What Can Be Done About Security of Debit Cards?

JumpDrive writes "I have been the victim of (Visa) debit card theft. I do not know where they stole or got the number, but it was used one day on the other side of the country and the next day it was used in Europe until they cleaned out my account. I had been monitoring my account online and immediately went to the bank and filed a claim. I was told at that time it would be 3 to 5 weeks for them to investigate the claim before they could return my money. Recently I tried to make a purchase with a debit card and was told that they couldn't use the card since it wasn't a Visa or MasterCard check card; this led to a discussion of why I no longer have a Visa or MasterCard check card. Which then led to the question of 'What can be done about it?' Currently I have a separate account for debit usage for my personal safety. But I also think that those producing these check cards should be required to advertise the hazards of having one of these cards (not in small print and maybe required in advertisement of these cards, similar to what is required with pharmaceutical drugs on television) and/or that if a debit or check card is issued a separate account should be required for its use, and users informed of the issues of placing all of their money in the same account that their debit card has access to. What other precautionary measures should be required or taken?"

Comments

What can be done? Nothing.

[plover]

The short answer? The banks will do nothing for you today.

The long answer: Nobody will do anything for you tomorrow, either.

Why? Because Visa does two things, only one of which makes money. First, they are in charge of defining financial card security through the PCI council, and they own and operate the secure network VisaNet, which carries authorizations from retailers to banks. Guess which one makes them money?

If Visa were to design and offer a cryptographically secure solution, one based only on smart cards for the customers and Hardware Security Modules (HSMs) at the banks, then I could safely route my charge authorizations over the plain ol' Internet. I wouldn't need to use the charge-per-transaction VisaNet. Visa would stop making money.

So instead of offering a secure solution, Visa and the PCI council say, "Merchants must lock down their systems, protect this data, follow these 12 steps, acknowledge that you are powerless over alcohol (oh wait, wrong 12 steps), and if you don't, we'll loudly blame you for allowing someone to see our non-existent security."

Visa owns the protocols used between merchants and banks. They could strengthen the protocols. They could prescribe encryption. They could require the deployment of chipped banking cards. But they do not, and have not for many, many years, despite a pathetic track record of security.

If you want the banks to be safe with your money, you ironically have to take charge of your own security. If you switch to using the green paper stuff, your losses will be finitely limited to what you carry on your person. If you want a more achievable answer in today's plastic world, DO NOT CARRY DEBIT CARDS. Debit cards do not offer you protection against loss. Credit cards are limited by U.S. law to a maximum of $50 liability to the cardholder. Debit cards losses are usually covered by the bank, but they are under no legal obligation to do so. For ATM access, most banks will honor your request for an ATM-only card instead of accepting their default ATM/Debit card. Of course, the use of credit cards requires personal discipline to always pay the debt on time, but otherwise you would see little difference.

Re:What can be done? Nothing.

[RenQuanta]

Credit cards are limited by U.S. law to a maximum of $50 liability to the cardholder. Debit cards losses are usually covered by the bank, but they are under no legal obligation to do so.

(Emphasis mine).

Actually, I don't think the part about the lack of debit card consumer protections is factually accurate. Here's the blurb from The FTC's Facts for Consumers:

ATM or Debit Card Loss or Fraudulent Transfers (EFTA). Your liability under federal law for unauthorized use of your ATM or debit card depends on how quickly you report the loss. If you report an ATM or debit card missing before it's used without your permission, the EFTA says the card issuer cannot hold you responsible for any unauthorized transfers. If unauthorized use occurs before you report it, your liability under federal law depends on how quickly you report the loss.

For example, if you report the loss within two business days after you realize your card is missing, you will not be responsible for more than $50 for unauthorized use. However, if you don't report the loss within two business days after you discover the loss, you could lose up to $500 because of an unauthorized transfer. You also risk unlimited loss if you fail to report an unauthorized transfer within 60 days after your bank statement containing unauthorized use is mailed to you. That means you could lose all the money in your bank account and the unused portion of your line of credit established for overdrafts. However, for unauthorized transfers involving only your debit card number (not the loss of the card), you are liable only for transfers that occur after 60 days following the mailing of your bank statement containing the unauthorized use and before you report the loss.

If unauthorized transfers show up on your bank statement, report them to the card issuer as quickly as possible. Once you've reported the loss of your ATM or debit card, you cannot be held liable for additional unauthorized transfers that occur after that time.

Re:What can be done? Nothing.

[Gr8Apes]

Naah - no modding down. Everyone here should be smart enough to distrust debit cards immensely.

