Hacked Debit Card? 9 Ways To Protect Your Money

How Debit Card Fraud Happens

Debit card fraud occurs when someone unlawfully uses your physical debit card or debit card number. Most people assume this takes place after their card is lost or stolen, but there are ways criminals can directly access your bank account.

A few months ago, a mother in South Florida had to petition her bank to credit fraudulent charges to her autistic son’s account. His debit card had been cloned at a card reader [*].

In another case, a Richmond man repeatedly stole mail containing banking information, which he promptly used to steal tens of thousands of dollars [*]. And in November 2023, Bank of America’s service providers were hacked, exposing thousands of customer Social Security numbers (SSNs) and account numbers on the Dark Web [*].

But compromised card readers, postal fraud, and data leaks aren’t the only routes leading to debit card fraud. Many scammers also use sophisticated phishing scams to collect your debit card number.

Others eavesdrop on unsecured public Wi-Fi networks to track your online purchases. Some take an even simpler path — shoulder surfing while you use your debit card at an ATM.

{{show-toc}}

What To Do To Prevent Fraud

Liability laws aren't forgiving when it comes to debit card fraud. While most credit cards offer zero fraud liability, debit cards come with nearly unlimited liability. If you fail to report a lost or stolen card within 60 days, you’re responsible for the charges that a criminal racks up on your card.

With pressure from consumers and lawmakers, banks are doing their part to stop fraud as it happens. However, some detection algorithms need fine-tuning.

Several banks tend to suddenly close or freeze your account whenever they detect “suspicious” transactions — even if you made them yourself [*].

Consumer Financial Protection Bureau (CFPB) data shows that January 2023 was a record month for complaints from aggrieved customers whose bank accounts were suddenly closed [*].

The best way to avoid these situations? Prevent debit card fraud in the first place. Here are some steps you can take to protect your debit card information:

1. Enable notifications from your bank account

Alerts about suspicious activity on your accounts are like weather wanes for identity theft. Nearly every modern bank offers real-time notifications for suspicious activity, declined transactions, low balances, and foreign purchases. 

Many even let you choose how you want to receive those notifications. For example, Chase customers can get notifications via email, text, or push notifications in their app [*].

To enroll in Chase alerts:

• Log in to your mobile or online account.
• Go to Profile & settings → Alerts → Choose alerts.
• Pick which alerts you want to receive for each account. Beyond the ones mentioned above, you might want to enable notifications for overdrawn accounts or ATM withdrawals exceeding a certain amount.
• Select your preferred method of delivery.

2. Disable overdraft protection

Fraudsters will use your debit card even if you have a low balance. Hitting a negative balance could mean incurring hefty overdraft fees — upwards of $30 per transaction [*].

It can also put your other accounts at risk. Banks may make automatic withdrawals from linked accounts to cover a scammer’s purchases on your debit card.

Opting out of overdraft coverage means that your bank will decline debit transactions when there are insufficient funds to cover it. Read your bank account agreement carefully to be sure; but most NSF (non-sufficient fund) fees only apply to bounced checks.

📚 How To Prevent Check Washing: 8 Steps →

3. Use a secure connection to access online banking

Hackers take advantage of security vulnerabilities in public Wi-Fi to inject malware into people’s devices. These viruses give scammers direct access to devices or allow them to spy on users’ activities.

Other fraudsters set up fake Wi-Fi hotspots that look like real ones. You may then be redirected to a spoofed website — resembling your online banking portal — that asks for your username and password.

Here’s where a virtual private network (VPN) might help. VPNs encrypt your browsing history and IP address, preventing hackers from intercepting information or tracking messages. Some VPNs, like Aura’s, automatically block harmful ads and websites, too.

{{show-cta}}

4. Be leery of phishing and imposter scams

Reality TV celebrity Andy Cohen fell for a bank scam earlier this year [*]. After losing his debit card, he began receiving legitimate-looking fraud alert emails, prompting him to sign in to his account to rectify the issue.

Thieves collected his credentials and continued to press for more information, sending a text convincing Andy to call a “support” number.

Once they got him on the phone, scammers duped Andy into providing authentication codes sent to his phone that would help them complete multiple wire transfers.

