U.S. PIRG Consumer Blog: Another warning: Don't use debit cards

Then, however, she goes on to point out one of the several reasons to avoid debit cards. Unfortunately, due to bank propaganda about zero liability, most people are not aware that debit cards put you at risk of losing all the money from your checking account:

From the Post:

I also learned that if someone fraudulently uses your credit card, you are reimbursed for nearly all the money lost. That may not be so with a debit card, especially if you do not notice it right away. According to the Electronic Fund Transfer Act, your liability is capped at $50 if you notify your bank in the first two business days. After that, you could lose up to $500. If you wait 60 days, you could lose it all.

Let me say it a different way:

Under the federal Truth In Lending Act, your liability for fraudulent use of your credit card is capped at $50 by law. Plus, it is the bank's money and they have an incentive to go after the bad guy.

But, debit cards are regulated under a different, less consumer-friendly law known as the Electronic Fund Transfer Act. You could lose all of your money in your account, or even more, under some circumstances. Your money? Yes, when a thief takes your own money from your debit card, it is vacuumed out of your accounts. You must fight with the bank to get it back. The bank has less incentive when it is your money, too. Legally, the bank can investigate for up to ten ten days before provisionally re-crediting your losses-- leaving your checking account high and dry in the meantime. Its investigation can then continue for a much longer period and it can take the provisional funds back if it ends up claiming you were responsible.

[But Ed, aren't you forgetting about the zero liability promises banks make?] No, actually, I am not forgetting about the promises that the banks and Visa and Mastercard make, but those are only promises, not the law. Read your account contract and check the fine print. These promises don't apply in all circumstances. These promises are only promises, not the law.

Here is a PIRG fact sheet explaining the risks of debit cards and here's another fact sheet from the Fed, which uses its own clunky term, EFT card, for debit card.

In this case, Trejos learned of the fraud when her bank called her. Since the bank's fraud surveillance software determined that she was a victim, she probably had an easier re-investigation than the average consumer does. But I hear all the time from consumers who don't get their money back for a long time, if at all, and are treated as if presumed guilty during the investigation.

At the beginning of this blog I said there are several reasons not to use a debit card:

Your liability risk is greater than with a credit card (see above).

Since debit cards, unlike plain old ATM cards, can be used without a PIN #, a thief who merely has your card number can access your accounts.

It's your own money you've lost and that could cause ripple effects in your finances (checks bouncing, etc.) during the bank investigation.

The Truth In Lending Act gives you other Fair Credit Billing Act rights when you use a credit card that the EFTA does not when you use a debit card, including a right in many circumstances to refuse payment for goods or services that don't arrive or don't work as promised, and to force the bank to take up your claim with the merchant on your behalf. These are just some of your billing error rights with a credit card.

Since debit cards are routinely used in offline transactions for small amounts, and the banks routinely approve transactions against negative balances, your risk of overdraft fees is very high, and you could end up with a $35 latte. Here's an MS-NBC Red Tape Chronicles entry on the Center for Responsible Lending's recent Debit Card Danger report.

Another big source of fees and hassles is debit card blocking. Off-line or non-PIN transactions (when you select "credit" or sign for a debit transaction it is off-line) at some merchants, especially gas stations, sometimes result in a hold or block on your funds that could be much greater than your actual transaction ($100 on a gas pump purchase) and last for several days. Some banks will bounce other checks or debits against the missing blocked funds.

Here's a consumer strategy:

Don't use debit cards.

Go to your bank or credit union and ask for a "plain old ATM card" that can only be used with a PIN (this card will not have a Visa or Mastercard logo).

If you must use debit cards, take care. (Tip #1) Keep a debit card that accesses only a small checking account that is not linked to and cannot access any of your other funds. Keep it in a different bank than your bank (The Trejos article also points this out.)

If you must use debit cards, take care. (Tip #2) Don't hand your debit card over in a restaurant or other business. Only use it in situations where you swipe. Else, someone who walks away to the machine could run it twice (once through an illegitimate skimmer device in their pocket) or simply copy the three digit security code off the back (banks increasingly are blaming consumers for fraud when the three digit code is used, conveniently forgetting that any bad guy in a good store can look at the back of your card. Banks are also routinely claiming that any time a PIN is used in a fraud, it is the consumer's fault, despite all the ways that PINs can be stolen.)

If you must use debit cards, take care. (Tip #3) Never ever use your debit card on the Internet. Too many bad guys in that space. Even if you were only using it with good guy stores, if you end up with your debit card number stored in your cookies file or elsewhere on your computer, you're vulnerable to bad guys.

If you must use debit cards, take care. (Tip #4) Monitor your bank account balance frequently.

And whether you use credit or debit cards, if you get a call or an email asking for non-public personal information from someone claiming to be from your bank, don't give up the information. If it is a phone call, call back on the number you have written on your card. If it is an email, again, call the number on your card, never click through to any link.

A fairly common scam is for a bad guy who has part of your information to pretend to be from your bank's security department to get the rest. He or she calls:

"Mr. Mierzwinski, don't be alarmed, I am from the bank. To verify who I am I will read you part of your account number. We won't read all of it because that will compromise it. After I read you part of it, we need you to give us your PIN number to verify that you, in fact, are Mr. Mierzwinski. Then we will tell you why we are calling."

Even if you were born at night, I hope it wasn't last night! Watch out for these social engineering scams. As police officer Garnell Stewart points out in the Post story, "you just never know:"

He asked: How did I know she was really calling from the bank? The next time, he said, ask the person if you can call him or her back and call the phone number on the back of your card. "You just never know," he said.

It strikes me as odd that the bank asked for even part of an SSN. It should have asked a security question, such as "What was your dog's name when you were a kid?" Consumer groups, including U.S. PIRG, have been trying for over ten years (since the national rollout of debit cards) to get Congress to pay attention and increase consumer rights when they use debit and other EFT or stored value cards. All plastic should have the rights granted credit card users under the Truth In Lending Act.