Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[porthole]

This is a bit long winded, but it may save you some real grief.

Debit cards, credit cards and the Target hack

Do you know the difference? Have you been following the Target scandal?

Do you know your rights?

Do you really know what “Zero liability” means?


A Sunday in May 2013 I saw unrecognized charges on my checking account when looking online.
Went to the bank Monday morning, we saw a few things that were not valid. The debit cards were canceled immediately and the bank fraud procedures started. The 3 transactions were for $920.

My bank, Wells Fargo, has unwritten thresholds, under $1000 and under $2500.
Since this was a low fraud alert, the transactions were allowed to post to my account, and a provisional credit was issued immediately for the $920. A letter a few days later stating the facts and that it was under investigation and a letter 8-10 days later closing the case as resolved.
I was out zero $$$ and just one trip to my local branch.

In August my wife had an issue with a check at the local A&P for groceries. Same A&P we have been using with the same bank account since 1998. She had to keep getting her checks approved at the courtesy window. Since we were in “travel mode” at the time and not around much, it was not until the end of October we found out why.

A&P recently switched to an instant check reading system (those numbers on the bottom of your check are printed with magnetic ink, so they can be read like a credit-debit card). The company that processed the checks was denying the transactions, which took 2 trips back to A&P to find out that the transactions were not going through because our account was “blocked”.

Back to my bank. Turns out in August there was an “attempted account takeover” of our checking  account, probably related to the debit card fraud back in May.

My bank, in my best interest decided to block my account, of course they forget to notify us!

And it was only blocked for checks that were being processed through 3rd party systems like Telecheck. Not for debit cards, personal checks, online debit or direct checking account withdrawals or payments etc.

At the banks recommendation we closed all our accounts and opened new accounts. What a royal pain in the butt. Direct deposits, mortgages, automatic payments, automatic withdrawals, online bill paying  new checks, debit and credit cards. The bank moved all of our checking account money to the new account, blocked the old account completely and did not leave in the amount needed for the bill pays),
9 trips to the bank to get all that straightened out.

January 9th at 4:30pm I get an automated call from Wells Fargo fraud department. At 5:00pm I call back and find out that there are some “questionable” charges on my debit card. After a 20 minute conversation we cancel my debit card again and determine that there are $4900 in fraud charges against my debit card that took place from 4:09pm to 4:29pm, both stateside and in Europe.

At this time none of the transactions have posted, all are pending. The bank’s automated system automatically moves $3800 from an equity account to cover the pending transactions (2 transactions at a fee of $12.50 each). Everything from a $1.00 test charge in Brooklyn to pizza at a Dominos in Southern California, $1900 at an Apple store, cross country train ticket in Germany multiple online games (wargames and minecraft) in Cypress and Sweden, Best Buy etc etc. Every international charge has an international charge transaction fee.

Debit or credit here is where there is a real difference.

With the debit card the bank does nothing until the charges post to your account.
So I effectively have the $4800 showing out of my account.
Within a day about $2000 is effectively blocked and removed from my online view.
Another week and the bank gives me a “provisional credit” of $1500, couple more transactions get reversal, another day another provisional credit of $500.

Since there was now an extra $2000 in the account the bank decides, without my authorization, to reverse the two overdraft transfers that were made. That could have been a real issue with all my bill paying (through the banks website) had I not caught it.
As of today, January 25, most of the fraud has either, not posted, posted and reversed or provisional credits issued waiting for an outcome.

Because a dozen or so of the transactions were international there are exchange rate differences. Apparently the value of our dollar has dropped enough in the past week that in the international reversals I am now short about $26

A police report was filed, although I seriously doubt anything will come of that.

Continued

[porthole]

Part 2

So I would suggest that if you have online access to your accounts you check them frequently. Set up alerts that get texted to your phone.
I never had alerts turned on. I now get an alert almost immediately when the cards are used with varying thresholds. I get a text message at gas stations before the attendant sticks the nozzle in the truck now.

Check your limits on the cards. My debit card had a $10,000 daily limit assigned to it.

If you are subject to this kind of fraud, I would suggest you check online multiple times per day during the investigation. I have seen credits and debits pop up and disappear the same day. My online statement was literally changing every couple of hours.
Debit card rules are not the same as credit card rules.
Your credit cards come under federal regulations that are very strict. If you report a theft promptly, the disputed amount is not posted on your account until it is settled. With credit cards, you are limited to a max of $50 for fraud reported promptly. Prompt in this case is up to 60 days from receiving your statement.

