsoever against black-hat websites (or keyloggers and the like), and I haven't been able to get anything remotely resembling a straight answer from the bank.

Re:What can be done? Nothing.

[Anonymous Coward]

Interestingly enough, your post highlights a potential risk in the way Slashdot shortens the square bracket preview of long URLs. Example of what I mean [securebank...online.com]

Haha, FAIL! Your "risky" link returns "Server not found".

Re:What can be done? Nothing.

[plover]

Unfortunately, cell phones that exist today won't work for this. The security has to come from an offline device, one that can't be modified by the user or by a network application. Otherwise, Trojan horses, keyboard monitors, or other malware will become the new avenue of attack.

You could build the card interface device into a mobile phone's shell, but it would need an independent display, keyboard, and chip reader, one the user could trust not to be modified by phone or network updates.

And I'll tell you right now from long experience dealing with people in similar situations that if you give them such a device, they'll demand the next generation of devices will integrate the chip's display and keyboard with the phone. People will say "oh, it's safe." They'll forget or ignore the security reasons for the separation. And not long after that there'll be a rash of phone malware that will persist for many years.

Re:What can be done? Nothing.

[mjwx]

Wouldn't the bank just hit you with a ton of overdraft fees?

What for? Aaving accounts in Australia do not permit overdraft?

Re:What can be done? Nothing.

[Throtex]

When I was a student, I had a card with a grace period and no annual fee. As another poster said, it was through a credit union. It had a $500 credit limit that drove me insane because they wouldn't clear pre-auths in a timely manner (meaning I could, under certain circumstances, only have a limit of $250!). But for a student, it was fine.

So yes, I suppose the one reason to use a debit card is if you can't get a *real* credit card, but that wasn't really my point :P

Re:What can be done? Nothing.

[Throtex]

As I said, "Sure, you're paying for it because the merchant builds the card fees into the price of whatever you're buying, but by and large paying cash won't get you a better rate these days."

So, whether you pay cash or credit/debit (both have merchant fees), you won't save a penny. Us credit users are driving up the costs for everyone, sure, but barring some concerted effort, it's better for me to just enjoy the perks rather than "do my part" to keep prices down.

To wit, you say "those fees get passed along to you," I say they get passed along to everyone. Most merchants don't (or can't because of their merchant agreement with the card companies) price discriminate based on cash/credit.

Re:What can be done? Nothing.

[qwijibo]

The problem with promoting an ideal solution involving special hardware and digital signatures is adoption. Most consumers do not want to pay for security, which means it would require a solution that has to be funded by people who are in business, and therefore unwilling to incur an unnecessary expense. Until the vast majority of merchants use better security, there's little incentive for anyone to convert. And profits will prevent companies like Visa from telling merchants to convert to get out.

Interactive communication with the customer, even if it has fundamental flaws, is a vast improvement over the current system. The key to adoption is minimizing the arguments against a new technology (like cost) while focusing on its benefits.

The malware you're concerned with would be targeting individuals to get their keys, which means each individual would have input on their security. That would be a lot better than the current system where shared secrets can be exploited by every single entity you share those secrets with. I agree that using cell phones is lame, but history shows us that using the best solution as an argument for not implementing a better solution guarantees that the status quo will not change.

I've had the same security desires out of financial institutions for the last 20 years, but in that time I've seen very little progress because nobody wants to support incremental improvements. The only improvement I've seen in that time is one time use card #'s, while the number of ways to exploit the fundamental existing problems has grown substantially.

Re:What can be done? Nothing.

[nacturation]

Of course. However, imagine a popular long domain gets frequently cited on Slashdot. Over time, people see the domain in brackets and get accustomed to it and may click on the link without checking the status bar when rolling over the link. Keep in mind that many security flaws rely on human laziness and the fact that things aren't always checked. For domain previews in the square brackets, Slashdot will always show at least 10 characters. What's the harm in always showing the full domain name?

Re:What can be done? Nothing.

[kiddygrinder]

Two things to say about that. First we need burger flippers, if we didn't need them we wouldn't have them, but people need to eat. That being said anyone capable of a different lie of work would probably chose it. I don't know about you but I know I would rather do what I do than flip burgers (thought I wouldn't mind pumping gas for a living.

I think you just agreed with me there, i would definitely have a crack at flipping burgers rather than my current programming job if the money was the same, and i can think of a lot of other less stressful jobs that would make my quality of life better if i didn't need to pay off a mortgage

People will still want faster computers, and faster cars, and bigger this and smaller that. The fact that we wouldn't need to exchange money for these resources does not make them any less valuable.

How do you decide who gets bigger this or that? If it's just those with better jobs isn't that just less defined version of money?

I'll give you Cuba :)

Trust me, what I am suggesting, and has been suggested by others before me, has never been tried. It hasn't been tried because it confuses most people, but that doesn't make it any less viable

To be honest i'm not really sure what it is that you're suggesting, sure we don't need money but it's a good enough carrot. You've suggested a stick might work instead but tbh i don't think you can get that far punishing people for not being good enough people.

Re:What can be done? Nothing.

[plover]

The idea of using cryptography external to the network carrying it is an incremental approach. By placing the security on the smart cards and in the banks removes the need for all the intermediate parties to do anything specific with respect to security.

Right now there are six million merchants who accept Visa. The bad guys have shown they can exploit any of them who are not secure. If we move that responsibility for security into tamper resistant chips and HSMs owned and issued by a few thousand banks, we've reduced the footprint to a set of organizations who specialize in security (and to the small handful of vendors providing solutions.)

If we relax the requirements for hardware tamper resistance at the user's end (via implementing the PIN pads as software on cell phones), every attack will change focus to the weak link. There are literally billions of cell phones in use, with tens of thousands of models of phones and hundreds of thousands of revisions for software for them. The software is written by people wanting to provide cool features, and not by security experts. Can you count on every phone to be secure, always?

If we move to a cell phone based model, it will be a huge expense and will create a set of expectations in the users, just as they have been trained in the convenience of mag stripes today. If we get one or two years into the full deployment and the hackers figure out how to get users to install Trojan Horse PIN pad apps anyway, (via viruses, worms, whatever) then the world will be no better off than they are today. Except, we will have shown them all through our actions that "we spent a ton of money and did it wrong again anyway!"

We have to take all the lessons of the past, including weaknesses in social engineering, EMV protocols, smart card chip design, exploitable differences between old and new protocols, and build a new solution that addresses them all. And we have to do it right the first time, because we won't get a second chance.

Re:What can be done? Nothing.

[xero314]

How do you decide who gets bigger this or that? If it's just those with better jobs isn't that just less defined version of money?

The answer is that everyone gets the benefit. The person that comes up with the idea gets the benefit. The person that implements the idea gets the benefit. All the people that support society so that these people can do this creative work get the benefit.

Point being that there is no reason to restrict new inventions to a select few. If it is something that will have a limited supply, then only a limited number of people can use it at a single time, but still everyone can have equal access. Then someone who would like to have more access works on a less resource intensive process so their can be more. Motivation remains, it's just that an individuals motivation happens to benefit all of society.

You've suggested a stick might work instead but tbh i don't think you can get that far punishing people for not being good enough people.

No actually I suggest nothing but a carrot. But like everything in life, one persons carrot is another person stick. The carrot is simple, you can have all your needs met and have access to all the available resources of society, and all you need to do is be reasonably productive (and yes I realize someone would have to define reasonably productive). I would think that would be a much better carrot than the current economic motivator that only provides for the needs of a very select few, and limits all other resources to an even smaller minority.

Then again, this whole thing started from one sentence, certainly not enough to define an entire ideology.

Re:What can be done? Nothing.

[xero314]

And as I already said, no country has ever been able to implement communism or even Marxism without resorting to ruthless dictatorships where the people are more in fear of their lives then wanting to participate.

I think you are confused. One can not implement Communism through dictatorships or fear. One can not a Communal Dictator. What you are referring to is the intermediate step between Capitalism and Communism, which, according to Marx, is socialism. And I'm not saying I believe in any of that, I'm just trying to set the facts straight.

It won't work unless you threaten people's lives.

If you look at it as a threat then it's certainly no more of a threat to one's life than capitalism. I see it is a benefit. You can starve in the ocean or become a productive member of society and have all your needs met. Given the choice I personally would chose to be productive. But that's no different than capitalism which says exactly the same thing. If you are not productive you will die.

Greed... basic...trait. Everything from Lions to wild dogs [are greedy].

Everything accept communal animals like ants, termites, and Meerkats (Yes I realize that those are autocratic societies, but they are also communal). But what's better is humans have a higher intellect that we can use to overcome animal instincts.

This is because their is no capitol or for some reason not enough capitol is available to market it.

You are correct, it is because there is not enough capitol available to market it. That's not to say that there is not enough capital, but instead because the capitol is controlled by a limited oligarchy. But that goes back to my original statement, that no one is looking for a cure because there is no capitol gain in a cure, but there is in keeping the country sick.

Inventions would be around, that's for sure. But being around and being used outside of the close nit of the inventor is something that wouldn't happen.

Your powers of precognition are astounding.

Re:What can be done? Nothing.

[Anonymous Coward]

I think one of the best online payment system is russian WebMoney http://www.wmtransfer.com/ it's secure, encrypted and you control all the payments. It's closest system to cache, the problem is that it's centralized and windows only.

id theft fear is overrated

[tilminator]

http://badmoneyadvice.com/2010/04/the-usefulness-of-id-theft-fear.html

Re:id theft fear is overrated

[AnonymousClown]

Interesting.

The worst I have ever heard happen to a victim of identity theft was lawsuits from collectors. After a while, they, the lawyers, figure out what has happened and go away. And it's a pain to get new credit - which I'm not so sure that's a bad thing. It does add a lot of stress to your life, though.

Re:id theft fear is overrated

[scdeimos]

The linked Bad Money Advice article makes the incorrect assumption that the consumers that are the victims in fraudulent credit card use. This is almost never the case.

Having suffered through a fraudulent purchase on my Visa card I was annoyed that the bank (read: Visa corp. behind the bank) took a full 45 business days to reverse the transaction, and I was annoyed that I had to fight with the bank to reverse the related overcharge fee (the purchase should never have been approved if it would exceed my limit) and interest charges on that fraudulent purchase, but that was only a minor inconvenience. The real victim in the transaction was the Harvard University Book Store who'd charged the original purchase - they had a chargeback on their account, so they doubly lost out on the amount of several hundred US-dollars in their bank account plus the cost of stock that they'd sold.

The banks and credit card companies don't care about fraudulent credit card use and they have no incentive to fix it. They charge the consumers interest on purchases, they charge the merchants merchant fees and they chargeback merchants whenever there's a fraudulent purchase. They are, quite literally, laughing all the way to the bank.

Re:id theft fear is overrated

[adonoman]

The HU Book Store was also the actor with the responsibility of determining if the person using the card was really you. They have the option of verifying your signature, or even asking for id. I know several stores that now require photo id if you want to use a credit card purchase of more than $100. Of course there are also several store that have decided that they're willing to accept any losses and don't even require a signature for purchases under $25. Of the three parties: you, VISA, and the merchant, the merchant has the best chance to catch something wrong, and the best chance to do something malicious if they do not bear the burden of the risk.

Get a credit card

[HeavyD14]

If it gets stolen, it's not your money. Also, you got skimmed.

Re:Get a credit card

[Anonymous Coward]

Most likely skimmed.

What's your card number and PIN so I can check.

Re:Get a credit card

[adolf]

The same fraud prevention policies apply equally to both credit and debit cards bearing the Visa or Mastercard logos, for transactions in which Visa or Mastercard is involved.

So, if you only ever use your "debit" card to perform "credit" transactions, and nobody has your PIN, you're just as well protected as you would be with an actual (debt-based) credit card.

However: Neither Visa nor Mastercard can do a damned thing if someone has your card number and your PIN, since a criminal in possession of both of these bits of information will just empty the account using debit transactions and the credit card companies simply aren't in the loop on that. In such cases, it's entirely up to your bank as to how you'll be treated.

More information from the horse's mouth is here. And still more, from that other horse, here.

Re:Get a credit card

[Anonymous Coward]

In at least some European countries, the law says that in this case money was stolen from the bank. Unless the bank can prove it was fraud on part of the client, the bank pays. Maybe that is why in those countries people seem to prefer ATM cards above credit cards.

Of course in some countries, banks very quickly said: "no more magnet strips, only chips". Unfortunately they had to keep the magnet strips for transactions abroad.

So it is possible to get better consumer protection laws. Please support the organizations or people in your country that try to make that happen.

Re:Get a credit card

[Tumbleweed]

If it gets stolen, it's not your money.

Well, yeah, not anymore, it isn't. Hence, the stealing.

Re:Get a credit card

[HeavyD14]

You missed the point, if your credit card number gets stolen, your checking account doesn't get wiped.

Re:Get a credit card

[Tumbleweed]

Most likely skimmed.
What's your card number and PIN so I can check.

Oh, awesome, service, thanks! My card # is 1234-5678-9012-3456, and my PIN is 1234 (same as my luggage, so I don't have to remember multiple numbers; I recommend this 'mnemonic device' to all my friends!).

Thanks so much, you're a real pal!

Re:Get a credit card

[adolf]

If that was the point, then yes, I did miss it because it was completely silly. The obvious to the particular problem you just described is simple: Don't put all of your eggs into one basket.

Re:Get a credit card

[Neoprofin]

I think it may also have something to do with Europe's generally different opinion of extending credit to anyone. I started receiving offers in the mail from anyone and everyone when I turned 18, my girlfriend (who is German) couldn't get a credit card with a limit over 200 Euros to save her life because she doesn't have established credit.

Re:Get a credit card

[psithurism]

If that was the point...Don't put all of your eggs into one basket.

I think the GP is trying to point out that whatever security measures may be in place. If someone steals your credit card, they rack pull out your limit worth of debt with your credit company. You inform the company and they say, "Oh shit! Someone stole our money!" They go after the thief while you get a new credit card and move on with life.

On the other hand, some one steals your debit card and cleans out your account, depending on your bank they may say, "Oh my! We'll refund you immediately," but usually they actually say, "sorry about your loss, we'll see when we can get around to sorting that out," as they did to the OP.

I've seen both happen to friends and hence why I choose to use a credit card over a debit card. My credit rating may take a hit if someone steals my lending agencies money, but my bank account will be fine.

Re:Get a credit card

[Citizen of Earth]

Also, you got skimmed.

I saw a news show recently reporting that lots of crooks have been breaking in to stores to steal the hard drives out of the cash registers. Lots of the registers store your debit/credit card information unencrypted and criminals can recover and use tit. One more reason I always use cash for minor purchases.

Re:Get a credit card

[scdeimos]

A lot of the audit rolls in cash registers also record card numbers. And yet business is heard to say, "we only store card numbers in encrypted data marts." My ass.

Re:Get a credit card

[Alarindris]

I work at a gas station part time. We just got a new computer system and I was appalled to see that when we printed off the numbers for the day, the credit/debit card numbers for each transaction are listed with the name on the card and expiration date. Although we do hold on to them for 7 years and then they are sent to the main office for another 8, it seems pretty damn sloppy to me.

Re:Get a credit card

[drsmithy]

I think it may also have something to do with Europe's generally different opinion of extending credit to anyone. I started receiving offers in the mail from anyone and everyone when I turned 18, my girlfriend (who is German) couldn't get a credit card with a limit over 200 Euros to save her life because she doesn't have established credit.

Really ? When we arrived in Switzerland a few years back, I had a credit card with a $20k limit within a couple of months of arriving (basically, a week or two after my B permit was finalised). When we recently moved to the US, however, I couldn't even borrow a measly $5k to help buy a car (worth probably 2-3x that), even though I'd been working for the same company for 5 years, earned over $100k/yr and probably would have paid it back within a month or two.

The US credit system is utterly insane.

Re:Get a credit card

[Anonymous Coward]

Lots of the registers store your debit/credit card information unencrypted and criminals can recover and use tit.

That's an interesting approach.

Re:Get a credit card

[Fredde87]

I have to agree with this poster. There is absolutely no excuse for using your debit card for anything other then cash withdrawals. There are other advantages as well, not only the fraud protection. Most cards will have a minimum of 30 days interest free on purchases so it wont cost you anything. And they will give you airmiles or cash back etc. I would learn from this experience and sign up for a credit card straight away.

Re:Get a credit card

[adonoman]

But on the other hand, by using your credit card often (and paying it off), your credit rating gets a boost.

Re:Get a credit card

[AK Marc]

If Joe robs a bank with a gun, then the bank loses money, but no individual depositor loses anything (unless the loss is so large the bank fails). But if Joe robs the bank by filling out a fraudulent withdrawal slip, then the bank has hired PR people to call that "identity theft" and blame the person whose name was on the withdrawal slip and then the bank, who was robbed by Joe, then steals from the person whose name appeared on the slip.

Never, ever, does Joe touch money from the person whose name he used on the withdrawal slip. So, tell me again how it's theft against the person whose name he used? He didn't take anything from them. The bank did, and they hired PR people to blame the theft committed by the bank on the person the bank stole from.

Use a credit card, duh

[QuantumG]

How the banks advertise it: "Use your own money to shop online!"
What it actually means: "Expose the cash you need to live on to fraud."

The banks like it because you're putting your money at risk, not theirs.

Re:Use a credit card, duh

[Anonymous Coward]

The bank makes its money loaning your money to others. Bank assets are your money! Most fees penalize account withdrawls, and interest rewards savings. Why would want you to lose the money that defines their valuation?

Re:Use a credit card, duh

[Lorien_the_first_one]

Yes, but they also know the alternative is to pay the banker interest.

Re:Use a credit card, duh

[evilviper]

The banks like it because you're putting your money at risk, not theirs.

It's their money, every bit as much as the bill on your charge card is their money.

If you put in writing that money was fraudulently withdrawn from your account, they have to give it back to you within a few days, and can only charge you a maximum of $50 if you didn't report it in a timely fashion.

At least, that's how it is in the USA. If the laws are backwards where you are, get them changed. Credit car theft used to be a life-changing experience, as individuals were held liable for fraudulent charges... The law had to be changed to protect you from credit card fraud, and similar laws were made for all other electronic transactions as well.

But from all the fools here claiming your better off with a credit card, it's sad to see how well the cynical advertising by the credit card companies has work on the unwashed masses...

just use a CREDIT card

[CohibaVancouver]

Step 1: Cut DEBIT "check" card in half
Step 2: Just use a CREDIT card. You're protected. Problem solved.

In Canada you need an ATM PIN to use a debit card linked to a bank account, but the PINs can still be skimmed by compromised payment terminals. I only pay by credit card.

Re:just use a CREDIT card

[Anonymous Coward]

This is exactly right. Credit cards have laws backing them up, along with an industry that places responsibility for fraud on the banks issuing the cards, and the vendors taking in fraudulent card transactions.

          Debit? It takes money out of your bank account. There are no legal protections. There is no regulation. The bank is not obligated to cover for fraud, they could tell you to go find the fraudster and get your money back.

          In Britain, they don't have these types of credit card laws and in fact the banks DO tell people the cards are infallible, and they owe for fraudulent transactions.

Re:just use a CREDIT card

[anarche]

What do you do when people don't compare signatures on your card/credit card slip?

Re:just use a CREDIT card

[gparent]

You file and get your money back. I've done it before.

Re:just use a CREDIT card

[ArundelCastle]

Casual debit card fraud in Canada is pretty limited. Credit cards have better protection *after* a complaint has been logged. I've heard co-workers in nearby cubicles spout out all the information on their credit card, and I may already know their home address. Within a half hour I could ship a dozen toilet seats to their house, or go on an iTunes shopping spree for myself, with only a Hotmail and an IP address log to find me. If the whole office shares an external IP, good luck tracing it to the department laptop I borrowed during coffee break. (Note: risk-management is part of my job)

These days convincing credit companies NOT to raise my credit limit is hard. If I want to limit my debit liability, I simply don't put excess cash or overdraft into the accounts linked to my card. No money, no cry.

The newsworthy cases of debit fraud involve compromised card readers or fake fronted ATMs. That is serious effort. To use debit, you have to have a card in hand. If I have your debit card number and your PIN written down, that won't even buy me a pizza. You can't use them over the phone, so a fraudster has to be well equipped by recreating fake cards, or tapping into financial networks. This is why they're adding chips to debit cards now.

For all the millions that Interac reimburses to fraud victims, it's a tiny drop in the bucket for the total amount of transactions every year in Canada. For one, banks can set daily AND transactional withdrawal limits with Interac, just as they can for their ATMs. Hard to steal 5,000 if it takes a week. Why don't we mind? Canada isn't Japan, it's unlikely the average person walking around has over a grand in cash on them. We love debit.

Businesses love debit too. Less fees than Visa in many cases. Same-as-cash, so grocery stores will gladly give you cash back. No issues with charge backs. There are much fewer Canada-wide banks, so Interac-by-email is a viable option. Think Paypal but with actual bank protections for the buyer.

I'm really not sure who decided that giving Visa the ability to create debit cards was a good idea.

