Forgot your password?
typodupeerror
Security The Almighty Buck IT

What Can Be Done About Security of Debit Cards? 511

Posted by timothy
from the go-cash-only dept.
JumpDrive writes "I have been the victim of (Visa) debit card theft. I do not know where they stole or got the number, but it was used one day on the other side of the country and the next day it was used in Europe until they cleaned out my account. I had been monitoring my account online and immediately went to the bank and filed a claim. I was told at that time it would be 3 to 5 weeks for them to investigate the claim before they could return my money. Recently I tried to make a purchase with a debit card and was told that they couldn't use the card since it wasn't a Visa or MasterCard check card; this led to a discussion of why I no longer have a Visa or MasterCard check card. Which then led to the question of 'What can be done about it?' Currently I have a separate account for debit usage for my personal safety. But I also think that those producing these check cards should be required to advertise the hazards of having one of these cards (not in small print and maybe required in advertisement of these cards, similar to what is required with pharmaceutical drugs on television) and/or that if a debit or check card is issued a separate account should be required for its use, and users informed of the issues of placing all of their money in the same account that their debit card has access to. What other precautionary measures should be required or taken?"
This discussion has been archived. No new comments can be posted.

What Can Be Done About Security of Debit Cards?

Comments Filter:
  • by plover (150551) * on Thursday April 15, 2010 @07:32PM (#31866154) Homepage Journal

    The short answer? The banks will do nothing for you today.

    The long answer: Nobody will do anything for you tomorrow, either.

    Why? Because Visa does two things, only one of which makes money. First, they are in charge of defining financial card security through the PCI council, and they own and operate the secure network VisaNet, which carries authorizations from retailers to banks. Guess which one makes them money?

    If Visa were to design and offer a cryptographically secure solution, one based only on smart cards for the customers and Hardware Security Modules (HSMs) at the banks, then I could safely route my charge authorizations over the plain ol' Internet. I wouldn't need to use the charge-per-transaction VisaNet. Visa would stop making money.

    So instead of offering a secure solution, Visa and the PCI council say, "Merchants must lock down their systems, protect this data, follow these 12 steps, acknowledge that you are powerless over alcohol (oh wait, wrong 12 steps), and if you don't, we'll loudly blame you for allowing someone to see our non-existent security."

    Visa owns the protocols used between merchants and banks. They could strengthen the protocols. They could prescribe encryption. They could require the deployment of chipped banking cards. But they do not, and have not for many, many years, despite a pathetic track record of security.

    If you want the banks to be safe with your money, you ironically have to take charge of your own security. If you switch to using the green paper stuff, your losses will be finitely limited to what you carry on your person. If you want a more achievable answer in today's plastic world, DO NOT CARRY DEBIT CARDS. Debit cards do not offer you protection against loss. Credit cards are limited by U.S. law to a maximum of $50 liability to the cardholder. Debit cards losses are usually covered by the bank, but they are under no legal obligation to do so. For ATM access, most banks will honor your request for an ATM-only card instead of accepting their default ATM/Debit card. Of course, the use of credit cards requires personal discipline to always pay the debt on time, but otherwise you would see little difference.

    • by Master Moose (1243274) on Thursday April 15, 2010 @07:41PM (#31866248) Homepage
      I suggest everyone reading this with a debit card transfer all of their money to my account. I do not have a debit card so it will be free from this sort of attack.
      • by godrik (1287354)

        Or send your card number to me. I will enter them in the "Debit Card Protection System 2.5" myself !

      • by AegisFang (753246) on Thursday April 15, 2010 @10:17PM (#31867514)

        I suggest everyone reading this with a debit card transfer all of their money to my account. I do not have a debit card so it will be free from this sort of attack.

        Hello Sir, I currently have over 3000000$(3 million) US dollars in account from my late uncle (Nigerian Royalty). If I could, please, to be put this inheritance in your account for 1 month to avoid Nigerian Tax Liability, I would gladly pay 10 percent to you in 1 month time. Please to send me your account number as offered and PIN. I will deposit funds forthrightly. Thank you God Bless! Kindest regards, Eeaye Eeayeou

      • Re: (Score:3, Funny)

        by blindseer (891256)

        I suggest everyone reading this with a debit card transfer all of their money to my account. I do not have a debit card so it will be free from this sort of attack.

        Sure, I'll do that. Please post your routing number and account number so that I can complete the transaction.

    • by stonewallred (1465497) on Thursday April 15, 2010 @07:47PM (#31866300)
      I hate to say this, but use cash. I have several credit cards, and I use some of them daily. But unless the interest rates are lower than what I can make by not paying them (seldom if ever) they get paid off monthly. I do not have a debit card. I have a paypal account tied to a bank account I use strictly for buying and selling on ebay(lego if you are interested). My bills I pay with check or cash, and sent via mail or delivered by hand (the HVAC/R supply houses, as it credits immediately to my accounts when paying at the store). If I want something off the internet, I get a buddy of mine to order it using his data, not mine. Plus with cash, there is never a question of bouncing a check or overdraft fees or charges. Will probably get modded down for suggesting such an anti-tech idea as using cash, but oh well. Karma is overrated anyway.
      • by Gr8Apes (679165) on Thursday April 15, 2010 @08:19PM (#31866596)

        Naah - no modding down. Everyone here should be smart enough to distrust debit cards immensely.

        As for internet buys - use 1 time numbers. My main credit card has them available, although I'll admit it is a pain in the tukas to get to the screen that gives you one, and it's not exactly advertised. (read that as you have to know what you're looking for and what the specific verbage is on the menus, or you won't find it)

        • by Recovery1 (217499) on Thursday April 15, 2010 @09:14PM (#31867046) Homepage

          Great idea. But my bank doesn't offer me such a system.

          In its place though I have a credit card issued from the bank. It is linked to only one account and I have to transfer money into it before I use it for any transactions so otherwise it is mostly empty. Try to withdraw any more then is in it, the transaction is automatically rejected. Seems to work for me so far with online transactions quite well.

