Every so often, we're given a harsh reminder that maybe our financial lives aren't as safe as we'd like to think.
About 56 million credit card numbers were stolen by hackers from home improvements giant Home Depot in September, far more than in the Target breach in December 2013. Going after other consumers' cards is one of the easier ways that identity fraudsters can make a buck, according to a recent report by Javelin Strategy & Research. It's also pervasive and complex, with thieves taking many different tactics to gain access to your plastic.
Here's a deeper dive into the world of existing credit card and debit card fraud, and what protections consumers have to guard their plastic.
Fraudsters attack cards from many angles
Fraud against the debit cards and credit cards in your wallet is the most common type of financial identity fraud, affecting 4.6 percent of Americans and accounting for 85 percent of new fraud incidents in 2013, according to the Javelin report.
Existing card fraud comes in different flavors:
- Card-not-present fraud: This fraud doesn't involve an actual card. Fraudsters will use the card-account information, obtained from skimming and phishing scams or card breaches, to make purchases online, over the phone or by mail.
- Lost or stolen card: This is your typical pickpocket kind of fraud, where a criminal steals a wallet or purse and uses the debit cards or credit cards before the cardholder reports them missing.
- Mail non-receipt fraud: This fraud happens when a criminal gets a card in transit after it's been issued by the credit card company but before the cardholder receives it. People who live in apartment buildings with communal mailboxes or those who have just moved and changed their address are most vulnerable.
- Counterfeit card fraud: This happens when a fake card is created by criminals using data from the magnetic stripe of a real card that they obtain by skimming or in data breaches.
- Card takeover fraud: This occurs when fraudsters use your information to take over a card in your name to change the mailing address, add them as an authorized user or for some other nefarious purpose.
There are consumer protections
Fortunately, there are good consumer protections for credit card holders when it comes to card fraud. The maximum liability under federal law is $50 if the actual credit card is lost or stolen. If the cardholder reports the card lost or stolen before any fraudulent charges are made, their liability is zero.
If only the credit card account information is stolen, say, from a data breach, then the cardholder has no liability, according to federal law.
Federal protections for debit card holders are not as consumer-friendly:
- If reported missing or stolen within two business days, the maximum liability is $50.
- If reported missing or stolen within 60 days of the fraudulent charge appearing on your billing statement, the maximum liability is $500.
- After those deadlines, the losses are unlimited.
Debit cards don't offer as much protection against fraudulent use. If you need to dispute a purchase, you are in a weaker position because the merchant already has the money and it will be returned only if you win the dispute, according to USA.gov.
Banks and retailers are working to create better card security. The U.S. payment landscape is moving toward the adoption of EMV (Europay, MasterCard and Visa) chip cards, which better secure physical transactions and make counterfeiting cards nearly impossible. There is also talk of using tokenization, where a random code is used to authenticate an online transaction.