Re:just use a CREDIT card

[caprid]

I agree wholeheartedly with this, and make specific instructions when opening a bank account that I do not want a debit card attached to the account. The bank sends along a good old-fashioned ATM card (no VISA logo), and I do not carry the risk of "we take the money first and you prove us wrong to get it back".

Re:just use a CREDIT card

[defaria]

Nobody checks signatures! I routinely use "I will never pay this" as my signature and they happily accept it.

Re:just use a CREDIT card

[Malc]

Actual bank security in Canada is pretty pathetic though, and I should know as I've been a victim of identity and had my bank accounts compromised, TFSA cleaned out and nearly $10,000 of RRSPs redeemed. MBNA Canada allowed somebody to change the address on the account, and requested a new card and PIN based on just knowing my DoB. HSBC Canada allowed somebody to change the record of my mother's maiden name to lock me out - that's something that doesn't change by definition! Sears Canada will issue you a credit that you can use that day in store without doing any background checks (they would have found a Fraud Victim warning if they'd called Transunion or Equifax). As will HBC and Home Depot it seems. Somebody was even bold enough to call my bank and ask for my manager by name... they were caught out because they had the wrong accent (I hadn't lost my British accent after nearly 15 years in N. America) - other banks where you don't know the account manager would have let them get away with it.

I've just moved to London (UK, not Ontario), and found bank security way higher. About every third time I use my credit card, it gets blocked and they call me. Every transaction with the bank online or the phone requires knowing random numbers from my security code. Contrast that to the process with my new ATM card mailed to me from Canada - when I called (via Skype) to setup internet banking as it uses the bank card, no security questions, but they did ask me contact details, what my new security questions should be, etc, which if my mail was compromised meant somebody could regained faudulent access to my accounts. There were times in Canada when I called banks or credit card companies and couldn't remember the info they wanted for security, and I just blagged my way through it. Pathetic.

Interac was ahead of the curve in the early 90s. It's not without problems - several times a year I'd get a call from my bank saying that my PIN was compromised and needed to go to a branch to change it. Apparently Interac terminals are frequently used fraudelently. The rest of the world has been moving to chip+pin for a decade, and it's time Canada caught up and abandoned Interac. I was asked for a PIN in India recently when I tried to use my UK credit card... Canadian merchants will still insist on a signature that they don't even bother to look at. So what if Visa offer me fraud protection... I'd rather not the time on the phone dealing with it.

Re:just use a CREDIT card

[qus123]

Seriously can anyone from the US explain what's wrong with debit cards? It seems people around the world commenting here don't get it either. Whole my life I used debit, being afraid to use credit card. The first time ever I missed it was in US. I couldn't even lend a car without it!

Re:just use a CREDIT card

[Sandbags]

The VISA transactions, through the CREDIT network, via your debit card, come with the EXACT SAME merchant and VISA guarantees as ANY OTHER CARD. Only ATM and PIN transactions are covered by your bank, the rest are 100% covered by Visa's own fraud protections, and is no less of a risk that a credit card, other than up to your daily maximum withdrawl could be mnissing from your checking account for a few days while you dispute it (in which case your savings, or cash backups, that you keep for emergencies, including the not less than 2 months salary you should be holding back in case of unemployment or other major life issue, should easily be able to cover for you...

Re:just use a CREDIT card

[Tarsir]

Isn't that arguably fraud? You're claiming you didn't authorize a transaction that you actually did authorize. I'm not trying to be snarky, it's a serious question. On a few occasions I've considered filing to get my money back, but I decided it was probably illegal :P

Re:just use a CREDIT card

[Hatta]

If it gets compromised, the money comes out of your own account. If a credit card gets compromised, the money comes from the credit card company.

Re:just use a CREDIT card

[CohibaVancouver]

I just don't know why I'd walk around all day long handing out the PIN to my mag-striped ATM card to every Tom Dick and Harry business all over town. It just seems wrong to me - So I use credit. I might revisit my policy when "chip"ed Interac cards are everywhere... Also, I earn an Aeroplan mile with every dollar on my visa card. I'm flying to Europe next month on points. What points to I get from Interac? Zip.

Re:just use a CREDIT card

[CohibaVancouver]

Seriously can anyone from the US explain what's wrong with debit cards? It seems people around the world commenting here don't get it either. Whole my life I used debit, being afraid to use credit card. The first time ever I missed it was in US. I couldn't even lend a car without it!

Businesses that in effect 'extend you credit' (i.e. provide you a service now for which you pay later) don't like debit cards. For example, if you check into a hotel and provide a credit card, the hotel has a degree of comfort that if you disappear in the night they have a better chance of getting paid. Ditto if you have a rental car and keep it an extra week, or drop it somewhere else. Debit cards don't work for them in this regard as you might empty your bank account and they'd have no means to get paid. Businesses like grocery stores don't extend you credit so they're not as concerned.

Re:just use a CREDIT card

[Anonymous Coward]

The signature isn't for verification. It's an agreement to pay. Try reading what it says by what you sign (both the card and the slip).

Re:just use a CREDIT card

[Hal The Computer]

What do you mean arguably and probably. Saying that you never bought something when you did, in order to get money is fraud.

Get a new bank

[KalvinB]

Shop around for a bank that actually values you as a customer. I believe Bank of America will give you your money back within 24 hours. I'm not a fan of theirs but at least they do that for you. I personally use US Bank.

Re:Get a new bank

[Sean5033]

This happened to me recently with B of A. I live in FL, and someone used my card in NJ. Bank of America shut my card off right after it happened, sent me an email, text message, and gave me a phone call letting me know they'd detected fraud. When I called them back, they gave me the option to turn the card back on (in case I'd jumped on a plane to NJ) or initiate a fraud investigation.

I think the fraud algorithm they use is pretty good, they found it right away. Fortunately it was only a $4.80 "test" charge. But they prevented any more money from coming out, and got the 4.80 back to me within 48 business hours.

Re:Get a new bank

[godrik]

I am not sure how it is in your country (since you do not say anything, I guess you live in the USA). I would go with get a new bank. My wallet was robbed one day. I called the phone service of my bank which is 24/7 as soon as I got that my wallet got stolen. My visa card was 'revoked' the day after.

Re:Get a new bank

[Matheus]

I've had to have transactions purged from my card a number of times... once stolen... a few times just stupid hotels double billing me 4-figure hotel bills.. and others.

Wells Fargo got me my money back immediately on claim (with restrictions) and within a week for real (once they had investigated).

No bank is perfect but for a large one I'm generally happy with the wagon.. of course don't get me started on over-draft fees :)

Re:Get a new bank

[DeadPixels]

I've had terrible experiences with Bank of America being unwilling to refund any money with clearly fraudulent charges. Had to fight for weeks to get any refund, and they were uncooperative the whole way. In the end I wound up switching to PNC and haven't had any problems with their service.

With that said, however, I think it depends entirely on what branch of each bank you're at and what call center you get routed to when trying to go up the corporate ladder. YMMV.

Re:Get a new bank

[Tumbleweed]

Same here for me with Wells Fargo, except they called me to ask if I had made certain funky-looking purchases (I had not) before I had even noticed. If you're going to go with a BigBank, Wells Fargo is the one, for sure. One of my local branches is even open until 5 or 6 on Saturdays, which is extra-special-nice.

Re:Get a new bank

[schnikies79]

I can't speak for BofA, as I use a local bank that only has three branches.

A few months ago I was on a trip to northern Michigan (i live in southern Indiana), and I ran across a good deal for a digital camera, so I bought it. About 45min later I got a phone call from a lady that works in fraud for the bank, she just wanted to make sure it was me that made the transaction.

Apparently they do this for any oddball purchases such as that.

Re:Get a new bank

[MWoody]

I have several complaints about BofA, but their handling of fraud isn't one of them. I've had my debit card stolen by Gypsies (yes, really) while in Europe, had it exposed by an online store's security compromise, had an Ebay transaction go very bad, and had it once used to buy $50 worth of gas 100 miles away where I never traced the angle of attack. In every case, I had the funds back within hours and a new card within the week.

Actually, I did have one complaint: when they stop a potentially fraudulent charge, an automated system calls YOU and asks for the last four digits of your SS to "confirm." I hung up and called the number on the card; they confirmed it was a real call and couldn't seem to understand why I thought that was insane.

But there's something else I learned about BofA recently: they're actually a number of smaller franchises pretending to be one unit. Though they appear unified, accounts are specific to your region/state/branch. I discovered this problem after moving cross country, when a bank manager very politely informed me that he could make zero changes to how my account was set up short of himself calling the same number to which I already had access. So the differing stories might be because we're actually dealing with different banks entirely.

Re:Get a new bank

[socsoc]

Discover does the same thing. A random number calling you from an automated system and asking you to call a 800 number that isn't their main number. No wonder people fall for phishing attacks via e-mail if this is how national banks act over the phone.

Re:Get a new bank

[$pace6host]

That's funny, because I dropped PNC precisely because they gave me the runaround for weeks when my card number was stolen, refusing to credit the stolen money back until they had completed their investigation. This was over a decade ago, and I ended up having to borrow money from my parents to pay my bills that month. So, I dropped PNC and went with a credit union. When a similar situation happened a few years later, the credit union refunded my money by the morning after the day I reported the fraudulent charges. But, that was a decad ago, maybe PNC got some customer focus in one of the mergers.

Re:Get a new bank

[kjart]

This happened to me recently with B of A. I live in FL, and someone used my card in NJ. Bank of America shut my card off right after it happened, sent me an email, text message, and gave me a phone call letting me know they'd detected fraud. When I called them back, they gave me the option to turn the card back on (in case I'd jumped on a plane to NJ) or initiate a fraud investigation.

I think the fraud algorithm they use is pretty good, they found it right away. Fortunately it was only a $4.80 "test" charge. But they prevented any more money from coming out, and got the 4.80 back to me within 48 business hours.

Yeah, I use CIBC (Canadian) and they seem to take similar measures. There have been probably half a dozen times over just as many years where they have temporarily disabled my card and immediately called me due to suspicious activity. In each of these case, it was (thankfully) a false positive due to me traveling at the time, but it is somewhat reassuring to know that something is watching, just in case.

Thankfully, you can also call to let them beforehand that you are out of the country so you can hopefully avoid the card being disabled when you try to pay for dinner in that fancy restaurant.

Re:Get a new bank

[Anonymous Coward]

Ive had this too, my card was skimmed when I was in Europe, and a few months later, when I was back in New Zealand, my bank called me up to say my card had been used in Europe again, and canceled the charges. I was pretty happy about it.
I also got an email from an online retailer to say they had been hacked, called my bank up and checked the charges out. They sent me a new card within a week, which was fantastic.

If there is a problem there, I'd say it was with the bank you are with. If they aren't willing to help you out with your own money, then they shouldn't have it.

Re:Get a new bank

[Anonymous Coward]

they do, and if you provide them with a number to reach you, they will call if there is strange activity to verify if you are authorized purchases.

They called me at 5am to let me know large sums were being withdrawn from gas station atms, reversed the charges and issued me a new card when i got to the bank at 9am.

they also explained any and all paperwork that would be needed to be filled to keep the charges off my account.

Re:Get a new bank

[Anonymous Coward]

Bank of America should be perfectly willing to credit your money back. After all, they'll happily deduct funds from your account through some of the highest fees I've seen and pay out horridly low interest for funds on deposit.

Not exactly a bank I'd recommend.

Re:Get a new bank

[sconeu]

Agreed about BofA. My wife's card got jacked -- two trivial transactions in WA. BofA cancelled the cards 4immediately.

My card is through my Credit Union, which treats me like a human. Some asshole jacked my card and drew about $1000 in England (where I've never been). The CU called ME and asked if I had made the transactions.

Re:Get a new bank

[Anonymous Coward]

This happened to me recently with B of A. I live in FL, and someone used my card in NJ. Bank of America shut my card off right after it happened, sent me an email, text message, and gave me a phone call letting me know they'd detected fraud. When I called them back, they gave me the option to turn the card back on (in case I'd jumped on a plane to NJ) or initiate a fraud investigation.

I think the fraud algorithm they use is pretty good, they found it right away. Fortunately it was only a $4.80 "test" charge. But they prevented any more money from coming out, and got the 4.80 back to me within 48 business hours.

Two weeks ago, almost $3000 was withdrawn from my account via ATMs around the city I live in. I never lost the card, so I figure I must have been skimmed.

I can second BofA's good policy regarding this: the money is already back in my account!

Re:Get a new bank

[laughingskeptic]

We had a Bank of America business account. We live in Austin, TX and someone in intercepted one of our two cards in transit, probably at the point of shipping and sent it to London where it was used to clean out our account. Yes BoA put all of the money back immediately, but apparently they do not have a lock-out policy on PIN tries. There were thousands of PIN tries executed by some computer in London before they got the PIN and then cleaned out the account. When I called, the person looking at the logs simply said "Oh boy, someone was sure trying hard to remember the PIN, oh ..." and then they apologized and promised the return of the money. I was absolutely shocked that there was a way to access the PIN validation system that allowed this.

Re:Get a new bank

[Anonymous Coward]

I use BofA and use my check card extensively, I would say for 85% of all financial transactions and all of my online transactions. I've had fraudulent charges on my account several times and in all cases I called BofA to report these charges. The money was put back into my account quickly, I think it was immediate, but it may have been 24 hours. They then sent me some paper work and it's all done.

I have to admit, I've always had a good experience with BofA and this is just one of the reasons why I like them. Obviously YMMV.

Re:Get a new bank

[aschlemm]

I had to get a new debit card a few years ago as someone got a hold of the card number and PIN code. I suspect I used a tampered ATM machine at a super market one day and I was losing $300.00 a day for 4 days until I logged in and saw those fraudulent transactions. I immediately called B of A and they refunded the money after a couple of days. They started an investigation and then sent me a letter about a month later saying that I didn't have to return any of the I was refunded. Not sure how they researched it but the ATM transaction were made late at night or early in the morning while I was asleep.

Simple

[Potor]

I travel a lot. I tell Visa where I am going to be, whenever I buy a ticket.

The've actually stopped me from using my own card. A minor inconvenience for peace of mind.

Re:Simple

[binarylarry]

It's annoying either way.

So in short: Use a credit card and if you get hit with fraud, have a backup credit card to use until the charges are reversed.

Most people don't realize that the onus is entirely on the bank to deal with fraud, it's their money and problem, not yours as a card holder.

Re:Simple

[humphrm]

This doesn't stop a skimmer from using your card across town. Also, what should he have done in this case, called Visa and said "I am not going to be on the other side of the country, or Europe next week"?

some technology that already exists

[Tumbleweed]

1) Get a bank that lets you put your picture on your card (in case your card is physically stolen)
2) If it's possible (not sure on this one), get a card that can't be used without a PIN
3) If it's possible (not sure here either), get a bank that allows you to configure your card to only be used online if the security code on the back is also used. MANY places online still don't ask for this, for some reason. The payment systems DO know the difference between whether a card is being used in person or not, so there's no technological reason this isn't possible.
4) Encourage laws to make these things available where they aren't, with the 'default' settings set to maximum safety.

Re:some technology that already exists

[socsoc]

Your third point has solely to do with the payment processing bank of the retailer. They often let the retailer determine the amount of verifications, I've had stuff shipped to previous address with an incorrect billing address on the receipt because the web forms kept messing up. I never understood it till I was setting up a payment service with a local bank and they asked me what verifications I wanted in place. It's amazing what little that you can do because they don't give a damn. Chargebacks go back to the retailer, with fees.

Re:some technology that already exists

[VGPowerlord]

1) Get a bank that lets you put your picture on your card (in case your card is physically stolen)

Doesn't help online, and it's very rare for anyone in a store to ask to see a credit card when one runs it through a credit card machine.

2) If it's possible (not sure on this one), get a card that can't be used without a PIN

Doesn't prevent skimming. In fact, in the United States, using a Debit card with PIN means that it's not processed through Visa/MasterCard, and thus their fraud protections don't apply.

How about a real solution?

[John Whitley]

But I also think that those producing these check cards should be required to advertise the hazards of having one of these cards

NO, NO, NO. No stupid, pointless warnings. Make the financial institutions solely liable for all identity theft. They're the only ones with the ability to stop it, and they should be the ones that bear the full economic incentive for managing fraud.

But I didn't say it first, Bruce Schneier did:

The actual problem to be solved is that of fraudulent transactions. Financial institutions make it too easy for a criminal to commit fraudulent transactions, and too difficult for the victims to clear their names.
[...]
It's not that financial institutions suffer no losses. Because of something called Regulation E, they already pay most of the direct costs of identity theft. But the costs in time, stress and hassle are entirely borne by the victims.

The whole article is +5 Insightful, well worth reading.

Re:How about a real solution?

[rbcd]

Mitchell and Webb have done an amusing sketch on it, too.

Re:How about a real solution?

[Lorien_the_first_one]

Agreed.

Re:How about a real solution?

[Anonymous Coward]

It isn't the banks though it is Visa/MasterCard etc whose preventing it. So unless you meant them. What we need is a new company to come out with a new system. Google! Google should do this! omg. I bet Google could come out with a secure solution. The only problem is it would be privacy invasive solution. It probably would cost nothing and be adopted quickly though. That would be the business model- and then they'd sell the data collected of course.

Re:How about a real solution?

[Mana Mana]

"They're the only ones with the ability to stop it, and they should be the ones that bear the full economic incentive for managing fraud."

Respectfully, you are wrong. All costs are passed down to you. ALL. I, paying cash, even have to pay, along with you, for your slothy behavior in not wasnting to be bothered in carrying, counting dealing with cash. That milk, bread, shampoo, toaster, all that wonderful shit available at Wegmans, Fairways, Wholefoods includes the extra fees, the extra costs that your VISA logoed, the behemoth in this segment, credit card foists onto that vendor you use.

You see, VISA networks doesn't lose jackshit. You're CC stolen and abused, pass fees onto you---they own the palying field in this huge niche. They force high commision rates onto the vendor, they pass it onto you with higher prices. For everything you buy and from everyone who buys, even when you only pay cash. Why do you think in harsgh times such as these, especiually, gasoline stations charhe higher prices for CC users. They don't want to, can't presently afford to carry your CC charging, VISA logo monopoly ass. Newsflash: your typical commercial bank is in on the scam too. Here for you ignnorant know nothing debit card bashers, banks hate them, even the VISA logoed ones. Ever had the clerk ask you when you want to use your CC or debit card, "charge or debit?" If you choose debit they, VISA and your bank, are cut out of a fee via virtue of you having to use your PIN! Different protocol SOP, no lucrative gouge on that. SO, fuckers, I have to carry, subsidize your lousy asses because I like to use PIN debit, with similar federal CC protections, as DCs don't report to credit reporting agencies. Or is sifted into a database nation to be used by the fucking car, home, health insurer industries amongst endless others to monitor my life and judge what rates they deign to offer me without my explicit consent for using my personal information. Dumbfuckers, read a newspaper, get off the facile cracks and make a fucking effort out of your shithead overly geeky ways.

Re:How about a real solution?

[noidentity]

Make the financial institutions solely liable for all identity theft. They're the only ones with the ability to stop it, and they should be the ones that bear the full economic incentive for managing fraud.

And let's stop calling it identity theft. It's really just a case of the bank mistaking person X for person Y, and thus mistakenly giving person Y's money to person X. It's the bank's error, yet the term implies that it was connected with you in some way, that you didn't protect something of yours well enough. Bullshit.

Re:How about a real solution?

[AK Marc]

It's really just a case of the bank mistaking person X for person Y, and thus mistakenly giving person Y's money to person X.

It's bank theft. When someone robs a bank, the bank doesn't say "that $10 came from Sally's account, and that $10 came from Bob's." But when Joe walks in with a forged withdrawal slip from Sally's account and steals the bank's money, the bank blames Sally, hassles her about her money, then spends millions on PR to convince people "identity theft" exists and that stealing from the bank is stealing from Sally, and not Bank of America.

Bank theft changed a little, and the banks hopped on that to limit their losses by stealing from their customers after bank thefts.

absolutely nothing

[Pinhedd]

Nothing can be done to improve debit card security beyond what already has been done. The best thing anyone can do is avoid using it anywhere other than an ATM or some place you trust. If you can, use a credit card and just dont over spend.

The only way is special accounts for Debit cards.

[AnonymousClown]

Clark Howard, a consumer advocate here in the States, has been railing against them for years.

And the really sucky part of your troubles is that any checks that get bounced because of this, you're responsible for the fees - all of them.

And banks love to tally up all your withdraws before all deposits just so they can hit you up for charges. They're junk!

The best way to protect yourself from debit cards is not to use them.

When Visa and Mastercard say that you have the same protections with a debit card as you do with a credit, they're full of it.

There's only one way I know to protect yourself if you really need to use one of those things ("Piece of trash Visa or Mastercard" as Howard says). I opened a checking account a few years ago and my own bank said that I should open anther account just for debit transaction (totally free of course) just to protect myself an my money. They even admitted that they're crap - WaMu before the Chase takeover.

I had a better experience

[roc97007]

One day I found that my bank account had been cleaned out. There were a massive number of $50 charges from one vendor -- essentially they kept charging $50 until they got a decline. The charges had occurred after 11:00 PM and before 5:00 AM local time, which made me think that time zones were involved.

