How to protect yourself from debit-card fraud

Filed Under: Featured, Phishing

Bank cards. Image from ShutterstockHow's this for a phone call you don't want on a Sunday night: Visa's fraud unit, calling to ask whether you're aware that $1,371 has been wired from your bank account via Western Union.

Lisa Rokusek was definitely not aware of this transaction, since she hadn't initiated it.

As it turns out, Rokusek, a US woman from St. Louis, Missouri, should have been wary of that phone call, too, if the caller did in fact claim to be from Visa's fraud unit, as originally reported in the St. Louis Post-Dispatch.

As a Visa representative told me (and at least one reader pointed out) after this story first ran, Visa's fraud unit doesn't call consumers when they detect suspicious patterns in such cases. Instead, they call the card's issuing bank, which has the consumer's contact information.

This is an important note, because scammers try to phish information by claiming that a call is coming from Visa's fraud department, Visa told me.

Given that the funds were wired from her account, the Visa representative pointed out, Rokusek was likely the victim of wire fraud. Could somebody have pulled a fast one with her debit card? Or did somebody get her account information solely through phishing?

We don't know at this point. At any rate, however the money came out, it got out, and it made Rokusek one of many victims of credit card or debit card fraud last month.

As the St. Louis Post-Dispatch's Jim Gallagher notes, a report from ACI Payment Systems released in October found that 42 percent of US survey respondents have been victimized by credit, debit or pre-paid card fraud over the prior five years.

It's bad outside the US, as well, with one in four survey respondents across 17 countries reporting such victimization.

When it comes to this type of fraud, there's a big difference between credit cards and debit cards.

When users spot fraudulent charges on their credit card bill, they can simply decline the charges and not pay the bill.

Debit cards, in contrast, draw money directly from your checking account, with no intermediary credit card company acting as a buffer.

That can mean a world of hurt to those whose debit cards are compromised. cites the case of the T J Maxx data theft, which resulted in $150 million in fraud losses - much of it clawed directly out of customers' bank accounts.

Frank Abagnale, a secure-document consultant, told Bankrate that credit card users in that breach got their accounts straightened out, with new cards in the mail, within a few days.

Fraud. Image from ShutterstockDebit card holders, on the other hand, waited an average of two to three months to get the swindled money reimbursed.

That's a lot of time to live with a bank account that's been popped like a balloon.

So how can consumers protect themselves from debit card fraud?

Some safeguards, from the St. Louis Dispatch and other sources:

Don't fall for phishing emails. Phishing email tries to trick victims into thinking that it comes from retailers, banks, or the US Internal Revenue Service (or whichever tax organization pertains to a given country), for example.

In fact, brazen phishers recently even used the US Federal Trade Commission (FTC) as a cloak. The FTC in January issued a warning to businesses about a phishing attack that was targeting small and medium-sized companies with bogus complaint files that purportedly originated from the FTC.

Once you click on a phishing email, you're typically taken to a phony website that lures victims into giving up their card or bank account numbers. Presto - the thieves are in.

Pay attention to bank and credit card statements. Speed is of the essence when it comes to reporting debit theft. If you report fraud within two days of receiving your statement, your liability is limited to $50.

If you wait up to 60 days, that liability goes up to $500. You can lose everything - your entire account balance - if you wait longer than 60 days.

In that time, you'll run the risk of bouncing important checks, such as those used to pay the rent, your mortgage, or your credit card bill.

Online shopping. Image from ShutterstockCompare that with credit card liability: If you lose your credit card, your loss is limited to $50, although most credit card issuers won't charge you anything at all. If the card number is stolen, as opposed to the card itself, the FTC says you're not liable for anything.

You can find more information on liability for the US here and the UK here. People from other countries should check with their local financial authority for liability information.

Don't let your debit card out of your sight. That's the advice Denise K DeRousse, senior vice president for retail banking at Pulaski Bank, gave to the St. Louis Post-Dispatch's Jim Gallagher.

Pay attention when clerks swipe your card. Also, take care when handing over your card if you want helpers to pick up groceries. They'll have your name, your security code and the card number: all they need, in other words, to vacuum out your account.

Ditch the debit/credit card. Detective Michael Hodge, who was assigned to Lisa Rokusek's fraud case, told Gallagher that he recommends using a simple ATM card along with a separate credit card, rather than the combined debit/credit cards that are now so popular.

That's constitutes a tradeoff, unfortunately, given that many banks are now requiring a minimum number of debit-card-used-as-a-credit-card purchases in order for account holders to qualify for high-performance bank accounts, which pay slightly less anemic rates than otherwise.

Good luck in choosing which is less painful in that scenario. I'm mulling it myself.

If you have other tips on securing your debit card, please share them in the comments section below.

Updated to include corrections from Visa.

Bank cards, online shopping and fraud images from Shutterstock.


You might like

17 Responses to How to protect yourself from debit-card fraud

  1. Keith · 910 days ago

    Don't fall for phishing phone calls. If "Visa's fraud unit" (or anyone claiming to represent your bank) calls, don't give them any personal identification. Hang up and call the phone number on the back of your card.

