JUST LAST MONTH, 1,000 Stop & Shop customers had their credit and debit card information stolen after thieves replaced store card-reading devices with ones that captured account data. It's the latest incident in a string of high-profile credit- and debit-card data breaches that have affected companies as varied as T.J. Maxx and Marshalls, Citibank, and payment processor CardSystems.
The lucky victims — if such a thing can be said — are those who got their credit-card data stolen, says Scott Bilker, founder of DebtSmart.com. Under the Fair Credit Reporting Act, your credit-card issuer can't hold you responsible for any of those unauthorized charges. "Usually, they give you a new card, a new account number, and that's that," he explains.
But consumers whose debit-card data gets lifted are subject to a different set of rules and regulations — ones that may well leave you unprotected. "You're in a fundamentally weak position angling to get the grocery money put back in your checking account," says Jean Ann Fox, director of consumer protection for the Consumer Federation of America. Best-case scenario, you're out of cash until the bank investigates your claim. And there's a very real chance you could lose some — or all — of that money for good.
Debit transactions are regulated under the Electronic Funds Transfer Act. Under these rules, just how much you'll be able to recover depends on how quickly you discover the problem. If you notify your bank within two business days of learning about an unauthorized transaction, your liability is $50, maximum. Between two and 60 days, your liability is $500; after that, it's unlimited.
Banks build on these rules with their own policies. These so-called "zero liability" policies claim to free the consumer from fees and losses should unauthorized purchases be made to your debit account. In most cases, the banks promise to fully reimburse you. "But there's no law that says they have to," says Bilker. "It's all on their terms and their interpretations." Fact is, if the theft occurred for a reason that the bank deems your own fault, you're likely out of luck.
Even if you are eligible for reimbursement, don't expect to get your missing cash back quickly, says Fox. Some banks issue temporary credits, but it's a rare concession. In most cases, before you can be reimbursed, your bank must assess the charges to determine the extent of your liability. That investigation can take as long as a week.
So when isn't a bank likely to honor some or even all of your claims? When you fall into any of the following four loopholes:
PIN vs. ATM Transactions
If the PIN was lifted along with your account number good luck getting reimbursed, says Fox. With the exception of Bank of America, Chase, and Wells Fargo, most major banks won't cover all unauthorized charges or withdrawals completed with a PIN. Signed purchases, on the other hand, are covered because they are processed through trusted credit-card networks.
So sign away whenever possible. While it takes an extra step, it offers an extra layer of protection. For other perks to signing, click here.
Consumer Negligence
If your bank thinks you're to blame for your account number getting stolen, you can be held liable for losses in that account. MasterCard, for example, allows banks issuing its cards to assign liability when a consumer has not "exercised reasonable care in safeguarding the card," according to the details of its liability policy.
Good luck figuring out what that means. "The language is a little bit open-ended," says Joanne Trout, vice president of worldwide communications. "At the end of the day, it's the bank's call." Carelessness, she says, could mean anything from letting your college kid borrow the card to shopping through an unsecured web site.
The Domino Effect
"If someone cleans out your account, it's inevitable: checks are going to bounce," warns Bilker. The resulting overdraft fees won't necessarily be reimbursed.
Also, be aware that if your account is already overdrawn or in otherwise poor standing when the theft occurs, that may be another reason for the bank not to reimburse you. The idea is that you already weren't monitoring your account diligently.
Slow on the Uptake
Major banks require you to catch the unauthorized transaction within 60 days of receiving your monthly statement to qualify for the zero liability policy. Spot it later than that and you'll need to cite extenuating circumstances — say, a hospital stay or a long trip abroad — to be reimbursed.