With Debit cards you could be liable for up to $500 of the charges if reported promptly and in this case prompt could mean as little as 2 days from the transaction.

Another FYI, Visa and MasterCard have different ways of handing fraud. For the consumer, Visa is a better option. With MC it is incumbent on you to contact the retailer-vendor.

The biggest difference is your funds. Most banks will not start the fraud investigation until after the transactions post to your account. This means you are out the funds until settled or a provisional credit is issued. Credit cards you don’t have anything removed until you actually pay your bill.

Do your own research. Debit cards are bad news for consumers and ripe for fraud. In the end banks lose little. The consumer and the vendors are the losers. The banks get to keep that disputed money for the ten days the claims are investigated.

I have used debit cards since they first came out, use them for everything. I like not having to carry cash (always a pain since the start of direct deposit). I also like that the money for my transactions comes out right away from our bank account, no surprises when the statement comes in.

Did you know that the average consumer spends at least 30 hours of time rectifying debit card fraud? I’m already past that number.

The most common place for debit card fraud is restaurants and gas stations. Here in New Jersey we can’t pump our own gas, so every station is attended. Stations without attendants are frequently hit with card scanners, cameras etc. Wells Fargo requires branch managers to physically check the ATM machines at least once per day for tampering.

The new way for debit and credit card fraud is random computer number generators. CC numbers generated using the 16 numbers on the front, the 3 digit CCV code on the back and zip codes. Then, potential numbers are zipped around the net trying online point of sales until a transaction goes through. In my case the $1.00 charge in Brooklyn was the first charge. Keep in mind; the first 6 numbers on your credit only identify the issuing bank. So, number generators have a head start.

I thought the idea of random number generators was a bit far fetched. We have 16 numbers on the front, 3 on the back and the 5 digit zip. But I have since learned during some “password security” searches that there are programs currently available that can search random passwords at the rate of 300,000 times a minute.

[porthole]

The Target debacle.

No doubt you are all aware of the Target fraud. Estimates put it up over 100 million ID’s now.

Did you know that anyone can go online and buy stolen credit card information? All you need to do is set up an account and fund it. BTW, you cannot fund it with credit cards or checks.

And, the numbers are searchable. No reason to buy a card from a South Dakota bank when you live in New Jersey. No, just search for a local bank you like with the “BIN”, Bank Identification Number, which are the first 6 digits on your card.
Example, Citibank Mastercards start with 4147 09

All of Target’s hacked information is searchable with the code name Tortuga (Tortuga, Tortuga 2, Tortuga 3 etc).

This screen shot is from an account Krebs Security set up while researching the breach.
This web site even guarantees the numbers you buy will be valid. If not, you automatically get a new number to use.

BTW, I have never even been in a Target or Neiman Marcus.

[smkymtnboy]

This is a bit long winded, but it may save you some real grief.

Debit cards, credit cards and the Target hack

Do you know the difference? Have you been following the Target scandal?

Do you know your rights?

Do you really know what “Zero liability” means?
cash is sounding better and better

A Sunday in May 2013 I saw unrecognized charges on my checking account when looking online.
Went to the bank Monday morning, we saw a few things that were not valid. The debit cards were canceled immediately and the bank fraud procedures started. The 3 transactions were for $920.

My bank, Wells Fargo, has unwritten thresholds, under $1000 and under $2500.
Since this was a low fraud alert, the transactions were allowed to post to my account, and a provisional credit was issued immediately for the $920. A letter a few days later stating the facts and that it was under investigation and a letter 8-10 days later closing the case as resolved.
I was out zero $$$ and just one trip to my local branch.

In August my wife had an issue with a check at the local A&P for groceries. Same A&P we have been using with the same bank account since 1998. She had to keep getting her checks approved at the courtesy window. Since we were in “travel mode” at the time and not around much, it was not until the end of October we found out why.

A&P recently switched to an instant check reading system (those numbers on the bottom of your check are printed with magnetic ink, so they can be read like a credit-debit card). The company that processed the checks was denying the transactions, which took 2 trips back to A&P to find out that the transactions were not going through because our account was “blocked”.

Back to my bank. Turns out in August there was an “attempted account takeover” of our checking  account, probably related to the debit card fraud back in May.

My bank, in my best interest decided to block my account, of course they forget to notify us!