I called the bank immediately and reported it, had the card frozen but by that time there was only about $20 left.

I did some research from the transaction information -- the company had an address in California that appeared to be fake, an 800 number that was disconnected, and the domain was owned by a different company in Korea.

I printed all this out, took it to the credit union. They had me fill out some forms, and gave me access to some money (I was pretty much broke) while they worked on it.

Within 3 days all my money was returned to me. It's possible that the credit union fronted me the cash while they worked with the authorities -- they never said. But as far as I was concerned, the event was over in less than a week.

Maybe it makes a difference which bank you use. Or maybe it's the difference between a bank and a credit union. I dunno.

I never did figure out how they got my numbers.

Re:I had a better experience

[Anonymous Coward]

Not quite this happened to me, but a similar scenario - I was double charged on a purchase with my debit card. I informed them as soon as I saw the double charge in online banking, and confirmed it wasn't just a memopost and settled transaction, no, it was in fact two transactions.

Called my bank. They sent me a bunch of forms, I filled them out and returned them. Even before I got the forms, the same day as I reported it, I immediately saw on my account a "Provisional Credit" for the disputed amount. It took them over 2 months to sort this out, but despite this, they never revoked this "provisional" amount.

Personally, no offense to the OP, but people need to READ THINGS before they sign or use them. Some debit cards have no form of insurance on the money or on theft. My debit card, provided you select "credit" and charge it through Visa, not the debit system, is protected by same zero liability for mistaken transactions. Also, my bank provides a 24-hour funds return guarantee if the card is stolen or my number is stolen as long as I report them. In other words, if I report it, they give me my money back within 24 hours.

So there you go. I don't mean to be an ass, but they aren't responsible for making you read the damn forms, that's your job as a consumer. Caveat emptor. If you're too lazy to read financial documents that may determine whether or not you have enough money TO LIVE then when it all goes missing and you're up shit creek, that's your own fault. Sorry.

Re:I had a better experience

[Amouth]

i know this will sound funny but i use paypal for online and random stuff.

hear me out.

if you set up a biz account then you can get a debit card issued and tied to the paypal account.

paypal has zero fees for moving money from your bank account into their account.. If it is a verified account and you have had zero faults then when you go into paypal and transfer money it is instantly available to your paypal debit card (even if it isn't pulled from your back for a couple days)

any time i buy something online i go through the check out and get the total cost - i then go over and transfer that amount rounded up to the dolor (some times amazon's tax isn't right) might put in an extra 5 if it's a large number then i flip back and use my paypal card..

It works for me because the most i can lose is the amount that i was already expecting to spend - and the paypal card can't overdraft from my bank and if there is NSF in the paypal account there are no fees just the transaction fails..

I have had my card # stolen too - i make a purchase and the next week got a call from Office Depot to verify my card info for an order of 8 portable dvd players (why something like that doesn't get flagged i have no idea) anyways.. after 2 hours with Office depot i manged to get them to give me the shipping details and cancel the order then called the local Sherif's Office where it was going to be shipped (it was in Louisiana i live in NC - again why that didn't get flagged you got me) and gave them all the info i had..

i then called paypal and they canceled the card and issued me a new one and i had it within a week - because there was no money in the account no charges to try to get back.. Sure it takes extra effort BUT you know.. it works.

as for my day to day around town.. i have my bank issued check card - i keep a monthly allowance in it and all my other money in a money market that isn't accessible to that card.. if it ever does get ripped off i just have to skimp for a couple weeks - but i don't get flushed out.. banks don't charge for having more than 1 account - take advantage of that - separate your money.. cause god knows they don't care - and the companies the scammers go through don't give a shit either.

Re:I had a better experience

[omglolbah]

Yep, had the same thing happen to my card in Norway.

I had played Warhammer online for a few months then quit.... They kept charging me for 6 months subscriptions even after I removed my card details from my account and quite clearly went through the cancel process...
My bank beat them with a hammer and got my money back to me in 2 days...
6 months later it happened again.. My bank just gave me back the money and said they'd handle it.

Now that is how it -should- work.

I love the consumer protection laws here in Norway. The difference between a debit and credit card in the case of abuse is just when you get your money back. The same protections apply to both :D

Re:I had a better experience

[Anonymous Coward]

I had a the same experience with my credit union as well, except I got all my money back the same day, I love credit unions. Refunds on atm fee's, interest on checking, no min balances (good for keeping debit card at $0) ), basically no cost to me, I even make a little.

Re:I had a better experience

[natehoy]

Glad your credit union was so helpful.

This is the way Credit Cards work by default, however. So I don't have to depend on getting a helpful agent at my credit union to bail me out.

In other words, if you have a really good bank/credit union, the experience is almost as good and almost as painless as having a credit card.

Re:I had a better experience

[Anonymous Coward]

One day I found that my bank account had been cleaned out.

...

I printed all this out, took it to the credit union.

bank <> credit union. very big difference.

Re:I had a better experience

[AK Marc]

6 months later it happened again.. My bank just gave me back the money and said they'd handle it.
Now that is how it -should- work.

How it should work (if I were in charge) is that when they make such a mistake 6 months after a properly cancellation, is that they either have the CEO serve a week in jail for fraud, or VISA places their account on suspension for one month (inability to take credit cards for a month).

They committed a crime. They fraudulently stole money from the bank in your name. "Oops" doesn't get people out of crimes, unless they happen to be corporations. Then they get to break all the laws they want, as long as they say "oops" at appropriate times. That's most definitely not how it -should- work.

Here's the answer: NEVER USE DEBIT!

[Anonymous Coward]

Debit cards are EVIL. Don't use one.

With credit cards, the onus is on the BANK to prove that a transaction is real. When theft occurs, you dispute the charge, and it's the bank and/or merchant that is left holding the bag and dealing with the police.

With debit cards, the onus is on YOU to prove that a transaction if false. When theft occurs, YOUR MONEY IS STOLEN, and it's you dealing with the police trying to get your money back.

In both cases, normally fraud gets cleared up eventually, but debit is a much bigger hassle.

The only possible reasons to use debit instead of credit:

- your credit history sucks and no one will give you a credit card
- you can't control your spending with a credit card

Unless you're in one of these categories, NEVER, EVER USE DEBIT.

so the real lesson is do onto others as they do 2u

[Rivalz]

If they are resolving it, but just not as fast as you like that is one thing.
If they are choosing to look the other way that is another and that will not work in the long run.
I think 3-5 weeks is a reasonable amount of time given the often complex nature of the problem.
How long do you think it takes the bank to recover or catch the parties involved?
Do they often recover the lost money?

Personally I would like it if I had a remote that I press that allows my debit card to be used for the next half hour and only when it is activated.
Hard currency is on its way out of style so whoever designs the next big sec measure for debit will be laughing to the bank.

Better softare

[thoughtsatthemoment]

... to limit where, when, and how much the card can be used. How about instant notification for user approval on your mobile phone? That'd be really cool.

Does your bank not call your or text you ?

[parallel_prankster]

I have set up my acct such that if there is an access made more than a certain amount of money and/or out of my local area, they call me/text me to call them and verify the transaction. I am not a frequent traveller, so this works out for me. Look up if such a facility is available with your bank too. Another thing, see if they offer some sort of fraud protection mechanism. Some banks do that. That takes off some of the time-delay/processing worries too. If you choose to use your debit card and not credit card mostly, also, move your money from checking to some savings account and keep very little ( subjective) money in checking. That may help too.

Re:Does your bank not call your or text you ?

[Aceticon]

If you choose to use your debit card and not credit card mostly, also, move your money from checking to some savings account and keep very little ( subjective) money in checking

I used this scheme with a bank in the UK (Halifax). Yet they still let through transactions done through an ATM terminal exceeding the amount available on my account and charged me a fee for "Unarranged overdraft" (even though I had explicitly requested "no overdrafts" when openning the account). [Naturally I'm not their customer anymore]

At least in the UK, restricting the amount of money in your account is little defense if you have a debit card linked to it - it's actually in the bank's best interest to let through transactions execeeding the amount of money in you account since they get to charge you overdraft fees (especially since a court case that went all the way to the Supreme Court has confirmed they can do it with impunity).

Cash

[gillbates]

You know the saying about having a single point of failure, all of the eggs in the same basket, etc... Have enough cash on hand to see you through the time it takes to get something like this resolved. An 8 to 12 week supply is probably prudent, as well as a reasonably robust safe to keep it.

CDs are also useful, though someone could conceivably take those as well.

Re:Cash

[Anonymous Coward]

I don't think anyone ever keeps 8-12 weeks worth of cash on them. Why should they? Even if your bank account does get cleaned out, payday is generally right around the corner and can help tie you over till your bank can straighten things out.

As for a safe, robustness isn't the important part, weight is. If someone breaks into your house and finds a safe that weighs less than 100 lbs, they're taking it with them and will figure it out later.

Re:Cash

[Civil_Disobedient]

It's a little hard to buy things online with cash.

Re:Cash

[haruharaharu]

If you're having an emergency (like getting cleaned out), maybe you can defer most of your online stuff?

No debit card

[zenray]

I won't use a debit card untill they make crediting the account just as fast as a debit action. In other words, never.

zenray

Wow...

[Anonymous Coward]

Guess what folks? Some people still -- yes, in this "any identity thief can get credit" age -- can't get a credit card.

For my part, I got tickled a year ago, on the debit card I got from the hole of the Great Unbanked: ACE Check Cashing.

They shut it off immediately, and refunded the $4.78 (to wanadoo.fr, a French Webhost)... but it took over a week to get me a new card *and I have direct deposit*.

My solution? Got a *second* new card.

Direct deposit goes to one, locked up in a safe place and *I never use that card for anything*. It has Virtual account numbers, and I've set those up for my car insurance and a couple recurring bills.

The second card is what I use to buy things, in person, online, and via PayPal... but that card almost never has more than $50 on it, unless I transfer money to it to buy something specific...

which transfer I can do via SMS. Average delay? 60 seconds.

Works out nicely for me.

Re:Wow...

[snowraver1]

Want to know why you can't get a credit card? Because you don't have a bank. Seriously, stop using those ghetto check cashing shops and get a bank account. Wasn't it embarrassing to tell you employer that your bank is "ACE Check Cashing"?

Re:so the real lesson is do onto others as they do

[Zironic]

What's usually expected of the bank is to return the money out of their own pocket while they're investigating.

Umm... what?

[Anonymous Coward]

You want my advice? Move to a civilized country. One where banks are required by law to secure debit card transfers, just like credit card companies are required to secure credit card transfers. Seriously, I've never met anyone who's had a problem with a debit card -- a credit card, perhaps, but never a debit card.

Just one more part of US legislation that is severely broken, I guess.

Only use a credit card

[cortesoft]

Debit cards are functionally useless, since they give you nothing that using credit card which you pay off every month wouldn't while costing you quite a bit.

If you have a credit card you pay off every month, you get an interest free loan for a month. You earn points for rewards. You get protection against fraud. You often get warranties on things you wouldn't normally get.

You get NONE of this with a debit card. The only reason a debit card is preferable is if you don't have the self control to spend an amount you can pay off every month, or you have such a bad credit rating you can't get a credit card with a grace period.

Re:Only use a credit card

[thegarbz]

In Australia there are many retailers who will pass on the the cost of credit transactions to the customers. The difference between hitting Credit or Debit at the terminal in many stores is between 3-5%. Swipe an Amex and we're talking 5-7%. Some places will not accept credit card but will accept debit cards. Obviously these conditions are *normally* limited to small retailers however you do occasionally get them at larger stores too. I use credit transactions where possible, but for me debit cards are far from "functionally useless" and almost a requirement which is why many here have a cards that fit dual purpose so they can decide which button to use and when.

Re:Only use a credit card

[symbolic]

Actually, I view debit cards as just the opposite - for people who aren't inclined to spend money they don't have. Credit cards are a trap that get people into a lot of trouble, quite frequently.

Re:Only use a credit card

[cortesoft]

Only if you let it. I have had credit cards for all my adult life and never once paid any interest. If you are the type of person who controls their spending, it doesn't have to trap you into spending money you don't have.

Re:Only use a credit card

[cortesoft]

That is interesting. In the United States, we often have the opposite situation: debit cards often cost $1.50 per use while credit cards are free. I have seen a couple of gas stations who charge less for cash, but that is extremely rare.

Re:Only use a credit card

[Anonymous Coward]

And there are those of us who have the intelligence not to trust credit cards. Though in my case I acquired it through very painfull experience.
For ten years I used a credit card with no problem, doing as people say and not caring a balance, then I had a few problems and boom -- I was declaring bankruptcy.

People will say they won't abuse their credit cards, but when the time comes that you are facing some kind of disaster and you can stave off that disaster-- it is very hard to not use that credit card. The reality is though that the credit card just makes the eventual disaster so much bigger. A lot bigger then if you never had the credit card.

Now you might call me a "deadbeat", but the fact is that credit card companies don't call me a deadbeat. You want to know who the credit card companies call deadbeats? The people who pay their credit cards off on time and never carry a balance. They lose money on those people.

The basic fact is that credit card companies make money off of people who abuse their cards. It's a system where your interests and credit card companies interests are in conflict, and the credit card companies deal the cards. You may think the effective interest free loan and the points and other rewards are great because you make money, but they also lose credit card companies money, and credit card companies are happy to lose money because they know eventually they will make money off of you. They know that the first time you carry a balance, they've got you.

Re:Only use a credit card

[glodime]

If you have a credit card you pay off every month

You don't have to do that with debit cards.

you get an interest free loan for a month.

Wow if you keep that money in your bank account each month over your life time you'll save enough for an iPad.

You earn points for rewards.

Some debit cards offer this, some have sweepstakes and giveaways. Most people don't and shouldn't care about the up to $200 per year in cash back. Good service is more valuable than that.

You get protection against fraud.

Debit card offer that too.

You often get warranties on things you wouldn't normally get.

If by often you mean one almost always already has insurance against those items then yes, often. How many people actually make a claim on the insurance/warranties that cards offer. I'm so uninterested in this that I don't even know if this is offered with debit cards. So you may be sort of correct here.

You get NONE of this with a debit card.

I beg to differ...

Re:Only use a credit card

[KPexEA]

According to my credit card merchant agreement (for Visa and Mastercard) I am not allowed to offer a discount for cash or other forms of payment, I am also not allowed to charge a surcharge for their cards and I am also not allowed to ask for any extra Identification. I am surprised that Visa and MC are not enforcing that in all countries (we are in Canada).

Re:Only use a credit card

[Tacvek]

The only time credit cards get people into trouble is when they don't have the self control to pay it in full every time, or lack the ability to keep track of the amount charged, leading to a bill they just can't pay.

I for one would like to see a hybrid. I describe it as follows.

The way it would work is that in addition the the checking account the user has a special second account at the bank. When a charge authorization request is routed to the bank, if there is enough information in the checking account then a hold is placed on that amount just like with a debit card. However when the transaction completes, instead of the money being withdrawn, it is merely transered to the special second account.

Thus like a debit card, with only limited exceptions[0] by default it is not possible to spend more money than you have. However, unlike a debit card the money remains yours. The bank would not be allowed to touch the money in the special account without you authorizing it. When you get the credit card bill, you have all the money in that account to pay it in full. But it is still a credit card. If you don't pay it, the same consequences would occur. Notably this means that in the event of identity theft all the money is still in an account you own, so it is just transferred back to checking immediately upon you reporting the fraud.

Now this concept can go one of two ways. One is a soft option. Under this option they can transfer money back out of the special account at will, and when they get the bill, they can pay the minimum payment, pay in full, or anywhere in between. This option basically just prevents somebody from inadvertently charging more to the credit card then they have in the checking account.

The other is a hard option, where although the money in the special account remains yours, you cannot touch it, and it is only every transferred back in the case of reported fraud. Under this scenario, the bank would also not accept anything other than full payments on the credit card bill. This is the option for people who lack the self control to pay in full. That is their only option. Well they have to pay the charged amount in full. They may choose not to pay the late fees and interest when late, that is fine, but they won't be able to charge the card, even if they have the money in the checking account.

Now since these are credit cards, in addition to having authorization fail when there is not enough funds in the checking account, there would also be a credit limit. But some (many?) debit cards already have a monthy limit, which may prevent transaction even when there is enough money in the account.

[0] There is always the possibility of the completed transactions exceeding the amount listed in the initial authorization. That happens when you put a tip on the credit card at restaurants, among other occasions.

Re:Only use a credit card

[MrCrassic]

Taking a cash advance on credit cards can be quite costly, though. And the ATM can come in handy very often (like for restaurants that don't accept cards)

Re:Only use a credit card

[DigiShaman]

Regardless, if you don't have cash or a checks on hand, use a credit card. It acts as a financial firewall between you and your checking account. In fact, this is how I perform all on-line transactions from purchases to paying utility bills. Should there be fraud (and it's happened to me), report the issue to your bank and request a new credit card number. Lather, rinse, repeat.

Re:Only use a credit card

[evilviper]

You get NONE of this with a debit card. The only reason a debit card is preferable is if you don't have the self control to spend an amount you can pay off every month

Or if you don't want to pay a fee to have a credit card.
Or if you don't like the terms and conditions.
Or if you care AT ALL about your privacy, and don't want every purchase you ever made in the database of the big three, free for ANYBODY to look up.
Or if you want to ensure that any lucky identity thieves can't do anything to ruin your non-existent credit rating...
Or...

Re:Only use a credit card

[mjwx]

Debit cards are functionally useless, since they give you nothing that using credit card which you pay off every month wouldn't while costing you quite a bit.

In fact they take away functionality.

Like the line of credit which I consider too much of a risk to have on my everyday card.

With my bank, I do not pay a fee to have the Visa debit card as long as my salary is deposited into that account (min A$1000 per month), in fact with that I pay no fee's when using my banks ATM network or EFTPOS. So I pretty much have fee free banking so long as I make sure to honour my debts (monthly phone bill and so forth). A line of credit which has a monthly interest rate of 17% or more is far too much of a risk, in addition to the fact that if my card details are stolen they would have access to that line of credit as well.

I do have a credit card, a completely separate card that sits in a safe, never to be used. Unfortunately whilst this is financially responsible it is frowned upon by the financial institutions and the entire system seems set up to punish me for it (no debts == no credit rating, getting a phone contract is a 3 day ordeal).

Re:Only use a credit card

[Leto-II]

You can get cards that you can use at the ATM machine, but that cannot be used as a debit card.

Re:Only use a credit card

[defaria]

Poppycock! The reason to use a debit card is 1) convenience and 2) to limit your risk. If you carry $100's of dollars in cash and are mugged kiss that money good bye. If you only have a debit card and are mugged you're liability is limited (probably only $50 tops).

Also it's been shown that many people start maintaining a balance when using credit cards. Sometimes it's a lack of control but often it's just because you're too busy with life to get to settling your debt. I've been debt free for a while now and used to pride myself on being able to pay off that balance every month. But then I got too busy and lost track.

Debit cards enforce a good practice, that of only spending that which you can afford and not borrowing.

Re:Only use a credit card

[j_sp_r]

Around here the Debit card is used like cash. I only need cash in the weekend (bar), the rest of the week I pay everything with my debit card (even E0,25 euro). Most times small transactions are free because they figured out it is cheaper to accept PIN then cash.

Credit card, might cost money and is not accepted everywhere.

Re:Only use a credit card

[jimicus]

They can't.

ICBW, but AIUI under European law, A is not allowed to dictate the terms of a transaction between B and C.

"A" in this case is Visa/MC, "B" is the retailer and "C" is the consumer.

Re:Only use a credit card

[Anonymous Coward]

Huh?! I never used credit cards, until I came to United States where I was surprised to discover that without credit card you don't exist. Whole life I used debit card, getting a credit card was really frightening. Fortunately I don't have to use it (until I go to US again).

Re:Only use a credit card

[Anonymous Coward]

Debit cards are easier to use, accepted at far more locations and don't come with an annual fee.

Re:Only use a credit card

[Sandbags]

Any "debit" transaction run as a credit transaction (you use a signature instead of a pin, or pay online in any way), are covered by the EXACT SAME VISA RULES as a credit card. The ONLY transactions on a debit card that are not covered in kind are "ATM" transactions, using your pin number.

When you swipe your card, your should NEVER enter your pin number. The merchant is required to offer you a signature based option. They bury it on some machines, but make it readily available on others. Ask the cashier "how do i use this as credit?" and they'll tell you how. If you do this, your transactions are protected by Visa (and you earn Visa rewards if you signed up).

If someone has your card number, but not your pin, ALL the illegal transactions they run go through Visa, not your bank directly. Your BANK may not offer protection (most do), but that doesn't matter since VISA does protect you. It may take a few business days to get the money back, and your bank may need to issue you a temporary "loan" (nearly all will offer up $500 interest free for a few weeks in these cases, no application required), or you can simply move money from savings to checking or use your wife's account for a few days.

most good banks also have fraud detection algorithms, which understand where transactions are run, time indexes between them, types of transactions, how much was pre-authorized vs rung up later (find waiters who write in big tips), and more. I've gotten calls from my bank several times when they blocked a transaction detected as such.