          • by Runaway1956 (1322357) on Thursday April 15, 2010 @09:32PM (#31867208) Homepage Journal

            GGP is on the mark, when he says "Use cash". But, in today's world, it seems a necessity that we are able to make purchases online. So, I have exactly what Recovery1 has - a plain debit card. I put money on the card, make my purchase, the card is dry, and no one can make any more withdrawals. Doesn't much matter if someone around the world gets my number, they can ONLY steal the money that I have put on the card that day, and if I've already made my purchases, the balance is zero, they can't steal anything at all.

            But, their attempts to do so will trigger alarms, and the bank knows that security has been compromised!! In theory, the bank will contact me, and ask about those attempted purchases.

            • by rtb61 (674572) on Thursday April 15, 2010 @09:46PM (#31867316) Homepage

              One thing to watch out for is being fobbed off by banks. Standard law for credit or debit cards is the onus is upon the seller to prove that you made the purchase not upon you to prove you didn't. If your bank wants to take a few weeks to resolve it immediately complain to your regulatory authority, the bank can take a few weeks to resolve it with the seller, not with you. Once you have made the formal claim for a stop payment it should be resolved in a couple of days, if your bank does not support you in this, it is time to change banks.

              The reality the person who used your credit or debit cards details, did not steal from you, the seller with the assistance of the credit or debit card company stole from you, they should be required by law to prove that charge in fact did occur, that they were defrauded and that they attempted to defraud you in error.

              The lie being spread by mass media, to suit their advertisers the credit card companies and the merchants is a lie, that the money was stolen from your by the thief that used the card details. Your money was stolen by the merchant who claimed you made the purchase, once you have made the complaint, the police should pursue the merchant who by law should prove they did not just attempt to defraud you, that someone defrauded the merchant has absolutely nothing to do with you and at no time should be considered your problem.

              • by StormReaver (59959) on Friday April 16, 2010 @07:23AM (#31870214)

                Once you have made the formal claim for a stop payment it should be resolved in a couple of days, if your bank does not support you in this, it is time to change banks.

                This is the most sensible advice I've seen on this thread. When my Commerce Bank debit card details were compromised, and several unauthorized charges started appearing on my bill, I called the number of the back of my debit card to report the losses. The bank immediately reversed all the charges and offered to send me a new card through overnight delivery.

                I told them to cancel my compromised card, and to send me a new one. They told me I would be without access to my funds via debit card until I activated the new one, but that it should be here within 24 hours (it was at my house in less than 12 hours). I was responsible for $0 of the unauthorized amount, and life went on normally.

                Bottom line: the debit card is only as risky as the bank with which you choose to do business. Get a bank that doesn't suck, and your debit card is a safe financial instrument.

        • by statusbar (314703) <jeffk@statusbar.com> on Thursday April 15, 2010 @09:26PM (#31867162) Homepage Journal

          One thing can be done:

          http://www.my-spy.com/ [my-spy.com]

          A service which will notify you via email or text message whenever any transaction occurs on your accounts.

          --jeffk++

        • Re: (Score:3, Informative)

          by nahdude812 (88157) *

          A debit card where you transfer money into that account just before each transaction has a similar effect if your bank doesn't offer one-time cards.

          Personally I have a credit union (I know not everyone is eligible to join one). When a similar thing happened to me as happened to OP, my CU refunded the missing funds the same day I filed the police report (over a certain dollar value a police report is required to file a dispute), which also happens to be the day I found out about it. I found out about it be

        • BofAmerica (Score:3, Informative)

          by jDeepbeep (913892)
          For Bank of America customers, this service is available [bankofamerica.com] as well.
        • by djdanlib (732853) on Friday April 16, 2010 @11:54AM (#31873586) Homepage

          One thing to be aware of... If you're doing an in-store merchandise pickup, they will normally want to see your card when you pick it up - for verification of your identity, and their computer systems generally require them to swipe the card. The programmers of said system were lazy enough to make that the only verification method, and the salespeople can't change it. Not the best way to do it, but it will save you a lot of hassle if you DON'T use a one-time number for these particular online transactions.

          Disclaimer: I used to work in a store. These one-time numbers caused us endless headaches and hassles because customers would get downright nasty when we simple and unempowered salespeople would have to jump through all these ridiculous hoops (return, refund, repurchase) to make our system handle them. This would take half an hour or so, while the customer did this to "save time"... so just use your actual card number for in-store pickups, or call the store to confirm merchandise availability, have them hold it for you, and buy it at the store.

          tl;dr if you need to verify your identity as the purchaser at a later date, especially with physical evidence, don't use one-time numbers.

      • I think this is brilliant. I try to use cash (withdrawl x amount) and spend that only. The problem is, counterfiting is likely as easy as Visa/Debit fraud. So when you start paying cash for things, you're made to feel like a bloody criminal - they look at you a few times too often, scan the bills under UV light and yadd yada. I'm usually buying stuff in well-dressed attire (not that that matters), but I'm not a homeless guy trying to pass a $100 at a till to buy smokes. This unfortunately are for both large

        • Re: (Score:3, Interesting)

          by Cimexus (1355033)

          Hehe I noticed that as a foreigner visiting America.

          Obviously I didn't want to use my debit card from my home bank for every transaction since I would incur a currency exchange fee every time. So I generally used cash (and this was mostly in large denominations like 50s and 100s, since thats what they give you when you get your money changed at the airport).

          The first thing I noticed was the signs at various shops saying "we don't accept 100s". This was 'new' to me. At home, money is money, and has to be acc

      • by Kral_Blbec (1201285) on Thursday April 15, 2010 @08:53PM (#31866904)
        We can't all have a friend buy stuff for us...
      • by dpilot (134227) on Friday April 16, 2010 @08:52AM (#31871142) Homepage Journal

        There's another perspective on this, and another reason to do as you do - the credit card tax.

        Everyone is up in arms about taxes these days - longer than just that really. People give up their days to protest taxes in various places. But I'll be that those very same people think nothing of using their credit cards to pay for that day's expenses. Or even if they don't, they don't realize that they're paying for the privilege of others using their credit cards.

        The credit cards get a transaction fee - typically somewhere in the 3-4 % range. Years ago, I remember some places used to charge a slight premium for using a credit card. I'm not sure if it was through legislation or other pressure, but that practice stopped, in favor of "same price, cash or credit." What that really means is that EVERYONE is paying for the credit card transaction fee, whether you're paying cash or credit.