And it was only blocked for checks that were being processed through 3rd party systems like Telecheck. Not for debit cards, personal checks, online debit or direct checking account withdrawals or payments etc.

At the banks recommendation we closed all our accounts and opened new accounts. What a royal pain in the butt. Direct deposits, mortgages, automatic payments, automatic withdrawals, online bill paying  new checks, debit and credit cards. The bank moved all of our checking account money to the new account, blocked the old account completely and did not leave in the amount needed for the bill pays),
9 trips to the bank to get all that straightened out.

January 9th at 4:30pm I get an automated call from Wells Fargo fraud department. At 5:00pm I call back and find out that there are some “questionable” charges on my debit card. After a 20 minute conversation we cancel my debit card again and determine that there are $4900 in fraud charges against my debit card that took place from 4:09pm to 4:29pm, both stateside and in Europe.

At this time none of the transactions have posted, all are pending. The bank’s automated system automatically moves $3800 from an equity account to cover the pending transactions (2 transactions at a fee of $12.50 each). Everything from a $1.00 test charge in Brooklyn to pizza at a Dominos in Southern California, $1900 at an Apple store, cross country train ticket in Germany multiple online games (wargames and minecraft) in Cypress and Sweden, Best Buy etc etc. Every international charge has an international charge transaction fee.

Debit or credit here is where there is a real difference.

With the debit card the bank does nothing until the charges post to your account.
So I effectively have the $4800 showing out of my account.
Within a day about $2000 is effectively blocked and removed from my online view.
Another week and the bank gives me a “provisional credit” of $1500, couple more transactions get reversal, another day another provisional credit of $500.

Since there was now an extra $2000 in the account the bank decides, without my authorization, to reverse the two overdraft transfers that were made. That could have been a real issue with all my bill paying (through the banks website) had I not caught it.
As of today, January 25, most of the fraud has either, not posted, posted and reversed or provisional credits issued waiting for an outcome.

Because a dozen or so of the transactions were international there are exchange rate differences. Apparently the value of our dollar has dropped enough in the past week that in the international reversals I am now short about $26

A police report was filed, although I seriously doubt anything will come of that.

Continued

[OBB]

Damn. So after all you've been through since last year. What are you doing to avoid any possible repeat issues? My wife always uses her debit card as a charge card to avoid using the PIN. Now I'm not so sure if it's safer to use the debit card as a debit or is it safer to use as a charge card.
I know my credit union has a $500 a day limit on charges and if I need to use it for anything more than that I have to call them first.
 I know on a few of my cards I have a $50 alert set so I get an email once a transaction hits over that amount.

[porthole]

Damn. So after all you've been through since last year. What are you doing to avoid any possible repeat issues? My wife always uses her debit card as a charge card to avoid using the PIN. Now I'm not so sure if it's safer to use the debit card as a debit or is it safer to use as a charge card.
I know my credit union has a $500 a day limit on charges and if I need to use it for anything more than that I have to call them first.
 I know on a few of my cards I have a $50 alert set so I get an email once a transaction hits over that amount.

We no longer use a debit card. I carry it only to get cash at a bank ATM.
A debit card is a debit card, whether you sign or use the PIN, no matter what the clerk says when they ask you "credit or debit". The problem arises with fraud.

You should verify the limit with your credit union. With Wells Fargo, that daily limit is on POS sales, "point of sale", you are at the register. There is no limit with online or phone transactions.

As to your alert messages, keep in mind with the fraud transactions on my account, the rate the transactions were posting prevented any "fast" notification.
25 of the transactions that hit my account were under $50.

[OBB]

We no longer use a debit card. I carry it only to get cash at a bank ATM.
A debit card is a debit card, whether you sign or use the PIN, no matter what the clerk says when they ask you "credit or debit". The problem arises with fraud.

You should verify the limit with your credit union. With Wells Fargo, that daily limit is on POS sales, "point of sale", you are at the register. There is no limit with online or phone transactions.

As to your alert messages, keep in mind with the fraud transactions on my account, the rate the transactions were posting prevented any "fast" notification.
25 of the transactions that hit my account were under $50.

The online transaction from my CU is also the same $500. I tried to use it before for over that amount. Guess I'll just start using my Visa for everything and make one big payment to them every month. Time to look into one of the banks that offer the HD Chrome points and make good use of it.

