ATM/Debit Cards: What consumers need to know about greater fraud risk, card blocking, and debit card fees.

  1. Debit card liability could cost you a lot -- while credit card liability only $50, by law.
  2. Debit cards used with signatures make banks a lot of money.
  3. Debit card blocking a problem.

SUMMARY: A debit card is an ATM card with a VISA or Mastercard logo on it. [VISA calls them "Checkcards" and Mastercard calls them "Mastermoney" cards.]

The difference? Debit cards are riskier than password protected (PIN-only) old-fashioned ATM cards because debit card can be used with a PIN OR can also be used with only a signature, without a secret PIN or password, just like a credit card, over the phone or in a store.

Debit Cards: Much greater liability risk than credit cards:

-- Legally, your ultimate liability for fraudulent use of a credit card is generally only $50. And, when a credit card is fraudulently used, you are also only disputing whether you owe the bank money.

-- Unlike a credit card, if your debit card is used fraudulently, the thief robs your checking account. Potentially, all your money is drained out of your checking account. It could take the bank 10 days or more to investigate and refund your money. In the meantime--you could bounce checks to your landlord, credit card company, or mortgage company.

-- Worse, unlike a credit card, under the law, your debit card liability could be as much as $500, if you notify the bank more than 48 hours after you learn of the problem or even up to all the money in your checking account plus your maximum overdraft line of credit if you fail to notify the bank within 60 days (See Fed excerpt below). Under pressure from the state PIRGs, banks claim to have voluntarily limited debit card liability to $50. PIRG has received complaints from consumers whose banks have not honored the well-publicized alleged voluntary $50 limit. Let us know (uspirg@pirg.org) if you have lost more than $50 in a debit card dispute with a bank, savings and loan or credit union.

Even the Federal Reserve recognizes the difference in liability rules. The following is excerpted from the Fed's website-- the Fed calls debit cards EFT or (Electronic Fund Transfer) cards:

What about Loss or Theft? It’s important to be aware of the potential risk in using an EFT card, which differs from the risk on a credit card.

On lost or stolen credit cards, your loss is limited to $50 per card (see Lost or Stolen Credit Cards). On an EFT card, your liability for an unauthorized withdrawal can vary: Your loss is limited to $50 if you notify the financial institution within two business days after learning of loss or theft of your card or code.

But you could lose as much as $500 if you do not tell the card issuer within two business days after learning of loss or theft.

If you do not report an unauthorized transfer that appears on your statement within 60 days after the statement is mailed to you, you risk unlimited loss on transfers made after the 60-day period. That means you could lose all the money in your account plus your maximum overdraft line of credit, if any. (end of Fed excerpt.)

Even worse, you are fighting to recover your own money back into your own checking account. It is true that some banks may eventually honor the voluntary $50 limit, but consumers face horrific problems because while the bank is conducting its internal investigation, consumers are dealing with other checks that may bounce, and consumers face enormous hassles explaining what happened to the bounced checks they wrote to their other creditors, since the fraudster drained their account. In 2001, the chief national bank regulator, the Office of the Comptroller of the Currency, which regulates all banks with national in their name, warned banks that the burden of proof in a reinvestigation is on the bank to show that a transaction was authorized (in other words, the bank isn't supposed to presume the consumer is guilty, but innoncent, when the consumer claims fraud). Excerpt:

...The OCC is concerned that some banks may be rejecting claims of unauthorized transactions solely because the customer's Automated Teller Machine (ATM) card or debit card and personal identification number (PIN) were used in the transaction, and the customer supplied no information indicating that the card or PIN was misappropriated. These facts alone may be insufficient to establish that a transaction was authorized because fraudulent means may have been used to obtain the customer's account number, card, or PIN. For instance, the customer may have been a victim of "shoulder surfing," a practice used by criminals to obtain account or card numbers or PINs by observing customer transactions. Therefore, banks cannot assume that they have satisfied their duty to investigate simply by concluding that the customer's debit card and PIN were used in the transaction at issue.... OCC, 7 Sept 2001

Always send copies of your complaint letters to your bank to the OCC. You can reach one of the Office of the Comptroller of the Currency's customer assistance specialists by: Telephoning 1-800-613-6743, toll-free (Monday-Thursday 9:00a.m. to 4:00p.m.CST) E-mailing - E-mail to Customer.Assistance@occ.treas.gov;
Fax - Faxing to - 1-713-336-4301 or; Sending mail to -
Customer Assistance Group
1301 McKinney Street
Suite 3710
Houston, TX 77010

-- Debit cards may offer some convenience. But debit cards have more risks than PIN-based ATM cards. Since the risk of credit card fraud on the Internet is so high, we urge consumers to ONLY use credit cards on the Internet-- never use debit cards. In addition to this greater legal liability protection with a credit card, you have greater legal protection if goods are defective or don't arrive, under the Fair Credit Billing Act, which applies to credit cards.

-- Debit cards make banks a lot of money. When you use the card like a credit card (with a signature, but not with a PIN), banks take a hefty fee from the merchant. When you use it with a PIN, like an ATM card, more and more banks are charging you a transaction fee (called a POS fee) of $0.25-$1. Other banks are charging a monthly card rental fee (even if you do not use it at all) of $1-2/month. That adds up to $12-24/year, plus transaction fees. Of course, banks are hitting you with a POs fee in hopes you use the card with a signature-- so they can make more money from the merchant.

-- "Blocking" is also a problem with debit cards. Some firms (hotels, gas stations and rent-a-car companies) routinely block a card in advance for the estimated cost of a transaction that may not be completed for several days. It isn't a problem for most credit card customers, unless they are near their account limits. But if you buy ten dollars worth of gas with your debit card, you may not know that the station may routinely block all transactions for $50-75, then doesn't "un-block" as you drive away -- it waits until that evening, or worse, every few days to conduct a "batch" transaction. If you are close to your checking account limit -- much more common than being close to a credit card limit -- you could end up bouncing checks or be refused transactions by other merchants due to faulty blocks. Most banks do a poor job of informing consumers that they may bounce transactions due to overdrafts created by blocks. Of course, virtually no gas station explains their blocking policy, which presumes everyone drives an RV or tractor trailer truck, and is filling it up.

-- Finally, most banks don't ask for consumer consent. When ATM cards expire, they replace them with risky debit cards. And, we are unaware of any bank that adequately explains the risks of debit cards.


(1) If you don't want a debit card, demand a plain old ATM card.

(2) If you do want the convenience of a debit card, lower the risks:

-- Never use a risky debit card on the Internet. Only use a credit card for Internet transactions. In addition to greater legal liability protection with a credit card, you have greater legal protection if goods are defective or don't arrive.

-- Use a debit card only with merchants you trust. It is also a good idea never to let it leave your sight-- it's one thing to watch a clerk "swipe" it right in front of you at the cash register and hand it back to you. It's another story when you hand it off to a potentially unscrupulous waiter or waitress who could have an illegal card "skimmer" (the size of a pack of cards) in their pocket and copy your information after they walk away with it.

-- Just as you wouldn't use it on the Internet, don't use it to call info-mercial 800#s off the television. If you have a dispute over double-billing or products that don't arrive from a sleazy info-merchant, remember-- you'll be fighting to get your own money back, and that could take ten days or more of arguing with your bank.

(3) Complain to Congress! Urge Congress to enact legislation to change the Electronic Funds Transfer Act law so that debit card liability is legally the same as credit card liability. Not surprisingly, the banks oppose it. No matter what card you use, you should be equally protected.

(4) Send comments of any complaints about unfair treatment by your bank of your debit card dispute to uspirg@pirg.org.