Re:Only use a credit card

[Divide By Zero]

A) Who takes a cash advance on a credit card as a matter of policy? I have under two circumstances: I put the wrong card in the ATM, and that's what my employer tells me to do when I'm traveling, to keep all my expenses on the employer-issued travel credit card. One was a mistake, and the other was because I was being reimbursed. I'd never take a cash advance on my own card on purpose. No grace period, insane interest rates, and they apply your payment to the cash advance last if you're carrying a balance.

B) How often do you go into a restaurant that doesn't take plastic? Where do you find them? I can count on one hand the number of restaurants I've SEEN in the last year that don't take debit/credit, and can count on something-I-don't-have the number of times I've been in one. Even if I did find one, I'd find an ATM first and use an ATM card - see A).

The whole credit-debit thing would be moot if people lived by the rule "If you don't have the money for it, you can't afford it, regardless of whether someone will give it to you." Other than a car, a house, or college, I can't think of anything I'd borrow for, and the sooner you pay those off, the better you are financially. I use a credit card all the time because of the protection afforded me in cases like this (literally had my credit card number stolen two days ago - they called me to make sure I hadn't bought a cell phone in Sweden, they shut it down and I had $0 liability and a new card w/new number yesterday) and for the cash-back. I effectively get 1-5% off whatever I buy on credit, and turning down free money's just DUMB. (also, be sure to get every employer match dollar on your 401(k) or similar)

...

This unsolicited financial advice brought to you by my father, who I've apparently turned into. Thanks, Dad.

Re:Only use a credit card

[macbuzz01]

I agree with you on many points, but Debit Cards do give you access to Cash at an ATM, which Credit Cards do, but at very high interest rates that are compounded daily.

Re:Only use a credit card

[sp0tter]

I could be out of the loop here since I only use cash, but unless your card specifically grants you a grace period, you will end up paying interest immediately upon charge.

One of my first coding assignments in high school involved writing our own calendar program and then using that system to print out bank statements. Our teacher liked to point out that our program had to convert a yearly interest rate into a daily one and appliy that to what was called the 'average daily balance.

Long story short, unless you pay the balance off immediately, you ended up paying interest, and the interest got large quite fast. As I said, I never use credit cards myself so I cannot say if this is really the case.

Re:Only use a credit card

[Anonymous Coward]

You can't use a debit card if you don't have the funds. You can use a credit card if you don't have the funds.

How many people have have large credit card debt. You Can't even get debit card debt.

See difference?

Re:Only use a credit card

[Anonymous Coward]

I have never used a real credit card yet. For all online purchases, I use virtual credit cards, because it is easy and safe. And I would not say that a dollar a month for debit card is expensive, even though I agree that the no monthly fee credit card is better in that regard.

Just a few days ago I ordered my first credit card. I told the banker that I don't intend to use it, but I just need it as a backup payment method for my upcoming USA trip. The banker responded under the lip: "this is how they all begin". I have heard stories about how people without credit cards are considered not trustworthy to do business with in the States. Something like "if your bank does not trust you with credit, why should we?". And as a jobless student with no credit history, I don't have a lot of credit on that card, but at least I can now earn the Americans' trust!

Using a debit card is being in charge of your own money. I can use what I have when I need it. In the last two weeks, I spent more money than I spent the whole last year, that is tens of times more than my credit. And I still have lots left! Compare this to an average credit card holder, who spends years to build his credit. Of course they could transfer extra money to their credit account when they needed it, but the whole lifestyle of credit cards, the "spending as much as you can to increase future spending possibilities" just leaves most people in the red before payday.

If you are a person of strong will who can take advantage of credit cards without being victimized by them, I support your argument. But I am not strong-willed. Instead, I am very security oriented and have never lost any money to thieves, robbers or frauds.

Sorry for the rant. It just boggles the mind how people can use cards that have all the important information printed on it for everyone to read. Also, I am a bit tipsy.

Re:Only use a credit card

[Hognoxious]

You probably found it almost impossible to get one too, until you've been there for several years.

I remember being turned down at the bank where my salary was paid. The limit I'd requested was relatively tiny - less than I earned in a week. I had a credit balnace of twenty times that held at the same branch.

Re:Only use a credit card

[Hognoxious]

You are not charged interest on purchases (including car hire, hotel stays) until a number of days after the bill is sent out. So if you buy something just after the old bill is sent you can get length_of_billing_cycle + grace_period (or postal_lag or whatever) days free credit.

Are you confusing it with cash withdrawals? Those do attract immediate interest.

P.S. High school coding assignments by their very nature are often based around simplifications and approximations of how the real world works. Take an infinitely long, perfect conductor...

Re:Only use a credit card

[Anonymous Coward]

stupid nigger

Re:Only use a credit card

[AK Marc]

Or if you don't want to pay a fee to have a credit card.

I've had exactly one credit card with an annual fee, and that's the Alaska Air card (issued through the Bank of America) where the free and discount vouchers saved me much more than the annual fee. The other 100 or so credit cards I've had (I had fun collecting tee shirts in college from them, all fee-free and I had over 50 cards at one time, and no, I've never carried a balance), I've never paid a fee.

Or if you don't like the terms and conditions.

Generally the same as the debit version of the same card.

Or if you care AT ALL about your privacy, and don't want every purchase you ever made in the database of the big three, free for ANYBODY to look up.

Either you are lying or are stupid. No single purchase with a credit card shows up there. Your monthly balance does, but not whether you carried a balance, nor how much you actually charged (and even things that might matter, like the ratio of purchases to cash advances don't show up). So yes, there's some information there, but "every purchase" is an outright lie.

Or if you want to ensure that any lucky identity thieves can't do anything to ruin your non-existent credit rating...

Huh? What's non existent, and if it doesn't exist, how can it be harmed? And are you asserting that the fraud prevention (better on credit cards than PIN debit transactions), is worse on the credit card? Because that's wrong. Apparently, you'd rather be broke with a good non existent credit rating, than have all your money and a bad credit rating. I'd call that stupid.

Or...

Yes, that's all you can do, pretend you can keep going, when you haven't even listed a single advantage of a debit Visa over a credit Visa.

Why use a debit card? Seriously- Why?

[Anonymous Coward]

I spent 12 years working in law enforcement. For several years, I specialized in "High Technology Crime", Identity Theft, and white collar crime. I learned many things doing that. One thing I learned is this: A True ATM card with a strong PIN is fine. A True CREDIT card is fine. A DEBIT card should be avoided. If a CREDIT card is compromised it is the banks money and not yours. One thing that I do not understand is why people with good credit use a debit card. Why not use a credit card (the banks money) and then pay the bill in full each month. My NEW bank and I have an understanding. The FIRST time that they try to upgrade me to a DEBIT card over a true ATM card, I take my money elsewhere.

It was a horrible idea then AND now

[markdavis]

I have been telling people for YEARS how unwise it is to have or use a "debit" card with a Visa/MC logo on it. My bank kept INSISTING that I use one, and I would have to send it back and tell them to please send me a regular debit/ATM card. Many of the same people that thought I was "paranoid" and "obsessive" or just plain strange don't think so anymore. I know more than one person who has had money taken from their account and then it is up to THEM to try and get their money back, meanwhile checks are bouncing, fees are accumulating, credit scores are plummeting. Hours and hours of work to "fix", and then not really know if it is "fixed".

The whole idea of taking a perfectly good ATM card and then linking a Visa logo to it so someone can take JUST YOUR NUMBER (not even have the card) and wipe out your actual account, live, without even a PIN code, is just crazy. Get a CREDIT CARD and let *THEM* take the risk!!

Re:It was a horrible idea then AND now

[oasisbob]

I have been telling people for YEARS how unwise it is to have or use a "debit" card with a Visa/MC logo on it. My bank kept INSISTING that I use one, and I would have to send it back and tell them to please send me a regular debit/ATM card. Many of the same people that thought I was "paranoid" and "obsessive" or just plain strange don't think so anymore.

You are paranoid. And ignorant. As long as you report the theft to your financial institution as soon as you learn about it, there are strong protections in place. It's simply not true that it's up to YOU to track down your money. It's up to your financial institution. They are required by law to credit you in the case of errors or unauthorized purchases, and are even required to issue a provisional credit in many cases before the investigation is complete.

A Visa Debit card carries the same protections as a Visa Credit card for signature based-transactions. PIN based transactions are still covered by Regulation E, which protects the consumer.

And there's no such thing as a perfectly good ATM card: with a skimmer, a fraudster can clone your ATM card and have your PIN. Fraudulent PIN based transactions are MUCH harder to refute. People call up all the time and say, "I have no idea how that person got my PIN number, I've never given it to ANYONE!" We (my bank) pull the ATM video, and sure enough it's their son/daughter. The consumer sheepishly admits, "Oh, well, I just told them my PIN once, months ago..." Given the choice between turning the video over to the police or rescinding the claim of unauthorized use, many people will choose the latter.

Re:It was a horrible idea then AND now

[noc007]

Disclaimer: IANAL nor do I know all of the pertaining US laws (some have already been quoted in other comments), however I work for a credit card processing gateway (known as a "Merchant Acquirer" in the industry) and am familiar with processing from that perspective.

The card holder has the right to dispute (chargeback) any transaction that they didn't authorize, receive the products, or services, to name a few, for up to six months (the chargeback period) and in extreme cases, nine months. Essentially the card holder goes to the card issuing bank and files a dispute. The bank issues a chargeback and the funds are soon after taken from the merchant's bank account along with fees and the amount the card holder was debited would be credited to their account. If the merchant doesn't have the funds in their account, the processor is liable and has to hand over the funds to the card holder. It's up to the merchant to provide documentation to support (prove) that the transaction was authorized by the card holder and they appropriately received the products or services they were billed for.

Obviously the processor doesn't want to maintain that risk, so they can get quite intrusive with knowing the merchant's ability to fund chargebacks, maintaining good documentation to support that the transaction was legitimate, and overall how they do business. This is generally done with the merchant agreement/contract stipulating that the merchant would provide any documentation to the processor the account is with and can include bank statements, signed receipts, signed invoices, signed contracts, invoices from suppliers, and even pictures of the facility in the case of brick and mortar businesses. If the processor isn't completely comfortable with how the merchant does business (ex: the merchant is using the transaction funds to buy the product from their supplier or they just don't keep a high enough balance in the account) or even a particular transaction, the processor can hold the funds for the one or all transactions for the chargeback period or possibly institute a rolling reserve where a percentage of the transaction funds are held by the processor for a specific time and then deposited into the merchant's account; this is done so processor can fund any chargebacks that may occur to reduce their overall financial risk.

In the case of a merchant fighting a chargeback, they would have to provide signed receipts, signed invoices, signed contracts, tracking numbers, and/or any other supporting documentation that is needed to prove the transaction was legitimate. This information is provided to the card issuing bank who needs to make an assessment. If the merchant wins, the original transaction amount is taken from the card holder and deposited back into the merchant's account minus any transaction fees. Even then, the merchant is screwed out of transaction fees three times (original transaction, chargeback transaction, and then winning the dispute) and the chargeback fee.

The card holder is in a good position to get their money back if the transaction is fraud or the merchant doesn't provide the product or service as advertised. A legitimate merchant is in a really crappy position no matter what.

Some light reading for those that want a little more:
http://en.wikipedia.org/wiki/Chargeback
-I know there are citations needed, but this article that I didn't write appears to be on the money from what I understand of the rules and regulations, which one can further review with Visa, MC, Discover, Amex, and PCI.

Re:It was a horrible idea then AND now

[Anonymous Coward]

You are paranoid. And ignorant. As long as you report the theft to your financial institution as soon as you learn about it, there are strong protections in place.

That's a very strong qualifier, and not one that I'm willing to live with.

Re:It was a horrible idea then AND now

[Anonymous Coward]

It's up to your financial institution. They are required by law to credit you in the case of errors or unauthorized purchases, and are even required to issue a provisional credit in many cases before the investigation is complete.

Err, the problem with debit cards (cf credit cards) is that most people are left out in the cold for a long time without their cash. All the regulations don't prevent that; so prevent it yourself by not having one (I do, but I recognise the risk).

Re:It was a horrible idea then AND now

[Anonymous Coward]

I'm sure someone else has already said this, but Debit cards shift the frontline risk to the consumer. Yes, you can get your money back, but in the meantime whether that's a few days or a few weeks, your money is gone, your checks have bounced, and you're spending a lot of time trying to get it worked out. With a credit card, you inform the bank of the charges and they issue you a new card while they investigate. At no point are you out of pocket. At no point do you bounce checks. Banks love Debit cards. They keep sending them to me and I keep using my ATM card.

Re:It was a horrible idea then AND now

[Anonymous Coward]

>You are paranoid. And ignorant.

And you're being a jerk. It's much easier to get your money back from the credit card companies than from the banks. (Don't bother pointing us to Regulation E again. I know about it, I'm a banker.) The simple fact is that banks drag their feet a lot more than the CC companies do, when it comes to making a customer whole after identity theft. Refusing a Visa or MasterCard ATM card is just good sense.

Australia and Debit Cards

[sr180]

Interestingly enough, a Australia's largest shopping retailer (Woolworths) has just stopped the use of debit cards in their store - citing excessive bank fees. Instead, customers must use EFTPOS - which goes directly through the banking network and not Mastercard or Visa.

Re:Australia and Debit Cards

[Anonymous Coward]

That is not true. They have not stopped the use. I took from an article that they are charging a fee to the customer if they select credit and swipe a scheme debit card.

There is no difference to the merchant, but the clearing house usually charges lower fees (in the cases I was involved) when debit cards are used. They are easily able to tell.

To top it off, the payment terminal _should_ be able to make the distinction automatically as I understand.

Re:Australia and Debit Cards

[Mr. Roadkill]

Interestingly, in Australia, Westpac has made a cynical grab for their share of the merchant fees by FORCING customers (like me) to have Debit Mastercards instead of regular ATM cards - they won't admit it, of course, but a free additional revenue stream for them has to be a huge attraction. My response, since they wouldn't let me keep my non-MC card, is to not use Mastercard side of it at all. What benefit does it give me? Nothing - it can take a few days for mastercard transactions to be properly reflected in the balance, unlike EFTPOS transations which are just about instantaneous, and I rely on that balance as a sanity-check for how much I have left in any particular week... plus I'm not the only one with access to that account, so unaccounted-for pending transactions could cause some embarrassment.

They make a huge deal out of how there's no limit to the number of Mastercard transactions per month, unlike EFTPOS ones, and cite it as a customer benefit. Their marketing drivel that came with the card stated how wonderful this was for the consumer, letting you use your money how and when you like with fewer fees (they helpfully neglect to mention that the merchant has to pay for the privilege of accepting Mastercard). They tried to avoid the subject of how somebody with the 16 digits on the front and three of those on the back could reach into my account without a PIN from the other side of the world, and wouldn't give me a plain ATM card instead - saying that it was done "because most customers want them", and they couldn't reverse it once the card had been converted over. Fuckers. Should have taken it to the Banking Ombudsman, but I just couldn't be bothered at the time.

I refuse to use it on-line or use the Mastercard facility; that's what the credit card and Paypal are for.

Re:Australia and Debit Cards

[sr180]

Actually, it is true. Woolworths are disabling the Credit buttons on their terminals when a debit card is swiped. The only option is to select Savings or Cheque, which both use the Eftpos network and not the Credit ones.

Why would you ever use a debit card?

[kopo]

This is something I've never understood. Why on earth would you ever use a debit card when a credit card can be used instead? As long as you keep your account balance at zero, you have nothing to lose by using a credit card. And you gain a few legal protections against fraud; your own money generally isn't exposed.

Do debit cards have any advantages at all?

Re:Why would you ever use a debit card?

[Anonymous Coward]

CCards are safer but with a debit card you can get cash back, which is handy. Also, my understanding is that the fees for the merchant are lower for debit cards.

Re:Why would you ever use a debit card?

[Anonymous Coward]

Why would you ever use a credit card? Can someone from USA explain it to the rest of the world?

Poor flagging?

[Vylen]

I dunno if places do it with debit cards, but it should be just as easy... but with some (dunno if all) credit card companies flag "suspicious" activity - and your card being used in Europe would be one such instance... in those cases, they'd call you up to verify the purchase.

Your bank could at least do that sort of thing. Like seriously.. Europe? duh!

Bank Fraud

[philofaqs]

As someone who has just been stung by a £10000 scam. Someone somehow persuaded my bank to to allow them to to do telephone banking on my account. He did not have my passport, driving licence or birth certificate. How the branch and the bank's fraud dept thought it wasn't possible however 2 days ago the fraudster phoned the bank's phone line to see why he couldn't steal any more money. All true BTW I never checked statements too closely you need to. Got about 7 grand back so far.

I did a study on this a few years ago...

[Anonymous Coward]

Did you know to accept a credit card roughly costs the merchant about $1.05 (US) per $50.00 spent? Why do you think you see ATM's in all kinds of small businesses? A debit card cost a merchant much less, though the merchant may not realize this because they have been sold an account that charges about as much to them. The Independent Sales Organizations (ISO's) and third party processors have to make a buck somehow. As consumers - were already paying this $1.05 fee, passed along to us as the the "insurance" to cover identity theft and credit card losses - namely in higher fees for products we purchase.

Cash is the best way to handle identity theft, though it places the merchant at risk for possible theft, as well as the cost in handling the physical money - so be it.

I wish that product prices were lower and customers would have to read a sign on display that expressed they had to pay 5% a surcharge to use their VISA card.... which of course is against "Visa's" rules. You know.. for identity theft purposes.

Re:I did a study on this a few years ago...

[Anonymous Coward]

Wow, that's wrong. Visa charges more for bank card/debit transactions than for credit cards. Gas stations, in particular, tend to advertise cash discounts. They typically tack on a fixed amount per gallon for their overhead/profit whereas visa charges an upfront charge and a percentage so when gas prices were hit $4 a gallon a couple years back, many were losing money credit card sales.

Re:I did a study on this a few years ago...

[Scott Wood]

I believe the lower charge is for transactions that go through the debit networks (i.e. with a PIN), and don't involve Visa or Mastercard.

A liquor chain here gives a 5% "cash" discount for using either cash, or debit with PIN. You only pay full price if you do a credit transaction.

What to do? Tell you're bank they're full of it

[oasisbob]

IAABG (I am a banking geek).

The rules for provisional credit on debit cards is very well established. They fall under Regulation E, section 205.11. The bank has ten days to get you a provisional refund, and can take up to 45 days in certain circumstances to complete their investigation and finalize the credit.

Make sure you get them a notice in writing! Once you do, they have ten days to credit you, and many banks will do it much faster. If the bank drags their feet, just tell them "I want provisional credit within the mandated timeline per Regualtion E".

Here's more on this topic:
http://www.bankersonline.com/technology/guru2008/gurus_tech022508c.html
http://usa.visa.com/personal/security/visa_security_program/zero_liability.html
http://finsolinc.com/Reg%20E%20EFTA%20Error%20Resolution%20Flowchart.pdf

The protection for misuse of debit cards is strong, you just need to know what to do. If your bank isn't responsive, Move Your Money to a smaller institution that cares.

Re:What to do? Tell you're bank they're full of it

[Anonymous Coward]

I work in banking, and this is absolutely correct. In fact, the Reg-E clock starts ticking even before a written notice. It begins as soon as you report, in any capacity, unauthorized charges.

Re:What to do? Tell you're bank they're full of it

[Anonymous Coward]

Absolutely correct; however, without a paper trail, the bank can just claim they weren't notified.

Re:What to do? Tell you're bank they're full of it

[Sandbags]

And that's where google vice, and the ability to record all calls to any business (by pressing a few buttons when starting the call), comes in so importantly. (provided you live in a single party state, or if you live in a 2 party state, you inform the person on the other end you are recording).

The recording itself is not legally binding for the CONTENT of the call (statements made can't be defended directly) in some states, the fact that call wes MADE is in fact admissible. Though, typically just playing that call back to a supervisor, manager, or company exec gets things not only done fast, but with some extra "compensation" for your trouble (aka giving you everything you ask for costs less than a guaranteed loss in a court room).

Something can be done.

[Darth Muffin]

My wife works at a Credit Union and gets these types of things all the time. There are a few things you can do.

1. Get a Bank or Credit Union that gives a damn. Investigate before you choose one. A good one will monitor your activity and shut it down and call you when something goes wonky (like charges from all over the place or charges from known fraudulent organizations). When it does go wrong a good one will either fix it quick or possibly give you provisional credit to get you buy until they do fix it.

2. Use a real Credit Card for most items and have the discipline to pay it off each month. Credit Cards are held to a higher standard than debit because it's *their* money and not *yours*. If you challenge a charge they have to credit you right away while they research it, and the burden of proof is on them. As a side benefit you might get mileage or an annual rebate.

3. Use your debit card for small ticket items -- lunch, gas, etc. Don't keep more than you're willing to lose in the account, a few hundred maybe.

Re:Something can be done.

[Kitkoan]

1. Get a Bank or Credit Union that gives a damn. Investigate before you choose one. A good one will monitor your activity and shut it down and call you when something goes wonky (like charges from all over the place or charges from known fraudulent organizations). When it does go wrong a good one will either fix it quick or possibly give you provisional credit to get you buy until they do fix it.

