Around 10 years ago, give or take a bit, I had a situation happen to me that happens to a lot of people. My debit card was hacked.

Fraudsters stole my debit card number; my credit union eventually concluded they swiped the card information by planting a gas pump skimmer at a station I frequented. It’s not hard to figure out what happened next. The bad guys used my card information to make fraudulent purchases. In the end, over $2,000 in unauthorized charges were made, courtesy of the money in mine and my husband’s joint bank account.

To make matters worse, my credit union didn’t catch the fraud. Instead, they approved the fraudulent transactions and allowed the money to be debited from my checking account. I personally didn’t realize there was a problem until a few days later when I logged into my bank account to pay a credit card bill. Only then did I discover that the money which was supposed to be in my checking account was missing.

Reporting the fraud

As I scrolled through my online account activity, I started to discover several charges I didn’t recognize. (Imagine my eyes popping open, bigger and bigger, along with several loud exclamations and you’ll have a pretty accurate mental image of my reaction.)

I called my credit union immediately to report the problem. I expected for the stolen money to be put back in my account right away. Spoiler alert: that’s not what happened.

Instead, the credit union representative told me they needed time to investigate the fraud. They would cut off my debit card and issue me a new one so no additional theft could take place. While that happened, however, it could take a week or more before I saw any money returned to my account. 

The next big problem? My family’s monthly bills were still due. Our credit card issuers, utility providers and mortgage company weren’t going to sit back and wait for their payments while the credit union investigated whether I was telling the truth about the phony charges.

Thankfully, my husband and I had money in savings. We used that money to pay the bills while our checking account sat empty during the investigation.

It was an eye opening experience for us. Our own personal money – not the credit union’s funds – was tied up during the investigation into the fraudulent charges on our account.

Why I never use debit cards

After a few days, the credit union did put the stolen money back into our checking account. Other than the initial shock and the hassle of moving some money from savings to checking, we came through the situation no worse for the wear. Yet I knew the outcome could have been a lot different if the thieves had stolen more money from our account.

What if our savings account balance had also been wiped out by thieves? (Our account, after all, was set up to withdraw money from savings if the checking account is ever empty.) What if the credit union had taken longer to reimburse us for the stolen funds? We could have faced late fees from our creditors and possibly even credit damage if we were unable to pay our bills during the fraud investigation.

Now, unless I’m pulling cash out of an ATM, I never use my debit card. When I can, I try to avoid using my debit card even then. (ATM skimmers are a common problem as well, in case you didn’t know.)

Legal fraud protections

Since this experience, my husband and I choose to use credit cards for our purchases. The fraud protections available are simply a lot more robust than those available for debit cards. I learned this lesson the hard way.

Don’t get me wrong – a credit card number is just as easy to steal as a debit card number. Had I used my credit card to pay for gas at that compromised pump all those years ago, my credit card account would almost certainly have been hacked.

The difference between debit cards and credit cards lies not in their ability to be compromised. It’s what happens after your account is used without your permission that sets these two payment methods apart.

The electronic funds transfer act

When your debit card number is stolen, like mine was, federal law protects you from liability for most of the fraudulent charges. The name of the law that gives you these protections is the Electronic Funds Transfer Act (EFTA).

But there’s a catch. You have to report the theft (or loss of your debit card) to your financial institution – and there’s a ticking clock.

How EFTA protections work for fraudulent debit card transactions

When your debit card number (not the card itself) is stolen and unauthorized transactions are made:

  • You have up to 60 days after your statement is sent out to report the fraud. Do this, and you have zero liability for unauthorized transactions.
  • Don’t wait more than 60 days after your statement has been sent out to report debit card fraud. If you make this mistake, your financial institution may hold you 100 percent responsible for unauthorized transactions.

I reported the fraud to my credit union as soon as I found out about it, before my next statement was even generated. However, the EFTA says your bank or credit union can take up to 10 business days to investigate the fraud and it can ask you to send a written confirmation of an error within 10 days after you report the fraud verbally.

Translation: that’s up to 10 business days the money you deposited in your checking account might not be available to use. Ouch!

If your physical debit card is lost or stolen, the rules change a little:

  • You should report debit card theft or loss within two business days of learning about your missing card. Do this and your maximum liability for any fraudulent transactions is limited to $50.
  • If you wait more than two business days (after learning about the problem) to report the theft or loss of your debit card, you could pay more. Your liability jumps to $500 within 60 days after your statement is sent out.
  • The worst thing you can do after a debit card is lost or stolen is to not report it at all. Once more than 60 days have passed after your statement is sent out, you could be personally on the hook for 100 percent of any unauthorized transactions.

The Fair Credit Billing Act (FCBA)

Your credit card issuers also have rules to follow when it comes to fraud. The Fair Credit Billing Act (FCBA) is a federal law which protects you if your credit card is overcharged, billed for merchandise you never receive, or – you guessed it – used without your permission.

When your credit card is used fraudulently, the FCBA caps your liability at $50. But many card issuers won’t hold you responsible for even this amount.

There’s still a ticking clock to worry about, so you’ll need to report any credit card fraud within 60 days. And again, the FTC recommends for you to send a billing dispute in writing. However, you don’t have to send a payment for the disputed charges while your credit card issuer investigates them.

The bottom line

Hands down, credit cards offer more robust protection when it comes to fraud. That’s a big reason why they’re my favorite payment method to use.

Plus, if and when my credit card account is hacked again (let’s face it – card fraud happens a lot), I know my personal money won’t be tied up during the investigation. If my debit card is hacked, on the other hand, I can’t access my personal money while my financial institution tries to figure out what happened on my account.

When you add in the fact that credit cards give us so many other perks, like price protection and the ability to earn lucrative rewards, the choice between debit cards and credit cards is really a no-brainer.

Learn more: