Getty Images

For the roughly 185 million U.S. consumers with debit cards, the recent security breach at arts-and-crafts retailer Michaels Stores offers yet another cause for concern. The reports allege that the thieves did more than simply steal debit-card information from stores in 20 states they used it to take money from customers' bank accounts.

This isn't the first time debit-card information has been stolen, but these kinds of crimes are becoming more common and more serious. The Michaels thefts follow a similar case last summer at Aldi Inc. grocery stores that reportedly led to customer reports of debit-card fraud. Year-to-date, debit and credit cards make up 20% of all consumer data breaches, up from 11% during the same period last year, according to the Identity Theft Resource Center. Debit-card fraud losses incurred by banks hit a record $788 million in 2008, according to the latest estimates from the American Bankers Association, due mostly to stolen and counterfeit debit cards. "This is going to get worse you're going to see more bad guys out there looking for debit card information," says Jay Foley, executive director at the ITRC.

For consumers, debit-card theft whether of the physical card or the numbers on it can be more damaging than a credit-card theft. Debit-card holders who report their card missing before it gets used aren't held responsible for withdrawals. But if they don't notice until after fraudulent transactions occur, they could be held responsible for some or all of the charges. In the worst-case scenario, a debit-card theft could wipe out a bank account, and if a consumer's checking account is linked to a line of credit for overdraft protection, they could lose that, too.

 

Credit Cards Are Safer Than Debit Cards

1:45

If scammers steal your debit-card pin number, your bank account may be at risk. Fewer than half of banks promise zero-liability protection on debit-card pin transactions, says MarketWatch's Andrea Coombes. (Image courtesy of Getty)

It all depends how much time elapses, says Lauren Saunders, managing attorney at the Washington D.C. office for the National Consumer Law Center. If a consumer's debit card has not been lost or stolen but there are unauthorized charges on their account, they will be protected if they report those charges within 60 days of when the statement was sent. When a physical card goes missing or is stolen, consumers have just two business days after learning about the loss to notify the card issuer; those who do will limit their losses to $50. Otherwise, they could lose up to $500. If they take months to notify the bank, they may not recoup any money at all.

These are the basic rules, though some banks extend them. Wells Fargo, for example, says consumers aren't responsible for any unauthorized transactions made with their debit card as long as they contact the bank promptly. "The sooner the better," says a spokeswoman, "preferably under 60 days." Chase also says it offers "zero liability protection," as longs as customers notify the bank "promptly," but a spokesman didn't provide a specific timeline, saying "customers need to pay attention to their accounts." Banks also say they watch debit-card activity and actively look for signs of fraud. A Bank of America spokeswoman says that if the bank determines fraud, victims aren't held liable.

But for consumers, the rising risk means an extra level of vigilance and in some cases, hassle. While for many consumers the dawn of the debit card meant the end of religiously balancing a checkbook, experts now recommend reviewing your checking account balance online every day, and contacting the bank immediately after a debit card goes missing or a suspicious transaction pops up. If a card gets stolen and used, Foley recommends filing a police report. It's unlikely the police will catch the thief, but it can help consumers make a case for reimbursement with the bank.

Meanwhile, banks are considering their own protective measures. Chase, for example, says it's considering a maximum of $50 or $100 per transaction, in part because new legislation will dramatically reduce the revenue generated by debit cards, but the costs of fraud are expected to remain the same. Citi says it is evaluating potential changes as well; other banks say it's too soon to speculate.