Problem with this is, the ones that tend to give a damn are the smaller banks. And with those bank bailouts that the US Gov kept giving out only to the big banks has caused many small banks to go under. This leaves most of the power in the big banks, weakens to small banks and leaves most people with a lack of options and no longer looking for which bank gives a damn and more looking for a bank that won't completely screw you over.

Protection

[arizwebfoot]

I have a separate account with debit card that stays zero. When I know I'm going to pay a bill online or use for some other purchase, I move just however much I need into that account to cover the purchases or debits. In this way, if some one gets ahold of the number, there isn't a lot they can do with it.

Also I don't have overdraft protection on that specific account so that again, if someone gets my number(s), there isn't much they can do about it. Sure I may get nailed for a hundred bucks - if they catch it at the right time - otherwise, they just don't get my money.

Re:Protection

[olsmeister]

The point is, you shouldn't have to do all that.

Re:Protection

[arizwebfoot]

Agreed, however, prudence is the price for protection.

Re:Protection

[ErikZ]

Really?
My bank will apply every charge, then the charge bounces and they'll hit me with a 30$ fee for each bounce.

They don't check to see if the money is in the account at all.

Re:Protection

[Anonymous Coward]

Or you could use a credit card.

Re:Protection

[stars_are_number_1]

You should check with your bank to see if you can turn this "feature" off. I recently did with my bank account. All it took was simply stopping by any branch and signing a piece of paper to initiate the change in terms. Problem solved! :-)

So you need to be saved from yourself?

[suprcvic]

"and users informed of the issues of placing all of their money in the same account that their debit card has access to." Ever heard of not putting all of your eggs in one basket? I keep enough money in my checking account to cover me and the rest securely in a savings account. People shouldn't have to be told to have common sense.

Are there CC companies that fight fraud?

[Nanoda]

A common theme I hear is that credit card companies don't care enough about fraud to do any investigation whatsoever. I'm loath to pay any fees at all on my credit card, but I'd probably pay, say, 50$/year to get a card where, in the event of my card being used fraudulently, the criminals are hunted down and prosecuted / persecuted to the fullest extent available in the country in which they're found. (Rather than it just being written off as a cost-of-business expense and raising everyone's interest rates)

What can be done? Campaign finance reform.

[Anonymous Coward]

"What other precautionary measures should be required or taken?"

You are asking a bank CEO who makes $40 million per year + bonuses and stock to care.

The U.S. government is controlled by those who profit from a corrupt financial system, by those who profit from making war, and by those who profit from a number of other manipulations.

"What can be done? Nothing."

What can be done? Reform campaign finance. That will help eliminate government corruption. Now those who pay the most get the politicians they want.

Only a matter of time

[KevMar]

It is no longer a question of if your card will get stolen, but when will it get stolen.

I keep my daily limit low on my debit card. Around $250-$300 is my daily max. When I want to purchase something over that I call the number on the back of the card and have it raised. After the purchase, I call back and lower it again. The few times I need to make that call are worth it.

Once I was calling back to get it lowered and the lady was so confused as to why anyone would want such a low daily limit. Once I explained it to her, she thought it was a good idea.

I use this card every day. So if someone runs it to its max, I will find out about at lunch time. If I am out that 300, its a manageable loss.

What if you could get back every dollar that they take from your account from the bank (or some type of insurance)? Lets just say you have a high daily limit and they are able clean out your account in 1-4 days. How long can you survive while you wait to get it back. Thats the scariest thing about it comming directly out of your account. It is money you are missing while you try to get it recovered. When it is on a normal credit card, you can still make your house payment. There is no way they could get that back to you over night. It would take days or months while they investigate.

The most common theft of credit card numbers are from family members or someone you know. When charges are local to you, the investigations require more time and take more work.

Re:Only a matter of time

[Anonymous Coward]

I have a wachovia debit card (the generic blue one). It's tied to a student checking account.

I got my replacement card in the mail a month or two ago, and saw that my daily limit was $5,000. For a college student, with less than $5,000 in the checking account. I called up Wachovia and asked for a lower limit. They said that the (blue) cards could only go down to $5k. There's also apparently gold cards, because the rep asked what color the card was.

So I took off overdraft protection, so if someone drains the account I can still transfer money over from savings while the bank messes with the investigation.

I wish I could have a $300 daily max.

Re:Only a matter of time

[darkmeridian]

I lowered my ATM daily limit to $100. My ATM card is not a debit card. That sounds like insanity but for any purchase over that amount, I use a credit card to get the benefit of improved return policies, protection against bad merchants, and extended warranties. If I need to pay rent or something, I write a check so I have some record of the transaction. If I need a lot of cash such as for hookers and blow (just kidding), I go to the bank teller to make a personal withdrawal. That doesn't happen often so it's not a headache. If I need a lot of cash at a time when the bank is closed, then something is really wrong. I have yet to have that happen, and I wish it never does.

So basically, yeah, you're right. I'm a single dude so it may be a good idea to have a higher limit if you have a family. However, the $500 or $1000 daily limit some banks have is a pretty dumb idea.

Network effects

[sjbe]

On the flip side of that argument, someone stands to make a lot of money by entering the market and challenging Visa with the selling point of increased security.

Theoretically true but it would take someone with VERY deep pockets. Visa and the other large credit card vendors have a the very powerful asset of network effects on their side. Virtually every merchant takes Visa and Mastercard. Somewhat fewer take Discover and Amex. Very few merchants have the equipment to handle more secure cards. This means that even though there are safer cards available, there is no network to handle them and it would cost a sizable fortune to get enough merchants to carry them. From the consumer's point of view there is little incentive to carry a card that is not widely accepted especially if they are protected against loss anyway. Visa can simply promise to cover any losses which makes it uneconomical for someone to build a more secure network. In other words, ain't gonna happen.

Only way I can see a secure card network being installed in the US is if it is mandated by Congress. I've seen some efforts by Amex and some others but unless somehow we can convince Congress to get involved (unlikely in my opinion) I just don't see it happening any time soon.

Re:Network effects

[Al's Hat]

Congress is getting involved in luggage charges by the airlines. I'm sure if they feel there is some advantage to them they'll step up to address the need for a secure card network. You are of course correct that it won't be soon.

Re:Network effects

[socsoc]

Just like all the wonderful stuff they did with the CARD Act? Whatever they do will bite the consumer in the ass.

Just read the fine print

[Anonymous Coward]

Just yesterday, I got a replacement debit card from VISA -- after my account was one of an unknown (to me) number of accounts that might have been "compromised" in VISA's words.

I was astonished to read that their new security features include a limit of $2,500 for a single purchase (or $1,000 for a single cash withdrawl) WITHOUT the PIN. Yes, WITHOUT the PIN!

One-time transactions

[Xugumad]

As others are going to point out, short of a miracle you'll have a hard time persuading banks to move to anything more secure, but...

Currently, if I order online, I give the retailer my credit card number, expiry date, the security number off the back, my name and address. I might as well just post them my passport, in terms of giving them things that can be mis-used. So, better plan; I attach a trusted (as in I trust it, not to be confused with Intel's idea of giving you hardware the MPAA trusts) hardware device, in to which I insert my card. My web browser says "I want to pay $100 to " to the device, the device flashes this onto its own independent screen, and asks for my PIN to confirm the transaction. If I confirm, it generates a one-time usable token for payment of $100, usable only by the named retailer, and sends it to the web browser, to go on to the retailer. If it's intercepted, it's useless. If someone manages to persuade you to pay the wrong person (say a site that calls itself fBay and you don't notice it's not eBay, I don't know), at least they can only take as much as you've agreed to, there's no way they can take more.

For shopping day to day... I don't know, maybe the little hardware device does short range Bluetooth to do a similar transaction sequence with the till?

Yeah, so, not going to happen, but that's what could be done.

Re:One-time transactions

[Zironic]

What's wrong with the software based one-time debit card numbers?

Re:One-time transactions

[Xugumad]

Essentially, they require you to trust a system that is much harder to secure, your local computer, as opposed to a small separate hardware device that is explicitly designed not to be changed. Definitely a big improvement, though...

Solution: Don't use a debit card

[sumbry]

It sounds counterintuitive but the real solution is to just never use a debit card. Have a separate ATM card and credit card.

When you're using a credit card, you're protected automatically when things like this happen. If you claim that a charge is fraud, it is up to the merchant to actually prove that it is a legit charge. This means that your credit card company will remove the money from the merchants account immediately. If they fail to prove (usually by signature or some other means) that you made the charge, they take the hit.

The other thing that sucks about using a debit card is that they do absolutely nothing to help you build your credit. If you're looking to get lower APRs one of the best ways to do that is to use an actual credit card to buy things and then pay off most of the balance every month. When you use a debit card it doesn't register as a balance. If you bought tens of thousands of dollars on a credit card it could do wonders for your score if you pay it off and keep the balance low. Doing that same thing on a debit card does absolutely nothing.

Debit cards also suck because if you use them for things like Hotel Reservations, the Hotel will actually put an AUTH on your card for more than the price of your room. As long as that AUTH is there you don't have any access to those funds in your checking account. Hotels, etc will routinely AUTH you for more than the price of a room, in some cases 1/3-1/2 as much.

Stories from the third world

[Superdarion]

HSBC, the chinese bank, has been handling my money for a long time. I use a debit card and quite freely, I might add. I had never had a problem until about 6 months ago, when I saw a transaction which I hadn't made.

I called the bank immediatly and told the nice lady my problem. What she said was "Are you sure you didn't buy anything from companyname on that date? Alright. Do you agree to pay any charges that could arise if the company has the signed voucher for that purchase? You do? ... ... ... Ok, sir, your money is back in your account. You can use it right away."

It made me feel kind of dizzy to see a company treat me, their client, as a human being. I checked right away and just as she said, the money was back in my account.

A few months later I had some issues with an internet transaction. I clicked the "pay now" button at the end of the process and after a few seconds, the page gave me an error and I just left it there. However, the site did make the charge (even though the company had no record of the transaction when I called them). I had to call the bank again. This time the call took 30 minutes, but the money was back in my account by the end of the week.

Say what you will about the Chinese bank, but they treated me greatly those two times.

Re:Stories from the third world

[afidel]

HSBC is actually a UK chartered bank originally HQ'd in Hong Kong before the return of the territory to China, it has been HQ'd in London since 1993.

Re:Stories from the third world

[mjwx]

HSBC, the chinese bank

Actually HSBC is an English bank. Founded in Hong Kong in 1985, a British protectorate at the time and incorporated in England in 1990, its headquarters are currently in London after being moved from Hong Kong in 1993 in accordance with the rules of the change over of Hong Kong between the England and China. Today the governance of HSBC has little to do with the PRC. HSBC stands for Hong Kong and Shanghai Banking Corporation, coincidentally Hong Kong and Shanghai are currently SAR (Special Administrative Regions) in china permitted to have separate economic rules.

Exercise your Reg E right

[Pagey123]

I work as a network admin for a small community bank, so I have a passing knowledge of these matters. First, fully investigate your rights under Reg E if you are in the US.

http://www.federalreserve.gov/bankinforeg/regecg.htm

There are rules that govern reporting unauthorized transactions and the providing of "provisional credit" by the financial institution. Make sure you read and understand your rights. Hold your institution's feet to the fire, and make sure they act within this framework.

Second, understand that it is difficult to protect your debit card information. It can be stored (and stolen) from so many places. Any online purchase may result in your card info being stored on a server somewhere. Once that server's back end database is compromised, your data is exposed. Or you shop at a store with a POS system that is not well secured. Or your server at the restaurant last night cloned the mag stripe on the card. Ad infinitum.

Now, it's easy to say "make the financial institution liable for all fraud". But keep in mind the sheer volume of ACH payments processed by some of these banks. There's no way in hell that a bank can know for sure, 100%, that you did or did not initiate a particular transaction. However, please know that most banks' core providers have heuristic/behavioral analysis that does in fact look for behaviors that don't match yours. Companies like Fidelity National Information Services (FNIS), for example, actively send out "fraud alerts" that monitor ACH and debit activity on their networks. For example, if your card is used to purchase a product from a country or a domestic location that doesn't match your activity history, your bank can be alerted and the card can be "hot carded". I know it seems like we, as banks, drop the ball a lot, but keep in mind there is a lot going on that customers are not even aware of.

One piece of advice I would give is to just keep enough in the DDA account to which the card is tied to not go into an overdrawn status. Keep the bulk of your funds in a NOW or savings account with nothing electronic tied to it. No debit card, no automatic bill pay, etc.

Re:Exercise your Reg E right

[osu-neko]

... There's no way in hell that a bank can know for sure, 100%, that you did or did not initiate a particular transaction. However, please know that most banks' core providers have heuristic/behavioral analysis that does in fact look for behaviors that don't match yours. Companies like Fidelity National Information Services (FNIS), for example, actively send out "fraud alerts" that monitor ACH and debit activity on their networks. For example, if your card is used to purchase a product from a country or a domestic location that doesn't match your activity history, your bank can be alerted and the card can be "hot carded". ...

Had that happen to me. One day my debit card stopped working, and I immediately checked my activity on the online banking site and it had $800 worth of charges I hadn't made. The cool thing was, they detected the unusual activity even though it was all local -- whoever cloned the card used it locally, so all the transactions were to businesses within my area, in a couple cases to a liquor store that's within walking distance of my home. So geographically, it looked very much like my normal usage, but most of the stores were places I've never been to before, and in the case of the liquor store, buying products I've never purchased before (if a friend offers me a beer I don't turn it down, but I've never purchased alcohol myself). Looking at it myself, it was easy to see it didn't match my shopping patterns, but it surprised me that the bankers who don't know me personally also caught it that quick. I immediately filed a claim and listed all the transactions that I hadn't made myself, and within a couple weeks all the funds were restored. Had they succeeded in draining the account completely, there would have been a few tough days there with no money, but thanks to the bank's quick recognition of the suspicious charges, I was barely even inconvenienced.

Use American Express

[DesScorp]

How the banks advertise it: "Use your own money to shop online!"
What it actually means: "Expose the cash you need to live on to fraud."

The banks like it because you're putting your money at risk, not theirs.

Which is why I've used AMEX for my daily expenses for close to ten years now. It's a charge card, not a credit card, so you don't get deep in the debt hole... you have to pay the balance at month's end. But it has all of the standard protections of full credit cards. Someone, probably a clerk at a store somewhere, used my number for fraudulent purposes, and as soon as I noticed it on my bill, AMEX froze the charge, and launched and investigation immediately. They kept me up to date the whole time. Also, if "suspicious" activity occurs on your account,,,, say, an all-night Ebay binge... they'll temporarily freeze the account and call you just to be safe.

Re:Use American Express

[QuantumG]

Which is why I've used AMEX for my daily expenses for close to ten years now.

You must have racked up a lot of those fees and surcharges that everyone puts up signs about because AMEX demands 2% more than Visa from the merchant and the merchants refuse to wear it.

Re:Use American Express

[natehoy]

Or you can use a credit card and pay it off every month. That makes it the same as a "charge card".

Banks don't want security

[straponego]

They encourage the use of signature cards instead of PIN cards, even though PIN cards cost them much less to process. That's because they can add their cut on top of that price, and pass the cost on to you.

Signature debt card fraud is about 15 times as high as PIN debt fraud. When was the last time somebody checked your signature on a card?

So, it's more wasteful, and enables vastly more fraud, but the banks love it. But I guess that makes sense; bankers are, after all, parasites and crooks under the protection of law.

Let me give another example of how they don't care about real security. USbank's online banking service now interrupts the standard username/password entry process by asking you a "security question." These questions are things that you could find about most people in a couple of minutes, by looking at Facebook/google, knowing them casually, guessing, etc etc. The answers are shown in the clear. So where, on every other site you've ever used (including, until recently, this one) you'd expect to be typing your password into an obscured field (********), you instead are typing into a box that anybody near you can read. Awesome. And in exchange, the security you get is... a trivial question, and a picture from a handful of pictures you're allowed to set as your "security image". Which anybody within 50 feet can see.

[Reviews comment in case caffeine has led to unfortunate or controversial comments. Nope, looks good!]

Re:Banks don't want security

[Anonymous Coward]

Thta's funny, my mother's maiden name is 32 digits of random hexadecimal and differs from institution to institution.

Re:Banks don't want security

[osu-neko]

...and a picture from a handful of pictures you're allowed to set as your "security image". Which anybody within 50 feet can see.

Most people setting up phishing sites aren't within 50 feet of you.

The point of the "security image" is so that if you go to a phishing site, their generic login page that's supposed to look like your normal online banking login page won't have the right picture, or the amusing caption you may have given it (e.g. the picture of a the man holding a gun with a dog in front of him, which I captioned "Support Dog Hunting").

Whether people within 50 feet of you can see it or not is irrelevant to the function it is supposed to serve. Heck, I've just told you which picture I picked... go to town with the info. XD

Re:Banks don't want security

[Sandbags]

The BANKS love signatures because they're not on the hook for those, VISA is. The bank is only on the hook for DEBIT transactions (requiring a pin), and they're only on the hook for certain limits (unless they extend additional coverage, as the only bank I'll bank with all do).

Re:Banks don't want security

[Anonymous Coward]

When was the last time somebody checked your signature on a card?

There's a reason shopkeepers don't bother checking signatures... it's pointless. You can get a lot more information about the validity of a transaction by looking at the person signing for signs of being nervous. And even then it is just pseudoscience and the rate of false positives (detecting fraud via signature verification) is so high that shopkeepers have to just let every transaction pass through if the customer persists.

Try living in a multicultural location where you have people signing for credit card transactions in multiple languages including Chinese, Korean, Arabic, unintelligible scribble, etc. Even highly trained graphologists (again, graphology is pseudoscience) spending hours analysing two signatures couldn't give you results with a satisfactory false positive ratio.

Financial transaction security should be treated more like electronic voting. Complicated encryption systems, fancy hardware and lengthy verification procedures generally don't improve security. As you make the system more complicated you get to the stage where no one (the account holder, merchants or bank) understands what is going on and who is responsible. The key to securing financial transactions is to ensure that everyone involved can easily understand what is going on. As is the case with paper votes... cash is something that people can see, feel and count at every stage of a transaction. Placing a magical crypto card into a magic black box and entering a password leaves both customer and merchant completely oblivious to what is really happening. This is why the onus should be placed on banks - they have the capability to understand their own security systems. You can't expect customers to understand complex cryptography and security.

Re:Banks don't want security

[Anonymous Coward]

And in exchange, the security you get is... a trivial question, and a picture from a handful of pictures you're allowed to set as your "security image". Which anybody within 50 feet can see.

The "security image" is so that you know that you are on their site, not a phishing site. That picture is their secret about you, not a secret that you have to hide from anyone else. I'm almost certain there is a link right under it that explains the whole process.

One last thing... obscuring your password as you type it in is a joke. If your computer access involves someone perched over your shoulder, maybe you shouldn't be banking online there. It's been firmly established here that security through obscurity is pretty weak sauce.

another idea ...

[Anonymous Coward]

One issue is whether the banks or legislation can protect you or not since like bankgeek told us, there are resolution mechanisms in place that CAN be accessed (Regulation E).

Another issue is what can you do, in addition to all of this, to protect yourself.

Step 1. Switch to a pure debit card (not debit/credit). This means that you can only spend what is in your account since the transaction never goes through a card merchant (PIN-based interbank transactions).

Step 2. Add another account at your bank that is not tied in to this debit card. Keep your money there.

Step 3. Move money to debit as you need it on the net.

One time pads

[eluusive]

Smart-style Cards loaded with one-time pad data that are recharged from time to time. No reason why a credit card number should ever work twice.

This is EXACTLY why I don't carry one

[sirwired]

This is EXACTLY why I refuse to carry a debit card. With one swipe, your account is empty and your mortgage bouncing.

With a credit card, you argue with the bank about THEIR money.

With a debit card, you argue with the bank about YOUR money.

Guess which sort of inquiry receives more attention?

SirWired

Re:This is EXACTLY why I don't carry one

[afidel]

Ding Ding Ding, this is the answer. I leave the debit card at home unless I am making an infrequent trip to an ATM. Direct deposit and online banking mean it's only when I'm paying my massage therapist or going to a restaurant I know doesn't take cards (less common every year) that I need cash.

Re:This is EXACTLY why I don't carry one

[Sandbags]

1) assuming you have a mortgage, emptying your account should require more than a couple of $100 transactions... Big transactions, or lots of little ones, especially when it's not in the region of a state you live in, raised BIG red flags, and these are either caught in advance by the bank, or easily flagged and refunded later.
2) assuming you have a mortgage, you have several months of salary in a separate savings or checking account, such to cover emergency situations as not to bounce your mortgage in an emergency. Your failure to do so risks your house and lifestyle, not just a few hundred bucks, and is completely STUPID.
3) nearly all debit card fraud is signature or online transaction fraud, and that is covered by VISA, not your bank. You have 100% protection from VISA under the merchant agreement! It may take a few days to put the money back, but it is NOT GONE. (they have 10 days by law, but typically when fraud is obvious it only takes 1-2 years).
4) Most banks will offer you fast cash in a pinch to cover you for a few days, and will also "hold" transactions as approved even if your balance is too low while the fraud dispute if processed. If you notice your account IS empty, the bank will retroactively approve any bounced transactions from the first evident fraudulent transaction, and they'll call your mortgage company and explain the issue (banking issues causing bounced transactions are covered by either visa or your bank, up to $50 in charger per transaction, and even if your mortgage bounced, they can not report that on your credit if you bank claims responsibility or if you can document having been the victim of fraud)
5) MOST banks use algorithms to look for bad transactions, or call you to confirm large, unusual ones. If you bank is not, move banks.