[Chief2505]

My bank allows me to set the cash daily limit and the daily purchase limit. I cannot get more than $100 out of an atm in any 24 hour period nor can I spend more than $300 a day no matter if it is used as a debit or credit. These are the limits I gave the card when I got them.


I do know though that the standard limits when they issue a card are $10,000 a day total.

[skratch]

Time to look into one of the banks that offer the HD Chrome points and make good use of it.

there is only 1.  us bank.  to apply for it, you have to go through the hd website.  there are 2 versions of it.  you want the signature card.  it gives you 1 point for every dollar spent.  2 points for every dollar at gas stations and restaurants, and 3 dollars for every dollar at a hd dealership.  2500 points equals $25.  the interest rate is a little higher, but if you pay it off every month, that's no worry.  i've never paid a dime in interest in over 3 years. 

i like my hd card.  it allowed me to save over $750 dollars on the tourpak for my bike.  after selling my old one, and using chrome cash, i was out of pocket about $50 for this one.

and they continually monitor for fraud as well.  i've gotten a couple of phone calls when using my card.  first time was at an arts festival where a bunch of artists from across the country gathered to sell their wares.  us bank wanted to know if there was a problem since the vendors all use different banks from all over the country.  the second time was when traveling from la to dc.  because of the charges from different states, they thought my card may have been compromised.  since then, i've called them before i left on a trip, or i make a bunch of purchases from festivals so that they are not unexpected for them.

[LovemyCVOgirl]

Thank you Duane for the info.  I totally agree with everything you have written.  If I use my debit card I always use it like a credit card.  Never, ever use it as a debit entering a PIN number.  Putting in a PIN number gives hackers access to your checking account and they can wipe you out!  And as you stated, you don't get the protection from a debit card that you get from a credit card because of federal regulations.  I use my bank debit card primarily to withdraw cash only.

[Pete7539]

Duane, not sure if you have, but go onto ftc.gov and file id theft report. It does help with the grand scheme. When completed drop a copy to your local precinct for their case file. They forward it to computer crimes.

[Skillet]

Good info. Thanks for posting.

[porthole]

My bank allows me to set the cash daily limit and the daily purchase limit. I cannot get more than $100 out of an atm in any 24 hour period nor can I spend more than $300 a day no matter if it is used as a debit or credit. These are the limits I gave the card when I got them.


I do know though that the standard limits when they issue a card are $10,000 a day total.

You should check those limits with your bank.

The daily Wells Fargo limit on a debit is POS only  - Point of sale. No limit other then your bank account for online transactions.

[porthole]

Duane, not sure if you have, but go onto ftc.gov and file id theft report. It does help with the grand scheme. When completed drop a copy to your local precinct for their case file. They forward it to computer crimes.

Learned something else today with Wells Fargo fraud investigations. They are only concerned with ONE aspect - Wells Fargo.

All of the fraud that was reversed? it is up to the vendor to pursue

[WFP]

Duane,

For years I have been saying that Debit Cards are a bad deal for us.

I only use the ATM card every two weeks to take out Cash or anytime we deposit Checks or other random banking needs.  It takes discipline, but I take out enough cash to last the two weeks  (any leftover goes to the Chrome fund )

We never have used our ATM cards as Debit Cards and have reduced them to zero for that purpose.

We only use Credit Cards for purchases and never carry a balance, paying off each month (they consider us dead beats since we never give them interest ).  I track pretty much daily (or several times a day).

I have alerts (text and email) set up at the $10 threshold, yes, $10 is the lowest they would let me go otherwise it would be ALL.  

Some have accused me of stalking Anne .  I have been seen standing outside the store at the Outlets and Anne tells the clerk to watch me after she swipes the card (at the Coach store for example).  I was caught just shaking my head when the alert text came in.  But it has saved our bacon on more than one trip.  

Twice AMEX  (no fee recolving credit version) has had to send us a new Card on a trip, UPSing it to a Hotel.  I believe one time it was "stolen" when we were at Citizen's Bank Park in Philly (Rain out so we were at McFadden's).  The nice thing is that Anne and I have different numbers on our AMEX cards so only one of the cards from the same account is affected giving us better options.  Our Visa cards are the same number but Anne uses that mostly for work travel to keep the charges separate for expense account tracking.

Unfortunately, this is going to get worse before it gets better if it ever gets better.

Eventually, my methods may not be enough and new methods will be required.

Bill