        What do you call it when there's an extra percentage fee tacked onto your purchases? One word might be "tax", except this one isn't collected by any government, but by private agencies. Nor is it voluntary, like a "free market" thing, because it's tacked onto your purchases, whether you use credit or not.

        I have a lot of sympathy for small, local businesses. I try to have a premium I will pay to buy locally, knowing that that money stays in my area, though I can't always do it, and I have my limits. But one thing I try even harder to do is avoid using my credit card with local businesses. They have to set their prices to account for the transaction fees, or else they go out of business. But by paying them in cash or check instead of credit, that piece of transaction fee goes to them instead of to some far-off bank. I can't get the "tax" back for myself, but at least I can give it to a local business.

    • Re: (Score:3, Informative)

      by halowolf (692775)
      I just use a credit card with a low limit for shopping both out in the real world and on the internet and just act smart. I have never had any theft from my card by any unauthorised charges yet. I have had one retailer not supply the goods I purchased (on an authorised charge mind you) because he was a lying scum bag, but I got my money back from that and hopefully my complaints to the regulatory authorities will land him in jail, since he was an insolvent trader.
      • Re: (Score:3, Insightful)

        by Fjandr (66656)

        This really is a good answer. Not necessarily the low limit, but credit cards have far more protections than debit cards and are used in an identical manner (well, except for signature vs pin). If it's a credit account with the same bank your checking or savings account is with, it's usually pretty simple to transfer the money from your bank account to pay off the credit account monthly. Doing so incurs no additional cost. If the card is charged maliciously, you still have all the money in your bank account

        • by Throtex (708974) on Thursday April 15, 2010 @09:46PM (#31867320)

          In fact, not only is it a good answer, it's the only correct answer. Credit is better than cash is better than debit. Why? If you have a dispute with a merchant you paid in cash, you need to sort it out with them directly before you can get your money back. If you have a dispute with a merchant and you paid with credit, and you're in good standing with your credit card provider, then you can just have them fight it out for you and reimburse you immediately. No hassle, no worries.

          I pay credit for everything I can. Absolutely everything. I have no shame whipping out a credit card for a $3 purchase if the merchant will accept it. Why should I care?

          Oh, and of course, all of this requires the very simple discipline of paying off your bills every month, and thereby incurring no fees. As a bonus, you get points/miles/whatever. Sure, you're paying for it because the merchant builds the card fees into the price of whatever you're buying, but by and large paying cash won't get you a better rate these days.

          Debit? Never use it. Unfortunately my ATM card HAS to also be a debit card, and there's no way to deactivate its debit usage. It's a shame. There is literally no point, whatsoever, to using a debit card. Unless, I suppose, you lack discipline, and well in that case you've got bigger problems.

    • by RenQuanta (3274) on Thursday April 15, 2010 @07:56PM (#31866394) Homepage

      Credit cards are limited by U.S. law to a maximum of $50 liability to the cardholder. Debit cards losses are usually covered by the bank, but they are under no legal obligation to do so.

      (Emphasis mine).

      Actually, I don't think the part about the lack of debit card consumer protections is factually accurate. Here's the blurb from The FTC's Facts for Consumers [ftc.gov]:

      ATM or Debit Card Loss or Fraudulent Transfers (EFTA). Your liability under federal law for unauthorized use of your ATM or debit card depends on how quickly you report the loss. If you report an ATM or debit card missing before it's used without your permission, the EFTA says the card issuer cannot hold you responsible for any unauthorized transfers. If unauthorized use occurs before you report it, your liability under federal law depends on how quickly you report the loss.

      For example, if you report the loss within two business days after you realize your card is missing, you will not be responsible for more than $50 for unauthorized use. However, if you don't report the loss within two business days after you discover the loss, you could lose up to $500 because of an unauthorized transfer. You also risk unlimited loss if you fail to report an unauthorized transfer within 60 days after your bank statement containing unauthorized use is mailed to you. That means you could lose all the money in your bank account and the unused portion of your line of credit established for overdrafts. However, for unauthorized transfers involving only your debit card number (not the loss of the card), you are liable only for transfers that occur after 60 days following the mailing of your bank statement containing the unauthorized use and before you report the loss.

      If unauthorized transfers show up on your bank statement, report them to the card issuer as quickly as possible. Once you've reported the loss of your ATM or debit card, you cannot be held liable for additional unauthorized transfers that occur after that time.

      • by plover (150551) *

        Thanks, that's good to know, but I still won't carry a debit card. I'm not in the habit of checking my bank balance daily to see if someone's been stealing from me.

        For these laughable "protections", I'd be far better off keeping my money under my mattress. It seems to me it should be 100% of the job of the bank to keep my money safe and secure.

        • by RenQuanta (3274) on Thursday April 15, 2010 @08:19PM (#31866602) Homepage

          In this day and age, with online banking so prevalent, checking your account every few days is only prudent. It's not unreasonable for the consumer to have some burden of identifying the loss, since each of us are the best and most efficient judge as to whether or not the transactions on our accounts are in fact ones we performed. Millions of dollars in software development and analyst training have been spent on helping banks to detect fraud, but those systems aren't fail proof.

          In the end, there's no substitute for each of us keeping an eye on our own accounts' transactions.

          If we don't take responsibility for our own financial affairs, should we really expect the banks to carry the whole burden on our behalf? No matter how good it is, any security measure can (and likely will, sooner or later) be defeated. (and let's not forget good old fashioned social engineering...)

          In the end, the best protection against a breach is constant vigilance. (Or, said another way, prevention only goes so far, detection is still requried ;-)

        • by dissy (172727)

          For these laughable "protections", I'd be far better off keeping my money under my mattress. It seems to me it should be 100% of the job of the bank to keep my money safe and secure.

          To be fair, for those of us that just keep money at a bank, they DO keep it pretty safe and secure.
          (Barring the bank going out of business in a tragic way or something of course)

          The problem is, as you hinted at in your first post, that by asking for a debit card (Or by not refusing one) you are basically instructing the bank that anyone using this set of 25 digits* has the ability to take money from the account.

          *(30 digits if zip is required, but I didn't think that one was enforced by the bank, just CC# C

    • by Twinbee (767046)

      Perhaps we should let the government control our banks, or at least get them to set up non-profit companies.