  2. Matt · 910 days ago

    My debit card was hit for a little over $400. Took CapitalOne about 48 hours to put the money back in the account and I had a temp replacement card same day, and permanent card within 72 hours

  3. Nick · 910 days ago

    Don't use your debit card while shopping online. Only use a credit card.

  4. bodisky · 910 days ago

    I have a separate account for online purchases or bill pay. I only put money in it as the bill or purchase is made/generated. When this account was compromised, it was a company called Drawwer they took $5.94. I caught it quickly but the money was still lost. The bank told me that all I could do, besides getting a new debit card which I did, was to report it to the fraud department.

    • JohnC · 909 days ago

      What you encountered is not unusual. The fraud department of the bank is the department which has the authority/expertise to investigate losses and issue refunds. When your bank told you to report the incident to the fraud department, they weren't refusing to refund the lost money, they were simply making you go through proper channels to get it. Unfortunately, the process can be quite slow. Been there, done that.

  5. Use a clean email account for your financial transactions and accounts, do not use that account for ANY other online activity.

    you will automatically know that all mail not coming to THAT account is not related to your real financial situation. scrutinize all mails coming to your special account and request 'text-based' mails whenever possible.

  6. bodisky. Yours sounds like mine, 3 times in a year always a small amount $6.92, $9.84 etc to some online company. When researching all these companies turn out to be bogus. I was lucky and caught them within 24 hrs and went to my bank. I deal with BB&T who were great about it (and seemed quite used to it) they reimbursed me immediately, let me take what I needed out of my account, then I had to wait 7-10 days for a new card. A pain but at least I didn't lose the money. I can't figure where they're getting it from, I don't fall for phishing scams, email or phone, I was only using it online from a secure connection and decrepitude companies. This last time I've decided to go cash only for most things. Use the card for gas & groceries and nothing else.

  7. NonYa · 909 days ago

    I live in Mexico now and let my bank (USAA) know about it. So when a purchase was made on my debit card from a Walmart in Chicago, they caught it immediately, caught the guy, blocked my card and sent me a new one before I even called to see why my card was blocked. USAA is AWESOME!!!!

  8. Joe Fletcher · 909 days ago

    My understanding is that purchases made using a debit card as a credit card guarantee that you have the same protections against fraud as you would if you had used a credit card.

    Using an isolated account for debit cards - as suggested by others here - make a lot of sense.

    • Salal · 663 days ago

      Joe is correct, protections are in place for both credit and debit cards. If no PIN number is used, then your liability is zero for fraudulent charges (under Visa rules, not sure about Mastercard). The article states that it can take up to 2 months for a debit card fraud to be resolved, I'm not sure what bank that is, but at my credit union, you get the funds back to you the same, or next day that you inform them of the fraud. I'm pretty sure that is industry standard, otherwise you'd have lots of upset people.

  9. MikeP_UK · 909 days ago

    It seems to me that the rules and regulation commented on above apply to US cards and banks. Rules in the UK and elsewhere are different and some offer much less protection to users of debit cards compared to credit cards. Something that law makers should look at seriously to protect those not wanting to have a credit card.

  10. spryte · 909 days ago

    Recent statistics from Interac (Canada's debit card) shows a significant decrease in debit card fraud since the "Chip" card was introduced around 2009.
    (see:, for more info)
    Beware if you have to "swipe" the magnetic strip instead of inserting the chip into the card reader. There are just too many things that can go wrong.

    At the time of the TJ Maxx fiasco my bank sent me a letter informing me my card information had been compromised, as TJ Maxx stored their transaction information in the U.S., not here in Canada were Winner's and Home Sense stores are located.
    The next day my new card arrived in the mail!!

  11. nowhere · 909 days ago

    Simple, have a couple of savings accounts with the bulk of your balance held there and only what on the ATM, checking, online banking, debit card your willing to risk losing. Don't use overdraft protection or have the savings account on the ATM or online banking.

    Sure it will require once a month going to the bank and making a transfer, but the tellers need work and all electronic devices outside the banks control are vulnerable and they can't be held liable for those loses. if they occur.

    Been doing this for years and it's kept me sleeping soundly at night.

    To get my money, you would have to get facial surgery.

  12. SteveHC · 907 days ago

    There is *no* question that forgoing the credit card company co-branded (and PIN-less) debit card in favor of separate credit and ATM cards (the latter of which *requires* the use of a PIN in order to draw funds from one's bank account) is indeed the best and safest way to matter WHAT one's personal circumstance. The "convenience" of having one card that does not require the use of a PIN for bank account withdrawals and/or electronic debits is absolutely NOT worth the risk of and inconvenience associated with monetary loss from fraud.

  13. PATRICK C. LISA · 846 days ago


    • Shane · 97 days ago

      I agree with you 100% Patrick, happened to me twice also. And every site I used was secured, from what I have heard, most of the times they get your card number from pay at the pump for gas.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

About the author

I've been writing about technology, careers, science and health since 1995. I rose to the lofty heights of Executive Editor for eWEEK, popped out with the 2008 crash, joined the freelancer economy, and am still writing for my beloved peeps at places like Sophos's Naked Security, CIO Mag, ComputerWorld, PC Mag, IT Expert Voice, Software Quality Connection, Time, and the US and British editions of HP's Input/Output. I respond to cash and spicy sites, so don't be shy.