Use of a debit card may have some risks, but they're small. use of CHECKS is GOD AWFUL RISKY, and comes with little or not protection at all.

Given the choice of using debit vs using a check? Debit. Not having to deal with traditional credit cards (and interest, penalties, and credit reporting hassles when something goes wrong like a lost payment in the mail), priceless.

Re:This is EXACTLY why I don't carry one

[Anonymous Coward]

If your bank treats you that way, maybe it's time to go look for another bank.

I've never had an issue with getting debit card issues resolved in 24 hours, and usually immediately. Oh, wait, I don't do business with large corporate banks: just credit unions and locally owned small banks.

Why do people insist on doing business with these big banks?

Re:This is EXACTLY why I don't carry one

[serialband]

That's not why the credit card inquiry gets more attention. It gets more attention because the law forces them to pay attention. The credit card company doesn't care because, it's not their money. It's the retailer's money. If the credit card company cared at all, they'd have better fraud prevention measures in place. The onus is on the retailers to prevent fraud, because they are the ones that lose money when you dispute the purchases.

The banks keep trying to force debit cards on you. I had to call them many years in a row to send me a regular ATM card not a Visa debit card before they finally agreed to permanently keep my card as an ATM only card. Originally, it was semi-permanent, because they sent me a debit card one more time a few years after the first calls. It took a final 3rd call and me asking for it to be permanant. It took them a while on that call because at that time they didn't have a way to flag it, just put notes. I haven't had to complain to them in the last 5 or 6 years, but they really, really want you to use a debit card. Whenever I called, they'd try to upsell me and I'd had to point out the weakness in their logic by pointing out the lack of laws protecting debit cards.

I already have a credit card, so why do I need a debit card? Credit cards are protected by law. Debit cards not as much. Why would I use a card with worse consumer protections? Debit cards might help some people with poor credit with some convenience, but I have great credit.

3-5 weeks is too long

[Ett]

Visa requires that a provisional credit for any losses be issued within 5 days. Tell your bank that the 3-5 week time-frame is unacceptable and inconsistent with Visa guidelines.

Re:3-5 weeks is too long

[LordKronos]

Mod parent up. This is partially true. However, there are exceptions. ATM transactions aren't covered by the 5 day policy (presumably because the bank is on the hook directly, not the merchant....funny how they're so helpful until it's their money on the line), along with a few other exceptions

Also, here is a pretty lengthy discussion of debit cards, including the risks involved in their use, and a lot of other useful details (including some of these visa rules and the exceptions)
http://www.fatwallet.com/forums/finance/989139

Not trying to be mean...

[billsayswow]

But this feels a bit much like an overreaction. I do feel bad for you, but... This is like saying I'm going to buy a car, and the window sticker says that, since I run the risk of, even if I roll up the windows and use the locks, that my vehicle could be stolen. It then says that I should not keep anything of any noteworthy value in the car, that all CDs I have inside should be a second copy purchased for my car, and that I should inject quick-set cement in the keyholes and take out the battery when I park it. Or... well, there are plenty of metaphors for it. The truth is, even with some of the most clever ideas in the world, bad things happen, one way or another. And most people are willing to run the risk of not having certain precautions in place in order to enjoy the convenience of not having those bogging things down. Having a separate account just for your debit card would be one of those obtrusive precautions, and still puts you in a lame spot if you encounter an emergency expense.

Nothing that would help

[Anonymous Coward]

Pretty much every financial institution seems completely opposed to things that are REASONABLE and would actually WORK.

My method to the money maddness.

[Anonymous Coward]

I run two checking accounts, one of which all my money goes into that does not have an ATM or a Debit card attached to it, and does not have any checks. The second which does. I transfer what money I need from the first into the second as required. So even if they steal my card details and clean out the second account they won't get more than a few hundred dollars.

I never use the 1st acount directly with the public. The money doesn't stay in that account for very long anyway as it heads out in all directions to various saving accounts and mutual funds, leaving just what I need to live through out the month.

The other is that I never do any online banking except from a sterile laptop at home, that is not used for anything but banking. Passwords and user names get changed a couple of times a year.

A bit over kill I know, but then again I've had zero problems with my money.

What can be done? Compartmentalization

[Anonymous Coward]

The Original Poster above is right that Visa & Co will do fuck all for you, but you can do something for yourself: compartmentalize. Create a separate account that is *only* for debit card and nothing else. Put in exactly what you need into this account. If someone steals your pin and number, you'll be (hopefully) getting back any bounced check / overage fees, but otherwise you'll be limiting your risk. As someone who works for a company that has a retail bank line of business (i.e. that's not all we do) I *REALLY* don't understand why some overachieving junior executive isn't trying to drive losses from theft to zero. If -hypothetically speaking- you could negotiate Visa into using a more secure system, you should also then be able to negotiate a better rate for clearing transactions as surely part of that transaction fee has fraud and loss management built into it.

Move the money to a different account

[nameless wimp]

I know that my check card can only access my checking account, so I would have just transferred everything in it to my savings until I got a new card issued. Also, I'd really be surprised if my bank acted this way - they've always been extremely helpful to me (it's a credit union though).

Depends on the bank

[Rytr23]

I have been pretty lucky with the banks I use. Years ago, I suddenly had some transactions from Ireland show up on my card. I went to a local branch and talked to someone. I simply filled out a form, they gave me a new card and refunded the money right there. More recently, I went on vacation and made one transaction with my debit card. About an 30 minutes later I got a call from a strange number, so I let it go to VM. The next time I tried to use the card it was declined. Annoyed I listened to my Vm and it was the bank (TD bank) asking me to call them back. I did and they asked me to confirm the area I was at and what my recent transactions were, once I confirmed them, they reactivated the card. Actually pretty nice of them.

Uhh.... they're British.

[Anonymous Coward]

Sorry to inform you, yes they originated in Hong Kong, but they're a British bank, headquartered in London.

http://en.wikipedia.org/wiki/HSBC

Interac in Canada

[xQuarkDS9x]

I thought the USA and perhaps other countries had what canada has for pretty much all Debit Cards... Interact

http://www.interac.ca/consumers/security_fraud.php

From the first paragraph of that FAQ

What we're doing about fraud

In 2009, $142 million was reimbursed to victims of fraud as a result of debit card skimming. Victims of debit card fraud are protected and will not suffer any financial losses resulting from circumstances beyond their control.

While debit card fraud represents a fraction of one percent of all transactions, Interac Association takes significant steps to prevent debit card fraud and protect cardholders. Interac Association works together with members and business partners to ensure that the Interac services remain among the most secure in the world. Following are some of the initiatives that Interac Association is involved with.

Re:Interac in Canada

[davecb]

The technology can detect doubtful transactions in real time, but what the bank can and will do about a (possibly false positive) warning varies.

Primarily, the response varies by the legal regime you're in: in Canada the requirements on the banks are strong, in the U.K. they're famously weak, and in the U.S. there is a federal standard, plus some state ones as well, of varying strengths.

For transactions that can be verified, such as cheques deposited at a bank ATM, the verification can happen as soon as someone arrives at work. That feature resulted in my getting a breakfast-time call last year, telling me that a false deposit had been made to my account, followed by a withdrawal, and I needed to come in and be issued a new card!

The refund followed the next day.

--dave

Anonymous Coward

[Anonymous Coward]

I have two credit cards, neither of which is attached to a bank that has any of my money. And the ATM card is only an ATM card.

Solution is not regulation

[Anonymous Coward]

So you think you have an inalienable right to protection of your money by a private bank, such that the government needs to regulate it? The bank currently provides you with a service of storing your money, 99.9% of the time completely safe and sound, paying you interest, giving you access to it at thousands of locations across your country (And across the world), and will even give it back to you when it is stolen (even with a possibility of it being your fault), yet you feel it is necessary that the government step in and require banks to point out to you that "Yes, with all this convencience, there is a (very) small possibility that your money may, temporarily, be stolen".

Let me suggest this: if you are unhappy with the service the banks are providing, then why don't you withdraw all your money, close your accounts, and manage your money yourself. No one requires you to store your money in a bank afterall. Compare the level of protection you receive when storing your money under a mattress, as compared to storing it in a bank.

Note that I'm not against banks coming up with better ways to protect our money, they surely are trying to, only that the government need not regulate it.

We've lost sight of something important here...

[JonathanX]

The whole point of a bank (at least originally) was to keep money safe by making it difficult to access. Through the years we have demanded that banks make it easier and more convenient to access our money, and now we are paying the price. Security and convenience are inversely proportional to one another. It is a mystery to me why we, as a civilization can't seem to grasp this basic concept.

Re:We've lost sight of something important here...

[Logic and Reason]

The whole point of a bank (at least originally) was to keep money safe by making it difficult to access.

If that were true, the best bank would have been a locked chest at the bottom of the ocean. Surely the point was to make it difficult for other people to access your money?

Verified by Visa

[xQx]

Look it up.

Visa are doing something about it, so much so that they are enticing people to use it by accepting the liability of fraud themselves - rather than leaving it firmly with the merchant as it is today.

The problem is an existing system that works worldwide with millions of users is BLOODY HARD TO CHANGE.

You will probably see it introduced at about the same pace as IPv6 (which suffers from the same 'migration issues')

Re:Verified by Visa

[Enigma2175]

When I was forced to sign up for VbV I was amused to find they had a MAXIMUM length for passwords, 8 chars IIRC. If they get such a fundamental part of the security so horribly wrong I have little faith that the non-visible processes in the mechanism are any more secure.

Re:Verified by Visa

[dzfoo]

"Verified by Visa" is a joke. It is a blatant attempt to shift absolute, unconditional liability on the issuing bank. There is little improvement in security underneath, and most of the interface between the retailer and the underlying system is left to each online merchant to implement on their own, offering varying degrees of actual, technical security.

The customer is supposed to feel all warm and fuzzy inside by the mere fact that there's a "Verified by Visa" logo on the web page, just like they're supposed to feel completely safe when they see that little pad-lock on their browser toolbar. But ultimately, there are many inconsistencies in the implementation and not much more actual security than if you went without.

        -dZ.

Re:Just do your security

[Anonymous Coward]

I always use a debit card. I asked for a special version that doesn't work offline (the VISA electron), the card-reader terminal must be connected to internet. I also requested that the balance must not go below zero.

How am I secure? I don't leave much money on the account of this card, just the daily necessary. If I lose it or it gets stolen, they won't get much.

For big payments between trustful people, I always use bank transfers. For Internet payments, I always connect over a VPN (if I'm using a public WiFi) and use virtual VISA cards which are one-time use with a upper user-defined limit.

Short answer: DON'T USE ONE

[gurps_npc]

A debit card is a fool's device. It has all of the disadvantages of a credit card without the free use of a months worth of money. Pay the messily $55 for an American Express card. It has all of the advantages of a credit card without any of the disadvantages. The money is worth it and you can make it up in a years worth of whatever point system you like (I like ONE, because it pays cash quickly.)

My bank (local) cares about me...

[Anonymous Coward]

I often hear people from US Bank and other large banks having problems where things like this happen and they get screwed...

I happen to use a local bank, many of the people there know me, they know my accounts and are always happy to see me. I have had a couple instances where my check/debit card (which can be used for Visa transactions) was compromised. I went to the bank, they gladly discussed the issue with me. I made a sworn statement about what happened (or didn't happen... like me not even being in florida at the time). Within two weeks they were clear about me not being where the transactions were made and reversed the charges.

I hear from people using larger banks that they just get screwed over. The banks don't make the effort and just pass the loss off to the client. My bank cares about me and they know if they don't protect me and reverse wrongful charges, that I will share my sentiment with others.
------

Anyway.... Large banks are somewhat impervious to complaint/criticism. I will *never* bank with US Bank after what I've heard from people close to me, but they will still thrive.

My point is that local banks are much more likely to care about you and do their best to protect you.

don't need to check balance daily

[pikine]

If you are pedantic, you would have read this:

However, for unauthorized transfers involving only your debit card number (not the loss of the card), you are liable only for transfers that occur after 60 days following the mailing of your bank statement containing the unauthorized use and before you report the loss.

You don't need to check your balance every day, only that you still physically possess your plastics. If you make sure everyday before you go to bed (or do it first thing in the morning) that you still have your credit cards, you can just check your balance once a month.

Re:The only way is special accounts for Debit card

[Belial6]

Bingo. Check/Debit cards are fraud magnets by design. Heck, when they were first introduced, Visa actually ran ads showing how easy it was to commit fraud with them. They would show how hard it was to use a check because you had to prove who you were, but with a Visa check card, you can buy whatever you want without any evidence of who you are. Check cards have all of the lack of security of a credit card, and all of the risk of an ATM card. It is simply an ATM card without a pin. Who in their right mind would think that issuing ATM cards where using the pin is optional is a good idea?

The Bill Paying/Spending Account Free Checking Opt

[MDillenbeck]

Best advice? If using a visa check card, use a second account. Do not link it to overdraft protection to your main account (or in any other way, such as a "loan" to cover overdrafts at high interest rates). Keep a low balance, using online banking to transfer money as needed into the "spending" account. Then make sure your bank does not provide a check card for your main of "bills" account. This way, if you ever get hit with a scam you loose a minimal amount. Case and point. I had such an account, and all the sudden it went from $25 to -$75 due to a fraudulent paypal billing. We contacted the bank first, and they said "oh, that... don't worry, we'll take care of it". Apparently, fraudulent paypal billings are extremely common with my bank. We got the $25 back and immediately closed that account, and since it was totally separate for us it meant that none of our important bills went unpaid (though I wasn't able to get some takeout that week). The point? The only option is for you to be a smart consumer and figure out how much you are willing to risk at any given moment. Otherwise, get a real credit card that you pay off every month and gives you virtual account numbers for purchases. That will also minimize risks.

...but lets be realistic

[MDillenbeck]

These charges were fraudulent. This may or may not affect your ability to pay your bills, buy food for your family, put gas in your car to get to work, and so forth. It could wind up costing you significantly more than just the charges in late fees and a damaged credit rating (which affects everything from loan rates to car insurance payments). These will haunt you for years to come. There are ways to minimize risks, but it sounds like you're saying to the family of someone murdered "stop being such a cry baby, people die all the time... its just the risk we take for living". In other words, maybe a little more empathy for the crime victim and a little less blame along with a dash of constructive advice would have been ... tactful.

Doesn't happen like that in AU

[double07]

Banks must roll differently stateside, here in Australia my visa debit card has been compromised twice. Both times I was contacted by the bank (different banks in each case) before I even knew what was going on. They had a new card and number out to me in 3 days and the dodgy charges were refunded by the time I logged on to my internet banking to check.

Another time I was on my honeymoon and the resort we were staying at put a rather large hold of funds on my visa debit card. My bank rang me and said they had a large charge on my card and asked if it was ok.

Impressive all round.

It happened to me today...

[gregstumph]

I got a letter in the mail today from Monoprice, saying that they had recently been hacked, and that a transaction I had with them feel within the window of lost data (credit card number, name, address, AND phone number??? Seriously, there is NO REASON for them to be storing this data "in their database"). I immediately called my bank to cancel my debit card, and while I was on the phone had them check to see if there were any pending transactions. Lo and behold, there were over 20 transactions TODAY for Blizzard Entertainment, for amounts ranging from $14.99 to $25. Also a couple of $1 charges to the Apple Online Store, probably to verify that the card was still good.

So I assume some criminal gang stole the CC numbers, then planned to rack up a bunch of WOW time to re-sell? Or something?

The back has assured me I won't be liable for any of it, but I'll believe it when it's over...

Re:It happened to me today...

[gregstumph]

s/feel/fell/
s/back/bank/

(argh. spell check only helps if the typo is also a misspelled word...)

The banks could include passwindows into their car

[Mattpw]

There would be no implementation costs as its just a printed pattern on a transparent region of the cards and the online authentication security exceeds the vast majority of electronic tokens, even being able to do transaction authentication to defeat MITM attacks.

derp

[Anonymous Coward]

My boyfriend had this happen to him with his National Australia Bank visa debit card, except someone just withdrew it from an ATM somewhere down here in Tassie. He was told 21 days, but in reality it was closer to 7 days. Since then I've mainly been using Paypal for online transactions except on sites I trust (and I always check URLs and whatnot), I'm very careful about covering my hand when typing in my pin at ATMs, and I always check for skimmers. Hmm.

Account Alerts

[TheMeuge]

All of my accounts will alert me by text and/or email of any transactions exceeding $500, or if the monthly transactions exceed $2000. I don't need to monitor my accounts daily, because the most anyone can take without triggering an alert is usually $500.

That being said, I check my accounts on a weekly basis, which is a good habit to get into. I get my balance and recent transaction history emailed to me on monday mornings, again using the banks' own systems.

Account alerts are wonderful tools. Use them!

Re:Account Alerts

[jimicus]

All of my accounts will alert me by text and/or email of any transactions exceeding $500, or if the monthly transactions exceed $2000. I don't need to monitor my accounts daily, because the most anyone can take without triggering an alert is usually $500.

That being said, I check my accounts on a weekly basis, which is a good habit to get into. I get my balance and recent transaction history emailed to me on monday mornings, again using the banks' own systems.

Account alerts are wonderful tools. Use them!

All a system like that does is discourage fraudsters from taking more than $500 in one transaction.

So they're not going to be buying a car with your card, but there's plenty of other things they could buy.

Start with your Senators...

[Anonymous Coward]

Vote every one of them holding office now, out.

6 out of 8 transactions at WhaaaMooo were fradulant not dangerous... ILLEGAL!

The Senate is supposed to provide oversight this crap. They actively encourage it!

They are domestic financial terrorists, throw them out of the fucking office.

What can be done

[oshkrozz]

This needs to be addressed from two angles 1) Write a letter to your local representative in government explaining the situation and how difficult it is to deal with the banks and some solutions that are well though out and can be instituted. Do this as a real letter not an email, the truth is as much as banks have lobbies you get the right person at the right time (say right when his best friend was hit with identity theft) and it will make a real impact and make the representative less receptive to the bank lobby. After you finish step one there are a few options for step 2 depending on the tech you have and if you travel out of your country allot. The best option is you travel rarely out of your country, you have a smart phone and don't like to use credit cards a) Get a bank that works with said phone online b) make sure the bank offers a pre-paid debit card and same day fund availability when you transfer with no fees and such nonsense c) put $50 on the card as a base d) anytime you want to make a larger purchase transfer funds with your phone and use your card If you travel out of the country increase the amount to say $200 and replenish as needed from internet cafes or hotel. This way if your wallet is lost or stolen you are temporarily out the money (the per paid cards are debit cards so have the same protection as debit cards) and they are better then carrying around a wad of cash. The other option as people have said is use a credit card normally a quick search online will reveal if people had a very hard time with a given card or bank and you will find better support from a smaller bank but not always better award points and so on.

Get an actual credit card

[Ritchie70]

I know this may not be popular, but debit cards are dangerous if lost, especially if a branded debit card. (I think that's the "proper" term for a Visa/MC/Discover debit card. It's what our treasury and acquirer/processor folks use, anyhow.)

I have a branded debit card issued by my bank, but it expired two years ago. I use it to get cash out of their ATMs. Because it expired it's unusable as a Visa card.

For my day to day purchases, I use a proper MasterCard - a credit card. Everything goes on it - I've gone weeks without touching cash.

I pay it off every month. I don't charge things I can't afford. If I lose it, at most I'm out $50.

More likely, Chase will phone me and ask if I really ordered a computer to be shipped to Nigeria, and I'll say no.

The ONLY problem I've EVER had was that Chase didn't get my profile right for a while last year - they were shutting down my card and calling me once a week to confirm things I really did.

So I used my Citi card for 6 months, let Chase cool off, and now I'm back to Chase. So far so good.

And I earn points. Lots of points. Points I can use to get free stuff. Do you get that with cash?

A Stolen Card, Not Identity

[Anonymous Coward]

The original poster had a stolen debit card number, not a full identity. True identity theft opens credit lines in the person's name. Those unpaid loans result in much worse than an empty bank account. Identity theft is much harder to track than a missing card.

Credit card stolen

[nuggz]

Well this is why I have 2 different credit cards and bank accounts at two separate institutions.

1. I use my credit cards, they caught suspicious activity once, killed the card and called me immediately. I got a new card within a few days, in the meantime I had my other card.
2. I had trouble with my bank once, just walked over to my other bank and they gave me a small Line of Credit on the spot. I never plan on being tied to a single institution again.

Personally I don't touch debit cards, I only use it to go and deposit paychecks or occasionally withdraw money. For almost everything I simply use my credit card. I don't understand why anyone would choose to use a debit card over a credit card.
Credit card gives me money back, I know fraudulent transactions are caught, and I get a free 30+ day loan on everything I buy.