      Stories like that make me feel ill.

      • Re: (Score:3, Insightful)

        by socsoc (1116769)
        We should control the banks in the US, since we basically own them via bailouts anyway.
    • by Kitkoan (1719118) on Thursday April 15, 2010 @08:07PM (#31866490)

      They could require the deployment of chipped banking cards.

      And this is where most of the problem has been caused. The belief that if we put those RFID chips in our bank cards, they [boingboing.net] must [engadget.com] become [daniweb.com] safer. [hackaday.com] The problem is, it's the chip that is the biggest security issue since its RFID it's 'always on' and more then willing to send it's information to whomever asks. The banks and credit card companies have invested millions, if not in the billions, of dollars into the technology and its a flop. A massive, expensive flop. And now they have 2 options. Fess up that it's a failed experiment and have very pissed off investors. Or, censor/intimidate anyone who wishes to publicly expose [engadget.com] this as the failure it truly is.

      • by plover (150551) * on Thursday April 15, 2010 @08:49PM (#31866844) Homepage Journal

        Did I say RF? No, I said "chipped", although once the security is done correctly RF might not matter as much as you might think.

        The correct protocol is for the merchant to tally the merchandise, and present the customer's card with their merchant ID and the transaction amount. The cardholder then has to see and approve that amount by entering a PIN in order to generate an authorization. (The cardholder needs to enter that PIN into a trusted device, which is best met by a smart card with a built-in keyboard and tiny display, or alternately by a trusted keycard device issued by the bank.) The card uses the PIN to generate a one-time approval code, which is forwarded by any means to the bank, along with the card data (account number or whatever), the amount, and the merchant ID. The bank returns an approval code to the merchant, who gives the merchandise to the customer. All this is digitally signed, of course, and the protocols need to be well laid out to avoid potential problems with respect to money laundering, man in the middle attacks, etc.

        Note that the customer's account number is only usable for identification. It's only the chip-generated authorization combined with the user entered PIN that carries the value. Something you have plus something you know.

        The authorization data is carried by the merchant and delivered by whatever means to the bank. The Internet would work fine. The merchant can see your account number, but they cannot charge you anything other than the value included in your approval. The authorization code is accepted by the bank for one time only use, and they will pay only the merchant ID indicated in the transaction.

        Note that in this case, the card is issued by the bank. The certificates and keys are created and injected in the card by the bank. That means it's 100% bank-owned-and-provided hardware from customer to bank and back again. The bank is 100% in charge of security. All you have to do as a customer is not to lose your chipped card AND keep your PIN secret.

        An RF based card would make only a minor difference in security. Sure, someone could ping it, but they couldn't get it to emit an authorization token unless they had it in their hands and pushed the tiny buttons. Protections would have to be taken to prevent RF based man-in-the-middle attacks between the merchant and the customer's card, otherwise the merchant might not get paid. But the customer's money is never at risk except when they are entering their PIN, and are staring at the tiny screen that says "PAY WALMART AMT=$34.56".

      • Re: (Score:3, Informative)

        by Zironic (1112127)

        Uhmmm, that's not what a chipped card is. This is a chipped card http://en.wikipedia.org/wiki/Smart_card [wikipedia.org] and it's way

    • My wife works at a Credit Union and gets these types of things all the time. There are a few things you can do.

      1. Get a Bank or Credit Union that gives a damn. Investigate before you choose one. A good one will monitor your activity and shut it down and call you when something goes wonky (like charges from all over the place or charges from known fraudulent organizations). When it does go wrong a good one will either fix it quick or possibly give you provisional credit to get you buy until they do fix i

    • by oasisbob (460665)

      Credit cards are limited by U.S. law to a maximum of $50 liability to the cardholder. Debit cards losses are usually covered by the bank, but they are under no legal obligation to do so.

      That simply isn't true. See Regulation E [bankersonline.com].

    • by archmcd (1789532) on Thursday April 15, 2010 @08:52PM (#31866886)

      I work in bank security, and I just wanted to offer some clarification on your rant:

      If you want a more achievable answer in today's plastic world, DO NOT CARRY DEBIT CARDS. Debit cards do not offer you protection against loss.

      A debit card can be used in two ways. It can either be used with a PIN in what's commonly called a debit transaction (or at an ATM), or it can be used as a "credit" transaction and processed through the Visa or MasterCard network. There is little to no protection against loss for the former of these transaction types, except keeping your PIN secure. The "credit" style transaction, on the other hand, is protected by a zero liability guarantee (at least Visa cards... not sure about MasterCard). Yes, your bank account may get cleaned out (or depleted up to the daily spending limit of your debit card), and outstanding checks may bounce, and you may have a freeze on your account until it gets resolved. However, this zero liability guarantee means any transactions found to be fraudulent will be reimbursed by your bank. The bank then goes after the merchant that processed the transaction to recoup their own losses. If you have a good bank, they'll also refund your overdraft fees. Debit or ATM transactions, on the other hand, are not covered by the same guarantee, so having your card skimmed and PIN captured is far worse - UNLESS your bank offers a guarantee on these types of transactions as well.

      See http://usa.visa.com/personal/cards/debit/visa_check_cards_faq.html [visa.com]

      Credit cards are limited by U.S. law to a maximum of $50 liability to the cardholder. Debit cards losses are usually covered by the bank, but they are under no legal obligation to do so.

      Losses due to fraudulent transactions processed through the Visa network are actually covered by the merchant that accepted the transaction, not your bank. Your bank only covers "Debit"-style losses they agree to cover if they offer protection against Debit or ATM transactions, but that's not a standard program.

      For ATM access, most banks will honor your request for an ATM-only card instead of accepting their default ATM/Debit card.

      An ATM-only card means you will have to use ATMs more frequently, thereby potentially exposing yourself to skimmers, as well as use of your PIN in public. Since there's no zero-liability coverage with most banks for skimmed ATM transactions, you're putting your money at greater risk by doing this. Oh, and by the way, the skimmers have this one figured out too. You no longer have to worry about the shady looking person loitering near the ATM watching you enter your PIN. They install a tiny camera painted to match the fascia of the ATM, and they aim it at the keypad.

