Before you whip out your debit card, consider this: if some crafty thief hacks the store terminal and goes on a shopping spree using your data, you could be held responsible for $500 in charges.
That’s because debit cards do not share the same consumer protections as credit cards. This week’s series of data security hearings on Capitol Hill, an outgrowth of the recent rash of retail data breaches, highlighted the unequal treatment.
Not all of the 40 million Target customers who had their debit and credit card numbers stolen during the holidays can rest easy about their liability for fraudulent charges, Ed Mierzwinski of the U.S. Public Interest Research Group pointed out to lawmakers.
“The zero liability promise the banks make is just a promise, it’s not the law,” he told the Senate Banking Committee. “All plastic should be equal.”
But it’s not. And here is why.
Credit cards are covered by the Truth in Lending Act, which places the maximum liability for fraudulent charges at $50. The law also offers dispute protection and fair credit billing that allows you to stop payment on purchases.
And debit cards? The plastic tied to your bank account is governed by a completely different law known as the Electronic Funds Transfer Act, with varying degrees of liability protection.
You are not liable for any charges, if you report the loss or theft of your debit card to your bank immediately and the card has not been used. If you notify the bank within two business days, you are liable for up to $50. On day three, your liability jumps to $500. If 60 days pass and you say nothing, well kiss all that money goodbye.
“After two months if you haven’t notified the bank, you’re liable for all the money that’s taken, even if they take it from other accounts that might be linked to your debit card, like a savings account,” Mierzwinski explained.
Your bank must extend the notification period if you can prove that “extenuating circumstances” (think: hospitalization) prevented you from reporting the theft in time.
U.S. PIRG has urged the Consumer Financial Protection Bureau to remedy the disparities by writing a rule that gives debit cards the same safeguards as credit cards. But Mierzwinski said it’s unclear whether that power lies with the agency.
Officials at the CFPB declined to comment on what actions the bureau could take. Late last month, the agency issued an advisory on what steps consumers should make in the event of a breach.
Mierzwinski said consumers should also consider that hackers have access to cash when debit cards are compromised. Criminals can clear out your account, while your bank takes up to two weeks to investigate the fraud and reimburse you the money. By that time, your rent or mortgage check could bounce.
Protecting your finances does require some vigilance—checking your statements, alerting your bank to suspicious activity.
Target has said that it has received very few complaints of fraudulent charges from customers, but it could take months for such activity to materialize.
The company, in consolation to its customers, is offering a year of free credit monitoring and identity theft protection. It also assured its customers that they will have “zero liability” for the cost of any fraudulent charges arising from the breach. But all that amounts to is a promise for debit card holders in the absence of stronger protection laws.