Interesting, cos a bank account isn't your money

[Colin Smith]

Legally.

In most countries a bank account is legally a loan to the bank. Legally it isn't a safety deposit box where they store your money for you.

This means the money is theirs to do with as they please and they are graciously allowing you to use their credit instead, with the attached terms and conditions.
 

This is WHAT WE PAY BANKS TO DO FOR US!

[commport1]

Think about the fundamental reason we use banks - they protect and secure our money. Think back to the Gold Rush era, they upped the security until the robberies stopped. This problem (and it's solution) lies solely with the banks. I hypothesize that it mustn't be costing them as much to pay out on Fraud claims as it would cost to implement effective security countermeasures. A couple of things they are already doing: Verified by Visa: http://www.anz.com/personal/credit-cards/security/verified-visa/ Security Chips: http://www.anz.com/personal/credit-cards/security/chip-cards/ 2 suggestions of mine: compulsory presentation of Photo ID for every CC transaction, and biometrics.

Recently got a Visa Debit card

[Anonymous Coward]

I got a Visa Debit card for a new account which I opened this week on Monday. I've kept the limit freakishly high for now because I need to purchase some stuff online. Once my credit cards arrive, I'll go back to a low limit on the debit card.

For online shopping, the bank says I get a self-typed personal message when I try a transaction, which I need to answer for it to work. It's not activated yet but I presume that if my card is stolen, they still wouldn't be able to use it online.

For retail shopping, I thought all debit cards need you to enter your PIN number when shopping? Which means any theft requires the thief to also know your PIN. Personally, I think they should let you create an ATM PIN which is different from your Shopping PIN for added security. But if the visa debit card works just like a credit card (sign and that's it) that's bad. What about presenting the signature/signed receipt? If you use your debit card like a credit card, then it should be required for the retailer to show your receipt. If they can't produce it, then the charge is reversed and your bank takes your money back from their bank and gives it to you. Except for that last step, should be how it works for credit cards as well.

Agreed, faked signatures are an issue as well. PINs are a good option for all debit cards...and credit cards. No manual signature checking involved. Paranoid option 2: carry an RSA key thing (which some banks use for online banking, along with one-time-passwords sms-ed to your mobile) as an added security to knowing your PIN.

This is all becoming a security compromise for the sake of convenience - something, we, as a generation of species, need to move past.

temporary debit cards

[Pohtaytoh]

You could start using one-time use, or temporary debit cards. They aren't linked to your bank account, and you'd be able to set an amount you'd like to use for the week or whatever time period. This has the added benefit that if it were stolen, they wouldn't be able to take all of your money.

I believe there are various companies, including some banks, that will generate them for you.

vaso is the answer

[Anonymous Coward]

cards need to have a blizz authenticator like chip/screen implanted in them that verifies you are who you are whenever a purchase is attempted to be made by your account.

Regulation E Dispute

[sysgeek01]

http://ecfr.gpoaccess.gov/cgi/t/text/text-idx?c=ecfr&sid=635f26c4af3e2fe4327fd25ef4cb5638&tpl=/ecfrbrowse/Title12/12cfr205_main_02.tpl

The bank HAS to refund your money.....

[JoeBanker]

I work IT in a community bank. I work very closely with our Operations and Fraud department. Here is what I can tell you about VISA debit card fraud. If you are a consumer, you are totally protected IF you report your debit card being lost, stolen, or compromised within 3 days that you became aware of it being lost, stolen, or compromised. The bank will also have a hard time proving when you found out you had a problem with your card. The bank HAS to give you your money back. VISA and Washington D.C. make all of these rules. The little known secret is that banks take huge losses on debit card fraud because the regulation coming from Washington D.C. totally protects the consumer. Most of the time in a fraud case, the bank isn't able to recover the money from the merchant and they have to refund the money to the consumer. Therefore, the banks lose money on VISA debit card fraud. As consumers, you really have nothing to worry about when it comes to VISA debit card fraud. You are totally covered. If you have a VISA business debit card though, you are not covered by the regulation and you are subject to taking losses in a fraud case. If you are a business owner, you better be REALLY CAREFUL when it comes to who has business debit cards tied to your accounts. In your case when the bank said 3 - 5 weeks to return your money, you should change banks. Go to a good community bank or credit union in your area. Somewhere that will recognize you as a person and not a number. Stay away from the large nationwide banks and regional banks. Especially the ones that are having loan trouble. They are trying to stay afloat by sticking all of their good customers with lots of account fees. I use my VISA debit card everywhere and never worry about fraud. You should do the same. I do suggest that you be careful using it on the Internet. As a computer security professional, I do recommend that you practice good computer security.... AV, Web Filtering, OpenDNS, Patching, etc....

Plan ahead. Use cash or prepaid cards.

[devleopard]

I know that sounds ridiculous, but the current system really doesn't prevent this kind of theft. Maybe this is a sign that we need to get back to a budget life - where we plan everything ahead; if you don't spend $ unexpectedly, you shouldn't have much problem having the cash on hand. This kills spontaneity, yes, but that's probably a big reason why we (in the US at least) have a negative savings rate. Hell, if you're clever, you can get discounts for paying cash (since you're saving the store 2-3% that they'd pay to process a card, or the wait on checks).

For online purchases, maintain a prepaid card with limited funds, or use PayPal - honestly, I have a high degree of confidence in their system, or at the worst, it isn't any lower than the confidence I feel towards the plastic in my wallet. If an online vendor doesn't take PayPal, well, there's always another one that does.

Had my Debit card duped in March.

[Phizzle]

I only uses the card as a debit card at Barnes and Noble and at Costco. Someone duped my card and did max withdrawals over a period of 4 days, using a series of ATMs at Chase banks in Southern California. My bank replaced the funds within days. Got police reports started immediately but haven't heard a peep from the SoCal police. Freaking annoying and makes me want to go Gordon Freeman on the thieves with a crowbar. Your mileage with your banks Customer Service may vary.

Get a credit card

[pushf popf]

You know debit cards are insecure. Get a credit card and get over it.

Debit cards are nothing more than a great way to screw you. The banks know this and now you know it.

If you have a credit card, you're protected by the Fair Credit Billing Act, which means you're liable for up to $50, although in practice, the banks often waive this as a "card benefit". I have absolutely no clue why any sane person would use a debit card since the liability is nearly infinite.

or Join a Credit Union

[seawall]

Typically Credit Unions are less jerky about this stuff. Mine was very fast and, as a policy, treats identity theft of credit card AND debit cards the same.

That's not to say any given Bank might not be better than any given Credit Union but, on the whole, I have WAY more trust in my local credit union than my now non-existing bank.

Verbal checks

[bjs555]

I'm wondering what the risks are in using verbal checks (paperless ACH transfers). I pay my monthly electricity bill that way since my power company adds a "convenience charge" for using a credit card. As far as I know, the only thing needed for a verbal check is the account number and bank routing number. What's to stop anyone who knows the account number from issuing a verbal check to themself? The routing number for any bank is available online or by calling the bank. If I dispute a verbal check is the bank required to reverse the charge?

Who would use a debit card off primary checking?

[bwave]

This is what an American Express card is for, you use it for your daily purchases, and you pay it off at the end of the month, no interest or fees. (other than annual fee). You get up to 20 days of float on your money also if you were to keep a money market account that you write just your mortgage payment out of etc, and use your Amex to pay everything else. If place doesn't accept Amex, then I'd recommend Paypal's Mastercard debit card, you transfer money into it, so you're never going to overdraft it, and their fraud dept is really good, and they are prompt on their security investigations. Plus again, it pays you interest on any balance, and cash back on (credit) purchases. For my business I made my merchant account (credit card processing) account a totally seperate account than my primary checking, I siphon money off every morning to the business account. But, that way if someone does a chargeback for a a large purchase and they put an investigatory hold on my account, I don't have vendor, payroll, mortgage checks bouncing... then again, I don't anyway, because I deal with a local regional bank (only 10 branches) that calls me anytime there is any problem, and gives me a few hours to make it right. This is why you don't deal with the bank of america's of the world. With a small bank all money deposited (including checks for anywhere) are available for withdrawl immediately, any overdrafts are recorded at night, and you have until 11am the next morning to make them good without paying any sort of fee, should you overdraft, they will go ahead and pay the item, and nearly all the time refund your overdraft fee if you talk to them. This is one way to get small loans, as they will let you overdraft your account and pay it back a couple days later for just a $30 fee... yes $30 might be alot on a $2500 loan but comes in handy in an emergency. This is why you get off your lazy a$$ and go to the bank and make deposits, INSIDE the branch, not the drive through. You get to know your bankers, and they get to know you. My bank offers free remote deposit capture, including they will give you all the hardware, but I still go into the bank about 4 times a week, just to make myself known.

socialist asshole

[Anonymous Coward]

I know, the title is trolling. Regulating banks is one thing that the constitution expressly allows. However, since 2 stays, Deleware and one of the dakotas are the only 2 exceptions to states reasonably regulating consumer banks, there's been no huge needs to do this to a greater extend then recently. Also note that MBNA owns the vice presdient and has for 30 years. Nothing will change.

As for non-profits, they're called credit unions. Ditch your usurious bank and go with a credit union. https://www.cusc.net/

Almost fraudulent action by those merchants

[rickb928]

"told that they couldn't use the card since it wasn't a Visa or MasterCard check card"

That's called 'steering'. Lots of reasons for that:

- Avoiding higher-cost forms of payment or perfering lower-cost forms; Losts of places that honor American Express try to steer customers to another card, as Amex often has the highest discount rate. Sometimes merchants avoid signatures and ask for the pin number to avoid the slightly higher discount for signature transactions. The issuers like higher discounts, so they run promotions like double points for signing for a purchase, etc. Oh, and rewards cards almost always cost the merchant more. You thought those points were free? All of these tactics are steering, by the merchant or the issuer.

- Some cards are more 'unreliable'. Those 'check cards' are always tied to an account. A 'debit' card might be pre-paid, and if something isn't quite right about the authorizaiton process, a merchant might not get paid if the funds are exhausted before they settle. It's not supposed to happen, but there are situations...

- Some merchants have agreements that kick back fees for certain cards, especially for larger volume or larger dollar-value transactions. That encourages steering, just another reason.

- Some card type are subject to more fraud than others, and merchants that understand that can either avoid those cards or treat them with extra caution. Address verification or matching the signature to another form of ID, for instance.

- It's not impossible that some merchants have agreements that expose them to more risk for certain card types. Online gambling outfits suffer huge losses, and are thrown under the bus by card issuers all the time. It's a dirty business. Any business where they don't have the card there (card-not-present) are usually more exposed and have to take more precautions. Even other fairly normal industries suffer more fraud. Fast-food restaurants for instance, etc. Some of these industries don't even bother to challenge chargebacks, as it's too small a portion to worry about. I'm regularly surprised at how merchants don't handle risk well at all.

Almost all issuers have agreements with merchants that prohibit steering, as well as charging more for card transactions than for cash, or requiring a minimum purchase for a card transaction. It can be hard to prove, but not impossible.

It would be interesting to ask one of these merchants why they don't accept a 'debit' card. I would not be surprised if they concoct some bs story, though the clerks may be told anything by the boss to get his way.

Re:Almost fraudulent action by those merchants

[Anonymous Coward]

If it isn't a 'branded' card then they don't have to accept it, even if they have an agreement with a brand like Visa.
Merchants are under no obligation to accept any particular form of currency, including cash.
If they told you they only accept gold, then you can't force them to take dollar bills.

How do you think places get away with "We don't accept bills $50 or greater?"

Avoid using credit/debit cards

[Anonymous Coward]

I had a very similar situation happening to me and just in the past year several of my friends and colleagues had their credit card info stolen and their account cleaned out. While credit card theft is rampant, many people still don't seem to realize in how many ways credit cards can be compromised and that there is no such thing as a "secure transaction" since 128-bit SSL has been broken or at least CA certificates are being spoofed like crazy. Unlike what credit card companies claim in their commercials, in most cases they may block your card right away but may still charge you and put the burden of proof that fraud has occurred on your end. The best things you can are paying with good old cash (both, merchants and people waiting in line behind you prefer that anyway) and use ordinary money orders for online purchases (no risks of "check washing" etc.). The risks of falling victim to credit card fraud and suffering losses or at least major inconveniences are simply too high nowadays.

This happened to me too

[Fish (David Trout)]

Well, almost.

I didn't so much have my ATM Debit Card card stolen as I did my identity.

What they (the criminals) actually did was electronically "skim" my card, thereby obtaining not only all of my bank account information (account number, etc -- all the stuff recorded on the magnetic strip of the card) but also my pin number. (Their keypad where you enter you pin number into was connected to another box that saved the two pieces of information together so they has everything they needed to clone and use the card).

We noticed it on the next bank statement. There were transactions for places in California and we live in Seattle, WA and we don't travel.

The next day I went to the bank to deposit a check and asked the teller what I should do. She immediately asked me whether I happened to make any purchases recently at the store across the street. Surprised that she would know I answered yes. She then told me the cops has just arrested the owner for fraud/identity theft. Apparently there were many dozens of victims, all in this area and many of them also customers of the same bank as mine (Bank of America).

Long story short, the bank refunded the entire amount (over $900) while the investigation was underway since it was likely the investigation would complete in my favor (and since they obviously had the resources to recover their losses better than I did to cover mine).

I'm surprised your bank isn't handling the situation similarly, unless your card was indeed stolen and not simply used as part of a much larger across-state-lines wide-spread identity theft ring (which the feds (FBI) took over investigating/prosecuting).

A random mistake scared me away from Debit Cards

[Anonymous Coward]

About 15 years ago I ended up with an unauthorized $150 charge to my credit card from DirectTV. The quickly issued me a refund and there wasn't any other fraudulent activity. I wasn't a customer of theirs and had never given them my card number so it seemed this was just a random error of an incorrectly entered card number. This made me think about similar mistakes that could happen with debit cards and the trouble I'd be in if my checking account was suddenly emptied. I've insisted on having only an ATM card from my banks since then and this post reminds me why that was such a good practice. Using a credit card as a charge card is much lower risk.

The beauty of the credit card over debit card

[Anonymous Coward]

If fraud DOES occur, even if your bank has a zero-liability policy for PIN-based debit transactions (non-signature) -- which is unlikely -- with a credit card, you just dispute the charges and DO NOT HAVE TO PAY and don't lose ANY money even temporarily. Unlike a debit card where your account is missing the money until the bank finishes and refunds it. As long as you can control your spending and pay off your credit card in full every month, credit cards will remain the superior plastic money.

BAAAWWWWWW

[Anonymous Coward]

Seriously, you must be 18 like I used to be. I got a few credit cards, didn't understand them, and for a while blamed them for my poor decisions. Sure, I should have not signed up for them, but I also didn't read the fine print. No matter how shitty small the print is, its worth it to read it or pay a lawyer/notary/editor to read it and summarize it. You sign an agreement, you know what you're getting in to. If you don't read it, you can't hold anyone else responsible. At first it sounded like you were talking about the theft of your card by technical means worthy of discussion on Slashdot - instead, you're whining about the bad decisions you made yourself.

I have debt. I'm working and paying it off. I should have known better, known what I was getting into, known it was a bad idea - but since I didn't, I got shafted. It doesn't take a scam to drain your bank account, and you can't force regulation on something like that.

a nice low tech fix

[smagdali]

My South African bank has a nice, highly effective, easy to implement, widely available, cheap, and easily solution that doesn't eliminate fraud, but certainly minimises its effects. Whenever I use my (VISA) debit card, I get an SMS with the date, time, amount and location. I, maybe, in a week, make 20 card transactions, so the cost is 50c/week max to the bank buying in bulk. If I see a transaction I don't recognise, I phone the bank. compared to all the mostly wasted investment in PCI (including all the requirements that weaken rather than strengthen your website's security), the phishing friendly bullshit of Verified by VISA etc, it works like a dream.

checks

[Anonymous Coward]

Did you know that someone with your checking account number can also empty your account without your permission?

So, no checks, no check-cards ... no ATM cards, leaves you with just cash and Visa if you want to avoid having your cash drained.

I run a separate account with a small amount of cash for ATM use. I haven't figured out what to do about the checking account draining potential. So far, I've been lucky.

Oh, and definitely shut off all internet-access to your banking and investment accounts. When I called Vanguard, the customer service folks were confused as to why I'd want to shut off on-line access. I simply asked them what would happen if our kids or babysitter downloaded a password sniffer on our home PC and someone drained my account using my credentials. They said they guaranteed my accounts against losses due to hacking of their systems. I said "yes, I know that, but it's not your system that's been hacked, it's mine." and they had no answer. As far as I know, right now US law doesn't protect me when someone uses my PIN/Password to drain my accounts. So, for now, I use paper-based statements and phone-based transactions.

dumb and dumber

[Anonymous Coward]

Man that guy must be stupid.

Why didn't you take all your money out of that account or just canceled the card?!

"Naw, I'm just going to sit down here watching the thieves travel on my money. Oh joy! Where will they go next?"

unbelievable...

prblem has been solved 10 years ago

[Anonymous Coward]

A credit or debit card has NO security at all, it's just a number.

Almost every European country is using the chipped bank cards, I've been using online banking for almost 10 years now, completely secure (in Europe you get a token device for online banking)

On top of that, if you choose the right bank, transactions costs are very small.

I run my own company, and I only use a credit card when dealing with American or UK companies, and I only deal with companies I know, I ask them to destroy my card number after the payment, and I get my card replaced every 3 months.
You just have to, when the limit on the card is 50000 euro.

I tried to use what Americans call "wired" transfers (that's what we use in Europe for all transactions), and then I noticed that American banks charge enormous costs for "wired transfers", why? Because they really don't want normal transfers from one account to another, the US banks want to lend money (CC card) as much as possible, so they can charge interest.

the UK and the US bank systems are at least 10 years behind compared to the rest of the world.

Needs fixing pronto

[dugeen]

I avoid using a debit card wherever possible for just this reason. The exception is with retailers (scum) who charge extra for paying by credit card - if I'm forced to deal with one such, I always change the PIN number immediately afterwards. UK banks have been ripping people off with this debit card thing ever since Chip & Fraud was introduced - they share your PIN with retailers, you get the blame for fraud!

Change Bank?

[Zelos]

I've had money taken from my account twice in 10 years. Both times I phoned my bank, reported the transactions as fraudulent and they credited me the money back by the next day. A week later they sent me a legal form to sign declaring that I didn't make the transactions, and that was the last I ever heard about them.

What does annoy me is the way they automatically block my card every time I use it abroad. Last time I went to the US they blocked my card after I used it to pay for my hotel room, then their automatic security system phoned me at 4am local time to ask if the transactions were legitimate.

You have already been warned and informed.

[Lord Bitman]

Check cards draw money directly from the account they are tied to.

What more needs to be said? I understand that you're upset your money got stolen, but how much more clear than "Check cards draw money directly from the account they are tied to" can one get? This isn't even a common sense thing. This is a "here, we have explicitly told you what is going on, and if you can't understand what that means you really shouldn't be given a bank account in the first place."

Re:You have already been warned and informed.

[Skapare]

He needs a separate account for the check card or debit card. Maybe even more than one. I currently have 2 of them. I don't keep them at zero from my convenience. But I keep them at levels I can afford to be without for a long time, or even afford to totally lose. My bulk money is stored in 2 other accounts with NO cards associated, and at different banks. I also keep enough cash tucked away in a secret place that I can live on for a couple months (which isn't that much if I stay away from beer, pizza, porn and newegg).

Re:You have already been warned and informed.

[Lord Bitman]

cool. I have a credit card and live in a country where banks are required to give you your money back if they give it to some random person who says "lol I'm that guy"

Yeah sure. Lots of nonsense.

[Anonymous Coward]

Unless you area trader of some kind or you own a shop selling groceries, you will not be paid in cash.

Salaried people everywhere (I have worked in Mexico, Malaysia, Thailand, Vietnam, Germany, UK and US if you must know) are paid with an electronic deposit to their bank account.

So then what? Are you seriously saying that you are going to queue in a bricks and mortar bank once a month to make a big withdrawal? Or even worst, several times a month to make smaller ones?

Lets assume you have your wads of cash, now everybody and his dog in your community knows your the lunatic that is carrying cash with him. Good luck with that one.

As for cheques, well, here in the UK they will be pahsed out in a couple of years, and I don't know elsewhere, but in the UK they were never a guaranteed from of payment, banks or payees could come after you years later demanding payment if something irregular has been found. THat does not really matter, tha fact is that you will not have cheques anymore in 2 or 3 years time.

EMV Works

[strewelpeter]

So many comments, so little common sense.
EMV is the answer, it works and is perfectly safe despite what the media whores in Cambridge tell you.

Adult or child?

[Anonymous Coward]

I am an adult and act responsibly.

I have been using credit cards for 20 years and have rarely paid anything but the amount I owe due to my purchases.