      • by natehoy (1608657) on Friday April 16, 2010 @08:12AM (#31870710) Journal

        Yes, your bank account may get cleaned out (or depleted up to the daily spending limit of your debit card), and outstanding checks may bounce, and you may have a freeze on your account until it gets resolved. However, this zero liability guarantee means any transactions found to be fraudulent will be reimbursed by your bank. The bank then goes after the merchant that processed the transaction to recoup their own losses. If you have a good bank, they'll also refund your overdraft fees.

        Meaning no offense, but why in the hell would this make me want a debit card?

        Maybe the bank would give me back my fees and losses, but I've still bounced checks with God-knows-who and caused them all manner of hassle and had them incur fees and lost trust with them. If my bank account gets cleaned out the day before my IRS check hits, do you seriously think they'll just chuckle and say "oopsie, well, we'll clear it again". No. I'm going to spend hours on the phone with everyone I sent a check or made an automated payment to, trying to dig my way out of the hole that used to be my bank account.

        I've had an account cleanout happen (account was cleaned out by lawyers suing my parents, and I stupidly left my mother's name on my bank account). My mortgage and car payment checks were in the outgoing mail the same day I received the "summons to trustee" notice, and all my money was gone. It worked out, but I had to take two days off work (lost vacation time) to make all the necessary phone calls, and I still had a black mark on my credit rating for several years afterward, even though none of the bounced checks were determined to be my fault. I worked for a bank service company at the time, and they routinely pulled credit ratings (since I handled account details on a lot of people). I had to spend a couple of hours explaining the whole situation at work, and it's possible I could have lost my job over it. Fortunately I didn't. Net result was an absolute nightmare, and my bank was actually pretty nice and helpful about the whole thing.

        I also had my credit card number compromised once (Hannaford breach, and my card was actually used overseas). Visa called me, said that the card had been suspended but that any automated payments I had set up would work for another week to give me time to transition to the new card number, went through the outstanding charges over the phone to verify that they were all valid, apologized for the inconvenience, and I never even saw any of the fraudulent charges at all. I spent 15 minutes on the phone with them, 10 minutes entering the new card on my automated payments, and another 5 minutes cutting up the old card when the new one came in. Impact to my credit rating: none.

        "Yes, the debit card can be almost as secure as the credit card if you use it as a credit card, and if your bank is really nice the resulting damage to your account and credit rating can be built back to almost new after a lot of effort!"

        Thanks, I'll use a credit card. If it gets used fraudulently, the onus is on the credit card company to help me out, because my money is not gone. A credit card does not have access to my checking account. That's a very important distinction to me.

  • Get a credit card (Score:5, Insightful)

    by HeavyD14 (898751) on Thursday April 15, 2010 @07:33PM (#31866174) Homepage
    If it gets stolen, it's not your money. Also, you got skimmed.
    • Re: (Score:3, Funny)

      by Anonymous Coward

      Most likely skimmed.

      What's your card number and PIN so I can check.

      • by Tumbleweed (3706)

        Most likely skimmed.
        What's your card number and PIN so I can check.

        Oh, awesome, service, thanks! My card # is 1234-5678-9012-3456, and my PIN is 1234 (same as my luggage, so I don't have to remember multiple numbers; I recommend this 'mnemonic device' to all my friends!).

        Thanks so much, you're a real pal!

    • by adolf (21054)

      The same fraud prevention policies apply equally to both credit and debit cards bearing the Visa or Mastercard logos, for transactions in which Visa or Mastercard is involved.

      So, if you only ever use your "debit" card to perform "credit" transactions, and nobody has your PIN, you're just as well protected as you would be with an actual (debt-based) credit card.

      However: Neither Visa nor Mastercard can do a damned thing if someone has your card number and your PIN, since a criminal in possession of both of t

      • by HeavyD14 (898751)
        You missed the point, if your credit card number gets stolen, your checking account doesn't get wiped.
    • by Tumbleweed (3706)

      If it gets stolen, it's not your money.

      Well, yeah, not anymore, it isn't. Hence, the stealing.

    • Re:Get a credit card (Score:5, Interesting)

      by Citizen of Earth (569446) on Thursday April 15, 2010 @09:23PM (#31867144)

      Also, you got skimmed.

      I saw a news show recently reporting that lots of crooks have been breaking in to stores to steal the hard drives out of the cash registers. Lots of the registers store your debit/credit card information unencrypted and criminals can recover and use tit. One more reason I always use cash for minor purchases.

      • Re:Get a credit card (Score:5, Informative)

        by scdeimos (632778) on Thursday April 15, 2010 @09:53PM (#31867364)
        A lot of the audit rolls in cash registers also record card numbers. And yet business is heard to say, "we only store card numbers in encrypted data marts." My ass.
      • Re:Get a credit card (Score:5, Interesting)

        by Alarindris (1253418) on Thursday April 15, 2010 @11:49PM (#31867956)
        I work at a gas station part time. We just got a new computer system and I was appalled to see that when we printed off the numbers for the day, the credit/debit card numbers for each transaction are listed with the name on the card and expiration date. Although we do hold on to them for 7 years and then they are sent to the main office for another 8, it seems pretty damn sloppy to me.
  • by QuantumG (50515) * <qg@biodome.org> on Thursday April 15, 2010 @07:35PM (#31866190) Homepage Journal

    How the banks advertise it: "Use your own money to shop online!"
    What it actually means: "Expose the cash you need to live on to fraud."

    The banks like it because you're putting your money at risk, not theirs.

    • How the banks advertise it: "Use your own money to shop online!"
      What it actually means: "Expose the cash you need to live on to fraud."

      The banks like it because you're putting your money at risk, not theirs.

      Which is why I've used AMEX for my daily expenses for close to ten years now. It's a charge card, not a credit card, so you don't get deep in the debt hole... you have to pay the balance at month's end. But it has all of the standard protections of full credit cards. Someone, probably a clerk at a store somewhere, used my number for fraudulent purposes, and as soon as I noticed it on my bill, AMEX froze the charge, and launched and investigation immediately. They kept me up to date the whole time. Also, if

    • Legally.

      In most countries a bank account is legally a loan to the bank. Legally it isn't a safety deposit box where they store your money for you.

      This means the money is theirs to do with as they please and they are graciously allowing you to use their credit instead, with the attached terms and conditions.
       

