Associated Press fileCLEVELAND, Ohio -- What if a bad guy could walk into a bank and take money out of your account without knowing your name or Social Security number or showing any identification? It happens every day, in a manner of speaking, with debit card fraud.
Debit card security breaches this month at two of the region's biggest local banks punctuate the point that debit cards are dangerous, experts say.
Debit card safety
- Get a debit card without a Visa or a MasterCard logo. That card can be used only with a PIN at an ATM or a point-of-sale machine.
- If you must have a logo debit card, have it on an account that is not your primary checking account.
- If you don't have or don't want a credit card and still need plastic, consider a prepaid debit card. But those come with fees.
- Regularly monitor every bank account and credit card you have, online if possible. But if you have a debit card on your primary account, monitor that one much more closely.
- Realize your account is vulnerable if you've been issued a debit card, even if you never use it.
- When debit card laws change this summer, make sure you don't agree in advance to allow transactions that put the account into the red.
-- Teresa Dixon Murray "You're not going to catch me dead using a debit card. The risks are too great," said Boston identity theft expert and consultant Robert Siciliano, chief executive officer of IDTheftSecurity.com
If the debit card bears a Visa or MasterCard logo, thieves can easily drain checking accounts by simply having the account's debit card number. They don't need the person's name or personal identification number or any other information.
The biggest problems with debit cards, Siciliano said, is that fraud involves money already in your account from paychecks or other deposits, and it may be money you need soon -- yet debit card protection isn't the same as it is for credit cards.
"We're functioning under a flawed system," said Siciliano, who is also a security consultant for Intelius Inc., an information commerce firm in Washington state.
In recent cases involving National City and Fifth Third Bank debit cards, the banks blamed third-party processing companies for security breaches.
"When your card number is swiped at a merchant or input into the computer when buying online, the information is transmitted to third parties that process that information," explained Fifth Third spokeswoman Laura Passerallo. "A criminal may have gained access to the card information through one of the entities involved with processing the transaction."
Consumers don't really think about third parties when they're dealing with their banks, said Jean Ann Fox, director of financial services for the Consumer Federation of America in Washington, D.C. They just expect that their banks will deal with reputable companies that are as trustworthy as the majority of banks are, she said.
Fox agreed that people who use debit cards are setting themselves up for big problems. With credit card fraud or errors, you don't have to pay any charges under dispute while they're being investigated. But with debit card fraud or billing errors, you're fighting to get your own money back -- money you might need immediately for rent or groceries.
Plus, Fox said, people with debit card problems have much less time to act and can lose more money.
According to the Federal Trade Commission, with credit cards, you have no liability for unauthorized transactions -- unless you've lost your card, in which case your maximum liability is $50. You have 60 days from the day the statement is mailed to report any problem and incur no liability.
With debit cards, if a problem isn't reported within two days of the time you discover it, you could lose up to $500. As with credit cards, after 60 days, the liability is potentially unlimited.
In the recent breach of security cases involving National City/PNC and Fifth Third, neither bank said how widespread the problem was.
Fifth Third said an undisclosed number of customers' debit card numbers were compromised and the accounts were accessed by thieves. The Cincinnati bank is issuing new debit cards.
National City/PNC discovered fraudulent charges on the accounts of "a small percentage of former National City customers" in Cincinnati, the bank said in a written statement.
National City/PNC spokeswoman Kelly Wagner Amen said the bank has been "working one-on-one with customers to refund accounts and has been returning funds within 24 hours."
Neither Fifth Third nor National City could offer advice to prevent a problem in the event that someone is hit by fraud that drains money intended to cover an automated car insurance payment or a check already written for a mortgage payment.
Both banks said they can work quickly to help customers after the fraud is detected by refunding money temporarily.
"The branch may provide provisional credit to cover the immediate need for cash, depending on the individual circumstances," Wagner Amen said.
That all sounds good, said Siciliano, the Boston consultant. But debit card fraud usually means one giant headache for the consumer.
Even if all of a person's money is restored and all nonsufficient-fund fees are refunded, "people lose time -- a lot of time -- and they spend a tremendous amount of life energy dealing with customer-service representatives who may be inept.
"The system is set up to function where everybody is conducting transactions above board," he said. "But the moment someone is dishonest, the system isn't set up to deal with that efficiently."
Consumers have an easier time being made whole when there are broad security breaches. In individual cases, they have to prove the fraud.
Consumers will get a little bit of protection this summer when new federal rules kick in. The rules prevent debit card overdrafts, unless a consumer chooses to pay NSF fees for one-time debits. But a thief could still drain the account.
Experts recommend having an ATM card that works only with a personal identification number, or PIN. Since those cards don't bear a MasterCard or a Visa logo, transactions can't be processed without both the actual card and the PIN.
Virtually every major bank offers ATM-only cards for people who ask, although some banks charge for them. KeyCorp and FirstMerit Corp. both charge $1 a month. National City/PNC has a one-time $10 fee "because it's a rare exception within our customer base, the majority of whom prefer the combined debit/ATM card option," Wagner Amen said.
Other banks, however, offer ATM-only cards at no charge. Huntington National Bank and U.S. Bank are among those with no fees.