As for internet buys - use 1 time numbers. My main credit card has them available, although I'll admit it is a pain in the tukas to get to the screen that gives you one, and it's not exactly advertised. (read that as you have to know what you're looking for and what the specific verbage is on the menus, or you won't find it)

Re:What can be done? Nothing.

[archmcd]

I work in bank security, and I just wanted to offer some clarification on your rant:

If you want a more achievable answer in today's plastic world, DO NOT CARRY DEBIT CARDS. Debit cards do not offer you protection against loss.

A debit card can be used in two ways. It can either be used with a PIN in what's commonly called a debit transaction (or at an ATM), or it can be used as a "credit" transaction and processed through the Visa or MasterCard network. There is little to no protection against loss for the former of these transaction types, except keeping your PIN secure. The "credit" style transaction, on the other hand, is protected by a zero liability guarantee (at least Visa cards... not sure about MasterCard). Yes, your bank account may get cleaned out (or depleted up to the daily spending limit of your debit card), and outstanding checks may bounce, and you may have a freeze on your account until it gets resolved. However, this zero liability guarantee means any transactions found to be fraudulent will be reimbursed by your bank. The bank then goes after the merchant that processed the transaction to recoup their own losses. If you have a good bank, they'll also refund your overdraft fees. Debit or ATM transactions, on the other hand, are not covered by the same guarantee, so having your card skimmed and PIN captured is far worse - UNLESS your bank offers a guarantee on these types of transactions as well.

See http://usa.visa.com/personal/cards/debit/visa_check_cards_faq.html

Credit cards are limited by U.S. law to a maximum of $50 liability to the cardholder. Debit cards losses are usually covered by the bank, but they are under no legal obligation to do so.

Losses due to fraudulent transactions processed through the Visa network are actually covered by the merchant that accepted the transaction, not your bank. Your bank only covers "Debit"-style losses they agree to cover if they offer protection against Debit or ATM transactions, but that's not a standard program.

For ATM access, most banks will honor your request for an ATM-only card instead of accepting their default ATM/Debit card.

An ATM-only card means you will have to use ATMs more frequently, thereby potentially exposing yourself to skimmers, as well as use of your PIN in public. Since there's no zero-liability coverage with most banks for skimmed ATM transactions, you're putting your money at greater risk by doing this. Oh, and by the way, the skimmers have this one figured out too. You no longer have to worry about the shady looking person loitering near the ATM watching you enter your PIN. They install a tiny camera painted to match the fascia of the ATM, and they aim it at the keypad.

Re:What can be done? Nothing.

[Recovery1]

Great idea. But my bank doesn't offer me such a system.

In its place though I have a credit card issued from the bank. It is linked to only one account and I have to transfer money into it before I use it for any transactions so otherwise it is mostly empty. Try to withdraw any more then is in it, the transaction is automatically rejected. Seems to work for me so far with online transactions quite well.

How about a real solution?

[John Whitley]

But I also think that those producing these check cards should be required to advertise the hazards of having one of these cards

NO, NO, NO. No stupid, pointless warnings. Make the financial institutions solely liable for all identity theft. They're the only ones with the ability to stop it, and they should be the ones that bear the full economic incentive for managing fraud.

But I didn't say it first, Bruce Schneier did:

The actual problem to be solved is that of fraudulent transactions. Financial institutions make it too easy for a criminal to commit fraudulent transactions, and too difficult for the victims to clear their names.
[...]
It's not that financial institutions suffer no losses. Because of something called Regulation E, they already pay most of the direct costs of identity theft. But the costs in time, stress and hassle are entirely borne by the victims.

The whole article is +5 Insightful, well worth reading.

What to do? Tell you're bank they're full of it

[oasisbob]

IAABG (I am a banking geek).

The rules for provisional credit on debit cards is very well established. They fall under Regulation E, section 205.11. The bank has ten days to get you a provisional refund, and can take up to 45 days in certain circumstances to complete their investigation and finalize the credit.

Make sure you get them a notice in writing! Once you do, they have ten days to credit you, and many banks will do it much faster. If the bank drags their feet, just tell them "I want provisional credit within the mandated timeline per Regualtion E".

Here's more on this topic:
http://www.bankersonline.com/technology/guru2008/gurus_tech022508c.html
http://usa.visa.com/personal/security/visa_security_program/zero_liability.html
http://finsolinc.com/Reg%20E%20EFTA%20Error%20Resolution%20Flowchart.pdf

The protection for misuse of debit cards is strong, you just need to know what to do. If your bank isn't responsive, Move Your Money to a smaller institution that cares.