  • by CohibaVancouver (864662) on Thursday April 15, 2010 @07:36PM (#31866198)
    Step 1: Cut DEBIT "check" card in half
    Step 2: Just use a CREDIT card. You're protected. Problem solved.

    In Canada you need an ATM PIN to use a debit card linked to a bank account, but the PINs can still be skimmed by compromised payment terminals. I only pay by credit card.
  • Get a new bank (Score:5, Interesting)

    by KalvinB (205500) on Thursday April 15, 2010 @07:37PM (#31866210) Homepage

    Shop around for a bank that actually values you as a customer. I believe Bank of America will give you your money back within 24 hours. I'm not a fan of theirs but at least they do that for you. I personally use US Bank.

    • Re: (Score:3, Insightful)

      by Sean5033 (246214)

      This happened to me recently with B of A. I live in FL, and someone used my card in NJ. Bank of America shut my card off right after it happened, sent me an email, text message, and gave me a phone call letting me know they'd detected fraud. When I called them back, they gave me the option to turn the card back on (in case I'd jumped on a plane to NJ) or initiate a fraud investigation.

      I think the fraud algorithm they use is pretty good, they found it right away. Fortunately it was only a $4.80 "test" ch

    • by godrik (1287354)

      I am not sure how it is in your country (since you do not say anything, I guess you live in the USA). I would go with get a new bank. My wallet was robbed one day. I called the phone service of my bank which is 24/7 as soon as I got that my wallet got stolen. My visa card was 'revoked' the day after.

    • Re: (Score:3, Insightful)

      by Matheus (586080)

      I've had to have transactions purged from my card a number of times... once stolen... a few times just stupid hotels double billing me 4-figure hotel bills.. and others.

      Wells Fargo got me my money back immediately on claim (with restrictions) and within a week for real (once they had investigated).

      No bank is perfect but for a large one I'm generally happy with the wagon.. of course don't get me started on over-draft fees :)

      • by Tumbleweed (3706)

        Same here for me with Wells Fargo, except they called me to ask if I had made certain funky-looking purchases (I had not) before I had even noticed. If you're going to go with a BigBank, Wells Fargo is the one, for sure. One of my local branches is even open until 5 or 6 on Saturdays, which is extra-special-nice.

    • I've had terrible experiences with Bank of America being unwilling to refund any money with clearly fraudulent charges. Had to fight for weeks to get any refund, and they were uncooperative the whole way. In the end I wound up switching to PNC and haven't had any problems with their service.

      With that said, however, I think it depends entirely on what branch of each bank you're at and what call center you get routed to when trying to go up the corporate ladder. YMMV.
      • by MWoody (222806)

        I have several complaints about BofA, but their handling of fraud isn't one of them. I've had my debit card stolen by Gypsies (yes, really) while in Europe, had it exposed by an online store's security compromise, had an Ebay transaction go very bad, and had it once used to buy $50 worth of gas 100 miles away where I never traced the angle of attack. In every case, I had the funds back within hours and a new card within the week.

        Actually, I did have one complaint: when they stop a potentially fraudulent c

    • I can't speak for BofA, as I use a local bank that only has three branches.

      A few months ago I was on a trip to northern Michigan (i live in southern Indiana), and I ran across a good deal for a digital camera, so I bought it. About 45min later I got a phone call from a lady that works in fraud for the bank, she just wanted to make sure it was me that made the transaction.

      Apparently they do this for any oddball purchases such as that.

  • by Potor (658520)
    I travel a lot. I tell Visa where I am going to be, whenever I buy a ticket.

    The've actually stopped me from using my own card. A minor inconvenience for peace of mind.

    • It's annoying either way.

      So in short: Use a credit card and if you get hit with fraud, have a backup credit card to use until the charges are reversed.

      Most people don't realize that the onus is entirely on the bank to deal with fraud, it's their money and problem, not yours as a card holder.

    • by humphrm (18130)

      This doesn't stop a skimmer from using your card across town. Also, what should he have done in this case, called Visa and said "I am not going to be on the other side of the country, or Europe next week"?

  • 1) Get a bank that lets you put your picture on your card (in case your card is physically stolen)
    2) If it's possible (not sure on this one), get a card that can't be used without a PIN
    3) If it's possible (not sure here either), get a bank that allows you to configure your card to only be used online if the security code on the back is also used. MANY places online still don't ask for this, for some reason. The payment systems DO know the difference between whether a card is being used in person or not, so

  • by John Whitley (6067) on Thursday April 15, 2010 @07:40PM (#31866234) Homepage

    But I also think that those producing these check cards should be required to advertise the hazards of having one of these cards

    NO, NO, NO. No stupid, pointless warnings. Make the financial institutions solely liable for all identity theft. They're the only ones with the ability to stop it, and they should be the ones that bear the full economic incentive for managing fraud.

    But I didn't say it first, Bruce Schneier did [wired.com]:

    The actual problem to be solved is that of fraudulent transactions. Financial institutions make it too easy for a criminal to commit fraudulent transactions, and too difficult for the victims to clear their names.
    [...]
    It's not that financial institutions suffer no losses. Because of something called Regulation E, they already pay most of the direct costs of identity theft. But the costs in time, stress and hassle are entirely borne by the victims.

    The whole article is +5 Insightful, well worth reading.

  • by roc97007 (608802) on Thursday April 15, 2010 @07:42PM (#31866260) Journal

    One day I found that my bank account had been cleaned out. There were a massive number of $50 charges from one vendor -- essentially they kept charging $50 until they got a decline. The charges had occurred after 11:00 PM and before 5:00 AM local time, which made me think that time zones were involved.

    I called the bank immediately and reported it, had the card frozen but by that time there was only about $20 left.

    I did some research from the transaction information -- the company had an address in California that appeared to be fake, an 800 number that was disconnected, and the domain was owned by a different company in Korea.

    I printed all this out, took it to the credit union. They had me fill out some forms, and gave me access to some money (I was pretty much broke) while they worked on it.

    Within 3 days all my money was returned to me. It's possible that the credit union fronted me the cash while they worked with the authorities -- they never said. But as far as I was concerned, the event was over in less than a week.

    Maybe it makes a difference which bank you use. Or maybe it's the difference between a bank and a credit union. I dunno.