The bank is providing you with a credit facility, if one does not learn to use it the cardholder is the only person to blame.

easy

[Anonymous Coward]

The card is only half the problem. The terminal is equally to blame.

one solution;
1. chip and PIN
2. liability transfer to non-compliant party (acquirer or issuer)
3. remove mag stripes

do nothing - setting yourself up to fail

[Anonymous Coward]

This type of fraud is going to hit the US BIG time in the next 2-3years, why? the rest of the world is moving to EMV. Skimming will cripple US payment systems within 5years if nothing is done NOW.

Get the law changed

[Anonymous Coward]

Here in Denmark, if I dispute any charges the bank has to transfer the money back immediately. This is consumer protection law regulated.
If their investigations shows that I need to pay, they can get the money back at that time + normal interests + a fee of around $50.

So I don't see any risk in using debit or credit cards.

The system I designed ...

[Skapare]

... would never be used by the banks because it requires them to become technically competent and to lose a nice revenue stream of milking victims even more by charging overdraft fees and late fees. But here goes, anyway ...

For online purchase, once you check out, the merchant sends the amount to their financial service provider. The FSP connects to a central clearing house and generates a unique transaction code. The CCH stores a description of the transaction and the ID of the merchant. The transaction code is sent back to the merchant. The merchant provides this code to YOU, the buyer.

You go to your bank web site and select the CCH payment screen. It has a place for the transaction code which you cut and paste from the merchant site, and submit. The bank connections with the CCH and obtains full details of the transaction and displays it for you. You verify that it looks familar. The bank tells you if you have enough money to pay it or not. When you choose to pay it, the bank tells the CCH that it is now paid. The CCH tells the merchant's bank that it is paid. The merchant's bank tells the merchant that it is paid. If this isn't done by a transmission push, then at least it can be done by the merchant pulling a status on the transaction code they generated. Back at the merchant web site, you can query the transaction and see that it is now know as paid (after the process finishes, which might take longer during Christmas).

Your account is NOT exposed to the merchant or the merchant's bank. Optionally, you can include your previously stored shipping address (or pick one from several) with the payment and the merchant can use that.

Offline, this is harder to do. Cash may be better there. But it is still doable by having a portable device YOU TRUST with the right software. This could be integrated into other portable devices, like a phone or music player, if you trust that. The mechanism would involve an infrared communication between the vendor (via their cash register) and your device. The vendor sends your device the transaction code, and provides a channel for you to send data to/from banks (and only banks) via a central bank connection. Your device establishes a secure encrypted connection to the CBC using the CBC public key. It then tells the CBC the identity of the bank (the merchant will not get this info). Over that secure channel a 2nd channel is forwarded to the bank. Now the device establishes a secure encrypted channel to your bank using the bank's public key. It logs in to your account at the bank, tells the bank what the transaction code is (the bank now goes back to the CCH as above). You see the amount of the transaction on the device and choose whether or not to pay it. If you pay it, that info gets back to the merchant and you can walk with the merchandise.

Additional security will be needed within the device and your home computer. Your bank will have to manage your account safely (e.g. not let others log in to your account). But those are mechanisms YOU have some control over (change banks if you have one that is sloppy with security). You do not have to depend on a merchant being secure, or the merchant's choice of bank being secure. At the same time, because your identity may not be included with the payments, once payments are made, they are likely not reversible. So it will be like paying in cash.

...should be made to...

[tamarik]

What a dangerous clause. Who is supposed to force whom to do something? So you want some larger authority (our beloved government, in this case?) to force the debit card companies to spend their money, manpower, and advertising space with no compensation; nay to cause harm to their own business model? Are there not enough warnings out there about the dangers of debit cards already? Weren't you already aware that these cards are not safe? Your ... somebody should do something... comes from your own frustration at shown to be an idiot, doesn't it? Hurts, don't it?

Don't trust corporations or government. Use cash and/or 'credit' cards. Have you learned these lessons now? I think not. You've already started up another 'debit' card account with the same rules that applied last time. Sheesh!

In Fairness

[Anonymous Coward]

My wife and I both had our debit card data stolen. Her account, with Bank of America and mine with Wachovia/Wells Fargo were both credited back within two business days. Basically both banks credited the disputed transactions back, then got the paperwork in order and investigated. I've plenty of complaints about big banks and how they don't care about customers. but in this case, I thought both banks were outstanding in their handling of our cases.

Use a CREDIT card - the CC companies love it

[bradley13]

Just a reminder, for anyone who has not been on the business side of it: the credit card companies would prefer that you used credit cards. That way, instead of a flat fee of a few cents, they take a percentage of the gross. This either cuts into the merchant's margin, or else they will pass it on to you in the form of higher prices. Either way, the credit card companies make out like bandits.

Except is the word. Local use is critical.

[Kludge]

but credit cards have far more protections than debit cards and are used in an identical manner (well, except for signature vs pin)

The "except" is a big difference. The debit card pin is fundamental. You can charge a credit card with any old scrawl that is never verified by anyone. A debit card pin number is verified electronically, never known to anyone except you and the card issuer. No one holds my debit card except me, making it more challenging to get the number on my card (hardly the pin). I never use my debit card over the internet.

This is why debit card fraud happens less frequently than credit card fraud. It is why retailers typically get charged about $0.25 + 2% for every credit card transaction, but only $0.15 for every debit card transaction. Note that retailers don't just eat these fees, costs get passed along to the consumer. When you use a credit card, you increase costs for everyone.

It's the Retails who always loose

[Anonymous Coward]

I don't know about the US but in the UK this type of theft tends to end up at the retailers door.

At least you will, hopefully, eventually get your money back.

If the thief has used the card to buy goods from a retailer - then what happens is:

1. Thief steals card details
2. Thief goes on spending spree
3. You report card stolen
4. Visa/Mastercard/Card-company take back the money from the retailer
5. You get money back
6. Retailer is left having sold an item for, say £2,000 - but no item, and now no money.

Even when the item has been sent to the account holders registered address, and all the security checks match - the retailer still looses out.

Back to the point.
In terms of physical card use, all credit/debit cards should have a photo of the owner lasered onto them - so the cashier can easily 'check' that the person giving them their card is in fact the owner of the card.
This would help stop stolen/cloned cards from being used at cashier points, but wouldn't help with them being used at ATM's or online. But at least it would help and would be very easy to implement.

Alternatively, use a finger-print double-check based system for all transactions (this would work at ATM's, but then falls over for on-line purchases).

BofAmerica

[jDeepbeep]

For Bank of America customers, this service is available as well.

Re:BofAmerica

[Kiaser Zohsay]

For Bank of America customers, fraud is the least of their worries.

Exactly!

[FatSean]

I can't see any value in using a debit card. It just seems like a way for banks to shift more liability onto the user w/o providing anything of value.

like so:

[Anonymous Coward]

don't use a debit card. use a ATM card = cash.
you don't need to give the ATM card to anyone else,
unlike with a credit or debit card.
-
IF you use a debit card, make a separate
account. figure out how much you "normally"
use per month with the debit card.
have the bank transfer said X amounts
from another bank account to debit account every month.
like so you can minimize your maximum loss.

The Credit Card Tax

[dpilot]

There's another perspective on this, and another reason to do as you do - the credit card tax.

Everyone is up in arms about taxes these days - longer than just that really. People give up their days to protest taxes in various places. But I'll be that those very same people think nothing of using their credit cards to pay for that day's expenses. Or even if they don't, they don't realize that they're paying for the privilege of others using their credit cards.

The credit cards get a transaction fee - typically somewhere in the 3-4 % range. Years ago, I remember some places used to charge a slight premium for using a credit card. I'm not sure if it was through legislation or other pressure, but that practice stopped, in favor of "same price, cash or credit." What that really means is that EVERYONE is paying for the credit card transaction fee, whether you're paying cash or credit.

What do you call it when there's an extra percentage fee tacked onto your purchases? One word might be "tax", except this one isn't collected by any government, but by private agencies. Nor is it voluntary, like a "free market" thing, because it's tacked onto your purchases, whether you use credit or not.

I have a lot of sympathy for small, local businesses. I try to have a premium I will pay to buy locally, knowing that that money stays in my area, though I can't always do it, and I have my limits. But one thing I try even harder to do is avoid using my credit card with local businesses. They have to set their prices to account for the transaction fees, or else they go out of business. But by paying them in cash or check instead of credit, that piece of transaction fee goes to them instead of to some far-off bank. I can't get the "tax" back for myself, but at least I can give it to a local business.

Re:The Credit Card Tax

[BBTaeKwonDo]

>I can't get the "tax" back for myself...

Maybe you can - ask "Do you offer a cash discount?" every time you're getting ready to buy something with cash. If the answer is yes, then you'll get the "tax" (or at least, part of it) back.

Re:The Credit Card Tax

[Anonymous Coward]

This has irked me for ages. Thank you for articulating it so well in this thread.

no easy solution

[Anonymous Coward]

With online usage, the bank could issue temporary numbers with a spending limit you set. The number works once, for one online purchase, then evaporates. That way if someone steals it, it won't work. They could even handle this transparently by setting up an application that behaves like paypal, where you click the link and it autogenerates the temporary card number for the merchant to charge against.

The trickier problem is malware infected atms and man in the middle attacks between atm and bank.

With either, the numbers can be sent to a card fabricator, who can simply recreate your card for a thief.

The bank has to take responsibility for this one since ultimately the security of their network and ATM kiosks is their problem.

You can ultimately take ownership of your own security by opening up a checking account with no atm card. Open a second one with an ATM card and transfer money to it as you need it via phone call or by using a smartphone application provided by the bank.

While this is a royal pain in the ass, it would work.

The US don't actually have credit card security

[carbon116]

I've been in the US for 10 days or so (longer now thanks to the Iceland volcano) and not once have I had my PIN or signature checked while purchasing goods. I get handed the goods and card before I finish my signature.

In the UK I have to enter my PIN for each purchase, and get occasional signature spot-checks.

So I suppose you guys have to start actually checking credit card security first before complaining.

Re:The US don't actually have credit card security

[cdrguru]

Debit cards can be processed two ways: as a PIN transaction without credit card validation or as a credit card without a PIN. A lot of merchants can only process credit cards and not debit cards so will use the second method exclusively.

There is only one "solution" to this: never, ever use a debit card for anything. Once you use it, the number is out and will be sold. Sold to folks that collect them and pass them out to people. If you work somewhere that accepts cards you can make some money on the side by selling customer's numbers. And plenty of people do exactly that.

With a credit card you are limited to $50 loss and I've never heard of anyone actually having been charged even that. It is just a nuisance. With a debit card they can clean your bank account out and there is no recourse. Nothing. You lose.

Don't use debit cards. The risk is way, way too high.

Re:What can be done? The above solved it for me

[DCFusor]

I've had the same experience though I wound up not actually losing the money after the bank did their investigation thing, and it's darn lucky that the guy who did it to me didn't realize that the debit card in question was for a payroll account and had a ton of money in it. Just some junkie who knew how to make up card numbers the first time (the algorithm is published including the checksum info!), and the second time a dumpster diver getting info from a legit company I deal with who got sloppy. I now just have several check accounts for various uses that have the attached plastic, and only put money in them when needed -- any attempt to rip them off won't get much if anything. And it works fine -- no more problems after that move. You can't just use cash -- my wife will pickpocket it (!), and the internet doesn't allow it for online ordering.

Smartcard is the solution

[Anonymous Coward]

In Brazil it is a common financial crime. Its called card clonning. The solution was replace all magnetic cards with smart cards. http://en.wikipedia.org/wiki/Smart_card. In these cases (card clonning) the Visa machine is replaced by an altered machine that records data about your card and password (if necessary). With smartcards, clonning is not possible, like GSM phones. Banks have inssurance. When they start to spend more money with inssurance than the cost of replace all cards by smart ones, they will start replace.

learn from the experience

[Anonymous Coward]

So you picked up a sharp object from the wrong end and cut yourself. Hopefully you didn't cut yourself too badly. In addition, you should have learned which end to hold onto.

Moral, don't blame someone else for the problem you encountered. Demanding that "something be done" is where excessive government comes from. Learn what the risks are, determine how much of those risks you are willing to take, and adjust what you do accordingly. Even using an armored truck to haul your cash around and using armed guards to make your purchases are no guarantee someone won't still make off with your money.

Additionally, where you "go" to spend your money, determines how likely there might be someone there who wants to take it from you, other than the merchant, bar, club, website that you intended to spend it at.

Verified by Visa is just horrible

[petgiraffe]

Check http://en.wikipedia.org/wiki/3-D_Secure#Criticism for just some of the problems.

Visa are doing something about it, so much so that they are enticing people to use it by accepting the liability of fraud themselves - rather than leaving it firmly with the merchant as it is today.

If only this were true it might be worth it. However, the terms of the agreement presented to me whenever Verified by Visa tries to force me to join require that I, personally absolve both Visa AND the merchant of any responsibility for fraudulent charges and agree to pay any and all such charges while waiving the fraud limits on my current "unverified" card.

Seems to be

[Anonymous Coward]

It's not in the bank's interest to make Debit card fraud easy.

options seem to be:
Use Cash
Use CREDIT card, paying balance in full each billing cycle (Works if credit Ok)
Use a checking account you transfer just enough into, and a debit card
Use one time numbers

Why?
Credit card, you just don't have to pay, it's not your money that they have, it's theirs. That is likely to be cleaned up far faster, and if it isn't, it's just not your problem once reported. Most real cards waive the 50$ federal limit, too.

Debit card, the longer they wait to clean it up, the more fees they accumulate, and the less interest they pay, less money out of Their pockets. So usually in the Bank's best interest to NOT clean it up quick. Yes, some banks do consider the ease, but it's entirely a customer service game, it costs them to do it. When cost > Benefit, they won't be so nice.

If the bank gives you a Debit card, you may request that it be deactivated. I was auto-issued one, and made an explicit request to NOT have a debit card, but Only a ATM Card. I didn't want to deal with cleaning it up, and I've already had my identity stolen.

Also look out for reversed direct deposits...

[ciggieposeur]

I once had an employer reverse a direct deposit 3 days after it had gone in, resulting in a dozen overdraft fees on small purchases. I got it straightened out and the credit union was good enough to forgive the fees, but I learned a valuable lesson.

Turns out nearly every banking institution will reverse direct deposits up to 10 days after they go in. So now I have to worry both about mistakes on both ends (deposits and ATM cards).

My solution: direct deposits go into account A, ATM card is account B, "real" money goes into account C, Paypal comes out of account D, payments over the Internet come out of account E, and payments by check come out of account F. And a wholly separate bank has a single savings-only account for long-term savings.

It's absurd, but I've got no assurance than ANY pool of money can't be gotten into and my life fucked trying to fix it.

You're an idiot, sorry.

[BitZtream]

The risks with cards are 'common knowledge'

If you did not know your card code be abused, you are beyond any doubt a complete and total moron, as is Timothy for posting this story.

Putting a warning like you're talking on every card would be just like the cancer warnings in California. You'll still be retarded and ignore them anyway.

Now, lets get down to facts and things that can help you.

All bank cards in America require that the proof of sale be on the seller. Your bank should immediately halt the funds at worst, and in general should return them to you until the seller proves you bought the items. It doesn't have to be a Visa or a MasterCard. Don't get me wrong, if you go by a prepaid visa or something from some random refill over the phone place, good luck getting your money back. With a real bank however, its generally a lot easier to just threaten to call the feds and report them.

You've probably already seen it, but here is an excellent comment with proper links to what you want:

http://ask.slashdot.org/comments.pl?sid=1620370&cid=31866498

Re: True...

[colinnwn]

You are correct, but it is also true there are more legal protections on credit card transactions than on debit card transactions. So I guess the real question is, how much do you trust your bank to do the right thing, vs. what they are minimally legally required to do, without having to call their regulators or file a lawsuit against them.

Re: I think you misunderstand parents intent

[colinnwn]

First, I think he'd tell you he'd never use his ATM/PIN in ANYTHING but an ATM machine. If you want cash without going to a teller, there is no cheaper or safer way to do it. Debit cards or credit cards would all work the same as an ATM card, or would be more expensive. This makes the issue of PIN transactions being harder to refute irrelevantly equal. And no retard should give their PIN to anyone they don't accept as an authorized user of the card for any purpose.

Also while Visa provides virtually equal protections for credit and debit cards, that doesn't give it the force of law, only the force of contract that may have to be litigated. I believe debit card transactions still have somewhat fewer legal protections than credit cards. But even that doesn't really matter.

The real issue is if your debit card is rooted, the money is gone until the bank chooses to return it whether they do it in a couple hours, a couple days, or a couple weeks, whether that is legal or illegal, contractual, or in violation. If your credit card is rooted, you still have all your money. And if worse comes to worse and you can't agree with the bank on whether it is a valid charge, and you choose to sue or not, you can just not pay your bill. You credit score might go to crap, and they might choose to sue you, but you still have your money until you choose to give it to someone else.

Re: True...

[godefroi]

Like I posted farther up, my bank did the exact same thing that the GP describes.

If you don't trust your bank, why are you banking with them?

I don't think the signature actually means much

[Chirs]

My credit card signature is blurred to the point of uselessness. Several places don't require a signature for smaller transactions.

I'm not sure how much legal weight the signature actually has.

Re: I don't truly trust any of them

[colinnwn]

I bank with a small national bank and a community credit union that I somewhat trust. They have never done anything to me, or anyone I know of that I deemed inappropriate.

But I also don't 100% trust any company to always do the right thing. You can always get a jerk employee, or just get unlucky after a misinterpreted policy change. When it is my money, I will always err on the side of caution, and the side of having more protection in regulation, rather than in contract or marketing language.

Re:Except is the word. Local use is critical.

[Fjandr]

The "except" is not a big difference, in fact it's not a difference at all when comparing fraudulent use (with possession of the card) of the two types. A debit card can be used with a signature, exactly as a credit card can. If they're not going to check an ID with one, they're not going to check an ID with the other. The "nobody holds my debit card ... internet use ..." has no bearing as the argument can be used just the same for credit cards. If it's never lost it doesn't matter.

Increased security measures have increased costs. The average prices are built-in, and credit cards aren't going away. Smart shoppers get the average merchant costs lowered by debit card users, so like most things a higher percentage of burden is on the backs of those who pay less attention to the ramifications of their actions. I'm perfectly fine with all that.

The only time any of that comparison would be valid is with a debit card that cannot ever be used as a credit card. I wish you the best in finding one of those that is accepted at all standard terminals. If you have, you're lucky.

no mentioning of Verifiedbyvisa ?

[freaker_TuC]

Verifiedbyvisa which will add an extra layer of security by demanding an OTP to be generated with the smart card of the VISA card; making fraud virtually impossible unless the card reader & code has been used.

*sigh*

[incubbus13]

You think warnings are going to help? They made a whole big hype about putting warnings on cigarette packs. Raised the price to do it.

Sorry, I don't know you. But this is asinine feel-good legislation. A debit card is an electronic checkbook. It contains, in one way or another, your account information.

You know that. Unless you're one of the people in 1990 that didn't know nicotine was addictive.

I fully agree they have a responsibility to protect their customers -- as much as is financially and practically feasible. But please. Signs don't solve problems. Or make a damn bit of difference in anything.

"But I also think that those producing these check cards should be required to advertise the hazards of having one of these cards (not in small print and maybe required in advertisement of these cards, similar to what is required with pharmaceutical drugs on television) and/or that if a debit or check card is issued a separate account should be required for its use, and users informed of the issues of placing all of their money in the same account that their debit card has access to."

Your argument is that you didn't know someone could steal your money? You were not aware of the hazards of carrying money (in whatever sense) in the modern world?

I'm sorry your account got cleaned out, identity theft is hardcore and there needs to be a lot more support and it needs to be treated like a much bigger crime than it is. I used to work in the check-authorization industry. It was awful to see these poor people getting their identity stolen and their life ruined.

But please. This is feel-good, 'blame the company'/lawsuit mitigation crap. It doesn't actually do anything. And it isn't anything that people shouldn't know already.

If we want to make a difference, we need a separate government bureau that is devoted to preventing/tracking/prosecuting/educating/defending citizens from/to/about identity theft. Smoke and lights aren't going to solve the problem. And they'll just make it more obnoxious and 8th grade-level instructions to do business with my bank. I hate that.

Again, it's not my intention to attack the OP personally. But those are the last things that are going to actually do any thing to help the problem. They will, though, cause the government/banks/credit card companies to spend a little bit of money, make a lot of noise, not make the situation any safer, and triple the hassle of doing through daily life. Airport security anyone?

K.

Get a different bank

[Anonymous Coward]

I have worked with the same bank for years now, and there have been six attempts on my debit cards, all taken from either ATM machines that had "readers" attached, or hacked from places like gas stations. Each time the questioned transactions were cancelled with no question by the bank. In one case, the security was so tight that I had trouble getting money from an ATM because I had gone on business to the Bahamas and they considered the transaction "out of pattern". Get a different bank.

Why would anyone want to use a debit card?

[Anonymous Coward]

I've never understood why anyone would use a debit card over a credit card. There are federal laws protecting this sort of thing for credit cards. For debit cards the banks can set whatever policy they want. Including doing nothing. Credit cards have other benefits, like doubling product warranties, allowing bill disputes BEFORE paying, etc., etc. I can't think of a single benefit to a debit card, short of someone not being able to qualify for credit.