How to protect yourself from debit-card fraud

How’s this for a phone call you don’t want on a Sunday night: Visa’s fraud unit, calling to ask whether you’re aware that $1,371 has been wired from your bank account via Western Union.

Lisa Rokusek was definitely not aware of this transaction, since she hadn’t initiated it.

As it turns out, Rokusek, a US woman from St. Louis, Missouri, should have been wary of that phone call, too, if the caller did in fact claim to be from Visa’s fraud unit, as originally reported in the St. Louis Post-Dispatch.

As a Visa representative told me (and at least one reader pointed out) after this story first ran, Visa’s fraud unit doesn’t call consumers when they detect suspicious patterns in such cases. Instead, they call the card’s issuing bank, which has the consumer’s contact information.

This is an important note, because scammers try to phish information by claiming that a call is coming from Visa’s fraud department, Visa told me.

Given that the funds were wired from her account, the Visa representative pointed out, Rokusek was likely the victim of wire fraud. Could somebody have pulled a fast one with her debit card? Or did somebody get her account information solely through phishing?

We don’t know at this point. At any rate, however the money came out, it got out, and it made Rokusek one of many victims of credit card or debit card fraud last month.

As the St. Louis Post-Dispatch’s Jim Gallagher notes, a report from ACI Payment Systems released in October found that 42 percent of US survey respondents have been victimized by credit, debit or pre-paid card fraud over the prior five years.

It’s bad outside the US, as well, with one in four survey respondents across 17 countries reporting such victimization.

When it comes to this type of fraud, there’s a big difference between credit cards and debit cards.

When users spot fraudulent charges on their credit card bill, they can simply decline the charges and not pay the bill.

Debit cards, in contrast, draw money directly from your checking account, with no intermediary credit card company acting as a buffer.

That can mean a world of hurt to those whose debit cards are compromised.

Bankrate.com cites the case of the T J Maxx data theft, which resulted in $150 million in fraud losses – much of it clawed directly out of customers’ bank accounts.

Frank Abagnale, a secure-document consultant, told Bankrate that credit card users in that breach got their accounts straightened out, with new cards in the mail, within a few days.

Debit card holders, on the other hand, waited an average of two to three months to get the swindled money reimbursed.

That’s a lot of time to live with a bank account that’s been popped like a balloon.

So how can consumers protect themselves from debit card fraud?

Some safeguards, from the St. Louis Dispatch and other sources:

1. Don’t fall for phishing emails -: Phishing email tries to trick victims into thinking that it comes from retailers, banks, or the US Internal Revenue Service (or whichever tax organization pertains to a given country), for example.

In fact, brazen phishers recently even used the US Federal Trade Commission (FTC) as a cloak. The FTC in January issued a warning to businesses about a phishing attack that was targeting small and medium-sized companies with bogus complaint files that purportedly originated from the FTC.

Once you click on a phishing email, you’re typically taken to a phony website that lures victims into giving up their card or bank account numbers. Presto – the thieves are in.

2. Pay attention to bank and credit card statements -: Speed is of the essence when it comes to reporting debit theft. If you report fraud within two days of receiving your statement, your liability is limited to $50.

If you wait up to 60 days, that liability goes up to $500. You can lose everything – your entire account balance – if you wait longer than 60 days.

In that time, you’ll run the risk of bouncing important checks, such as those used to pay the rent, your mortgage, or your credit card bill.

Compare that with credit card liability: If you lose your credit card, your loss is limited to $50, although most credit card issuers won’t charge you anything at all. If the card number is stolen, as opposed to the card itself, the FTC says you’re not liable for anything.

You can find more information on liability for the US here and the UK here. People from other countries should check with their local financial authority for liability information.

3. Don’t let your debit card out of your sight -: That’s the advice Denise K DeRousse, senior vice president for retail banking at Pulaski Bank, gave to the St. Louis Post-Dispatch’s Jim Gallagher.

Pay attention when clerks swipe your card. Also, take care when handing over your card if you want helpers to pick up groceries. They’ll have your name, your security code and the card number: all they need, in other words, to vacuum out your account.

4. Ditch the debit/credit card -: Detective Michael Hodge, who was assigned to Lisa Rokusek’s fraud case, told Gallagher that he recommends using a simple ATM card along with a separate credit card, rather than the combined debit/credit cards that are now so popular.

That’s constitutes a tradeoff, unfortunately, given that many banks are now requiring a minimum number of debit-card-used-as-a-credit-card purchases in order for account holders to qualify for high-performance bank accounts, which pay slightly less anemic rates than otherwise.

Good luck in choosing which is less painful in that scenario. I’m mulling it myself.

Articles by Lisa Vaas from Nakes Security.