    I never did figure out how they got my numbers.

  • by parallel_prankster (1455313) on Thursday April 15, 2010 @07:48PM (#31866310)
    I have set up my acct such that if there is an access made more than a certain amount of money and/or out of my local area, they call me/text me to call them and verify the transaction. I am not a frequent traveller, so this works out for me. Look up if such a facility is available with your bank too. Another thing, see if they offer some sort of fraud protection mechanism. Some banks do that. That takes off some of the time-delay/processing worries too. If you choose to use your debit card and not credit card mostly, also, move your money from checking to some savings account and keep very little ( subjective) money in checking. That may help too.
  • You know the saying about having a single point of failure, all of the eggs in the same basket, etc... Have enough cash on hand to see you through the time it takes to get something like this resolved. An 8 to 12 week supply is probably prudent, as well as a reasonably robust safe to keep it.

    CDs are also useful, though someone could conceivably take those as well.

  • I won't use a debit card untill they make crediting the account just as fast as a debit action. In other words, never.

    zenray

  • by cortesoft (1150075) on Thursday April 15, 2010 @07:55PM (#31866392)

    Debit cards are functionally useless, since they give you nothing that using credit card which you pay off every month wouldn't while costing you quite a bit.

    If you have a credit card you pay off every month, you get an interest free loan for a month. You earn points for rewards. You get protection against fraud. You often get warranties on things you wouldn't normally get.

    You get NONE of this with a debit card. The only reason a debit card is preferable is if you don't have the self control to spend an amount you can pay off every month, or you have such a bad credit rating you can't get a credit card with a grace period.

    • by symbolic (11752) on Thursday April 15, 2010 @09:35PM (#31867224)

      Actually, I view debit cards as just the opposite - for people who aren't inclined to spend money they don't have. Credit cards are a trap that get people into a lot of trouble, quite frequently.

  • I have been telling people for YEARS how unwise it is to have or use a "debit" card with a Visa/MC logo on it. My bank kept INSISTING that I use one, and I would have to send it back and tell them to please send me a regular debit/ATM card. Many of the same people that thought I was "paranoid" and "obsessive" or just plain strange don't think so anymore. I know more than one person who has had money taken from their account and then it is up to THEM to try and get their money back, meanwhile checks are b

    • by oasisbob (460665) on Thursday April 15, 2010 @08:44PM (#31866806)

      I have been telling people for YEARS how unwise it is to have or use a "debit" card with a Visa/MC logo on it. My bank kept INSISTING that I use one, and I would have to send it back and tell them to please send me a regular debit/ATM card. Many of the same people that thought I was "paranoid" and "obsessive" or just plain strange don't think so anymore.

      You are paranoid. And ignorant. As long as you report the theft to your financial institution as soon as you learn about it, there are strong protections in place. It's simply not true that it's up to YOU to track down your money. It's up to your financial institution. They are required by law to credit you in the case of errors or unauthorized purchases, and are even required to issue a provisional credit in many cases before the investigation is complete.

      A Visa Debit card carries the same protections [visa.com] as a Visa Credit card for signature based-transactions. PIN based transactions are still covered by Regulation E [wikipedia.org], which protects the consumer.

      And there's no such thing as a perfectly good ATM card: with a skimmer, a fraudster can clone your ATM card and have your PIN. Fraudulent PIN based transactions are MUCH harder to refute. People call up all the time and say, "I have no idea how that person got my PIN number, I've never given it to ANYONE!" We (my bank) pull the ATM video, and sure enough it's their son/daughter. The consumer sheepishly admits, "Oh, well, I just told them my PIN once, months ago..." Given the choice between turning the video over to the police or rescinding the claim of unauthorized use, many people will choose the latter.

  • Interestingly enough, a Australia's largest shopping retailer (Woolworths) has just stopped the use of debit cards in their store - citing excessive bank fees. Instead, customers must use EFTPOS - which goes directly through the banking network and not Mastercard or Visa.

  • by oasisbob (460665) on Thursday April 15, 2010 @08:08PM (#31866498)

    IAABG (I am a banking geek).

    The rules for provisional credit on debit cards is very well established. They fall under Regulation E, section 205.11. [bankersonline.com] The bank has ten days to get you a provisional refund, and can take up to 45 days in certain circumstances to complete their investigation and finalize the credit.

    Make sure you get them a notice in writing! Once you do, they have ten days to credit you, and many banks will do it much faster. If the bank drags their feet, just tell them "I want provisional credit within the mandated timeline per Regualtion E".

    Here's more on this topic:
    http://www.bankersonline.com/technology/guru2008/gurus_tech022508c.html [bankersonline.com]
    http://usa.visa.com/personal/security/visa_security_program/zero_liability.html [visa.com]
    http://finsolinc.com/Reg%20E%20EFTA%20Error%20Resolution%20Flowchart.pdf [finsolinc.com]

    The protection for misuse of debit cards is strong, you just need to know what to do. If your bank isn't responsive, Move Your Money [moveyourmoney.info] to a smaller institution that cares.

  • Protection (Score:4, Insightful)

    by arizwebfoot (1228544) on Thursday April 15, 2010 @08:10PM (#31866528)

    I have a separate account with debit card that stays zero. When I know I'm going to pay a bill online or use for some other purchase, I move just however much I need into that account to cover the purchases or debits. In this way, if some one gets ahold of the number, there isn't a lot they can do with it.

    Also I don't have overdraft protection on that specific account so that again, if someone gets my number(s), there isn't much they can do about it. Sure I may get nailed for a hundred bucks - if they catch it at the right time - otherwise, they just don't get my money.

  • by KevMar (471257) on Thursday April 15, 2010 @08:18PM (#31866588) Homepage Journal

    It is no longer a question of if your card will get stolen, but when will it get stolen.

    I keep my daily limit low on my debit card. Around $250-$300 is my daily max. When I want to purchase something over that I call the number on the back of the card and have it raised. After the purchase, I call back and lower it again. The few times I need to make that call are worth it.

    Once I was calling back to get it lowered and the lady was so confused as to why anyone would want such a low daily limit. Once I explained it to her, she thought it was a good idea.

    I use this card every day. So if someone runs it to its max, I will find out about at lunch time. If I am out that 300, its a manageable loss.

    What if you could get back every dollar that they take from your account from the bank (or some type of insurance)? Lets just say you have a high daily limit and they are able clean out your account in 1-4 days. How long can you survive while you wait to get it back. Thats the scariest thing about it comming directly out of your account. It is money you are missing while you try to get it recovered. When it is on a normal credit card, you can still make your house payment. There is no way they could get that back to you over night. It would take days or months while they investigate.

    The most common theft of credit card numbers are from family members or someone you know. When charges are local to you, the investigations require more time and take more work.

  • As others are going to point out, short of a miracle you'll have a hard time persuading banks to move to anything more secure, but...

    Currently, if I order online, I give the retailer my credit card number, expiry date, the security number off the back, my name and address. I might as well just post them my passport, in terms of giving them things that can be mis-used. So, better plan; I attach a trusted (as in I trust it, not to be confused with Intel's idea of giving you hardware the MPAA trusts) hardware

  • It sounds counterintuitive but the real solution is to just never use a debit card. Have a separate ATM card and credit card.

    When you're using a credit card, you're protected automatically when things like this happen. If you claim that a charge is fraud, it is up to the merchant to actually prove that it is a legit charge. This means that your credit card company will remove the money from the merchants account immediately. If they fail to prove (usually by signature or some other means) that you made

  • HSBC, the chinese bank, has been handling my money for a long time. I use a debit card and quite freely, I might add. I had never had a problem until about 6 months ago, when I saw a transaction which I hadn't made.

    I called the bank immediatly and told the nice lady my problem. What she said was "Are you sure you didn't buy anything from companyname on that date? Alright. Do you agree to pay any charges that could arise if the company has the signed voucher for that purchase? You do? ... ... ... Ok, sir,
  • by straponego (521991) on Thursday April 15, 2010 @08:27PM (#31866682)
    They encourage the use of signature cards instead of PIN cards, even though PIN cards cost them much less to process. That's because they can add their cut on top of that price, and pass the cost on to you.

    Signature debt card fraud is about 15 times as high as PIN debt fraud. When was the last time somebody checked your signature on a card?

    So, it's more wasteful, and enables vastly more fraud, but the banks love it. But I guess that makes sense; bankers are, after all, parasites and crooks under the protection of law.

    Let me give another example of how they don't care about real security. USbank's online banking service now interrupts the standard username/password entry process by asking you a "security question." These questions are things that you could find about most people in a couple of minutes, by looking at Facebook/google, knowing them casually, guessing, etc etc. The answers are shown in the clear. So where, on every other site you've ever used (including, until recently, this one) you'd expect to be typing your password into an obscured field (********), you instead are typing into a box that anybody near you can read. Awesome. And in exchange, the security you get is... a trivial question, and a picture from a handful of pictures you're allowed to set as your "security image". Which anybody within 50 feet can see.

    [Reviews comment in case caffeine has led to unfortunate or controversial comments. Nope, looks good!]
  • Smart-style Cards loaded with one-time pad data that are recharged from time to time. No reason why a credit card number should ever work twice.
  • by sirwired (27582) on Thursday April 15, 2010 @08:36PM (#31866742)

    This is EXACTLY why I refuse to carry a debit card. With one swipe, your account is empty and your mortgage bouncing.

    With a credit card, you argue with the bank about THEIR money.

    With a debit card, you argue with the bank about YOUR money.

    Guess which sort of inquiry receives more attention?

    SirWired

  • by JonathanX (469653) on Thursday April 15, 2010 @09:03PM (#31866970)

    The whole point of a bank (at least originally) was to keep money safe by making it difficult to access. Through the years we have demanded that banks make it easier and more convenient to access our money, and now we are paying the price. Security and convenience are inversely proportional to one another. It is a mystery to me why we, as a civilization can't seem to grasp this basic concept.

  • by JoeBanker (1791172) on Thursday April 15, 2010 @10:02PM (#31867418)
    I work IT in a community bank. I work very closely with our Operations and Fraud department. Here is what I can tell you about VISA debit card fraud. If you are a consumer, you are totally protected IF you report your debit card being lost, stolen, or compromised within 3 days that you became aware of it being lost, stolen, or compromised. The bank will also have a hard time proving when you found out you had a problem with your card. The bank HAS to give you your money back. VISA and Washington D.C. make all of these rules. The little known secret is that banks take huge losses on debit card fraud because the regulation coming from Washington D.C. totally protects the consumer. Most of the time in a fraud case, the bank isn't able to recover the money from the merchant and they have to refund the money to the consumer. Therefore, the banks lose money on VISA debit card fraud. As consumers, you really have nothing to worry about when it comes to VISA debit card fraud. You are totally covered. If you have a VISA business debit card though, you are not covered by the regulation and you are subject to taking losses in a fraud case. If you are a business owner, you better be REALLY CAREFUL when it comes to who has business debit cards tied to your accounts. In your case when the bank said 3 - 5 weeks to return your money, you should change banks. Go to a good community bank or credit union in your area. Somewhere that will recognize you as a person and not a number. Stay away from the large nationwide banks and regional banks. Especially the ones that are having loan trouble. They are trying to stay afloat by sticking all of their good customers with lots of account fees. I use my VISA debit card everywhere and never worry about fraud. You should do the same. I do suggest that you be careful using it on the Internet. As a computer security professional, I do recommend that you practice good computer security.... AV, Web Filtering, OpenDNS, Patching, etc....
  • a nice low tech fix (Score:3, Interesting)

    by smagdali (1234692) on Friday April 16, 2010 @02:27AM (#31868650)
    My South African bank has a nice, highly effective, easy to implement, widely available, cheap, and easily solution that doesn't eliminate fraud, but certainly minimises its effects. Whenever I use my (VISA) debit card, I get an SMS with the date, time, amount and location. I, maybe, in a week, make 20 card transactions, so the cost is 50c/week max to the bank buying in bulk. If I see a transaction I don't recognise, I phone the bank. compared to all the mostly wasted investment in PCI (including all the requirements that weaken rather than strengthen your website's security), the phishing friendly bullshit of Verified by VISA etc, it works like a dream.

FORTRAN is a good example of a language which is easier to parse using ad hoc techniques. -- D. Gries [What's good about it? Ed.]

Working...