If you’re concerned that your bank sent a real fraud alert, call its official customer service phone number and speak with a representative to confirm. Look out for unusual text messages and emails from people pretending to be friends or family members. And never give out any personal data.

5. Look for skimming devices at ATMs or payment terminals

Crooks place skimming devices on top of POS terminals, gas pumps, and ATM card readers to steal your card number and PIN.

With your bank account information, they can empty your account, sell your data online, or produce counterfeit cards. Skimmers are usually affixed over the existing card reader or PIN pad, giving them an odd color or bulkier look.

To spot a credit card skimmer, look for:

• Crooked card readers
• Loose keypads
• Tape or glue
• Pieces of the ATM device that look broken or manipulated

Also check for hidden cameras around an ATM. Banks and businesses never orient cameras toward the keyboard, but scammers do.

6. Choose bank ATMs over those in public places

Criminals tend to steer clear of bank ATMs because they are usually surrounded by cameras or security guards. The ATMs in malls, grocery stores, alleys, and convenience stores, however, have much less protection.

If you must use one of these ATMs, keep an eye out for signs of tampering, like:

• Strange on-screen instructions
• Unstable keypads
• Particularly sticky keys

Make a point to visit ATMs during the day. Peak ATM crimes occur between 7:00 pm and midnight [*].

While using the ATM, don’t let others get close enough to steal your PIN, and be wary of anyone who seems to have been at or around the ATM for an abnormally long period of time.

7. Maintain a low balance on your debit account

While a low balance won’t keep thieves away, it will restrict them from making large withdrawals. Plus, having a smaller sum in your debit account will make it easier to recognize fraudulent transactions — and finding and reporting fraud early will limit your liability.

You should also use a separate checking account for mortgage, utilities, and insurance payments. Even if someone drains your debit account, you won’t miss any payments or incur late fees.

📚 Does Credit Repair Work? What To Know Before You Sign Up →

8. Check your bank statements at least once a month

You should review your statement every month, but personal finance experts suggest tracking debit transactions daily. The sooner you catch fraudulent transactions, the sooner you can report them.

Opting in to paperless statements will prevent scammers from stealing bank documents from the mail. Download your bank’s mobile app to browse your transactions and identify unfamiliar ones on the go.

9. Consider using a prepaid card, credit card, or contactless payments

Credit cards are preferable to debit cards because they have far friendlier liability policies and timeframes for reporting fraud. Under the Fair Credit Billing Act (FCBA), cardholders have 60 days to dispute a charge with their card issuer [*]. And if an unauthorized user makes purchases with their card, the cardholder is only liable for $50.

Prepaid cards are another good alternative to debit cards. If someone has access to your accounts, they’re limited to the funds you’ve preloaded onto your card. You can also eliminate the chances of card reader skimming by using contactless payment methods like Apple Pay and Google Pay.

Keep in mind that none of these options will stop fraud altogether. You still need to watch for fraudulent transactions and any legitimate data breach alerts that could leak your payment card data.

Reporting Debit Card Fraud

The Electronic Funds Transfer Act (EFTA) protects consumers’ debit card transactions, as well as ATM activity, international money transfers, and gift cards [*].

It sets guidelines for disclosing bank fees, error resolution, and, perhaps most importantly, consumer liability. For lost or stolen debit cards, consumer liability is measured on a sliding scale:

• If you report a lost or stolen card before unauthorized charges appear, you have zero liability.
• If you report within two days, you have a $50 liability limit.
• If you report within 60 days, you have a $500 liability limit.
• If you report after 60 days, you have unlimited liability.

If your card isn’t lost or stolen, but you notice unauthorized transactions, you have 60 days to report them before incurring liability. Here’s how to make a report:

• If your debit card was lost or stolen: Call your bank or credit union’s support number or follow the reporting instructions in your mobile app. Then, write your bank a letter detailing what happened (more on what to include below). Get confirmation for your original report, and make a copy of your mailed-in report.
• If your security code or PIN was stolen: Notify your bank or credit union within two days to avoid liability.
• If your debit card was charged for something you didn’t buy and you still have the physical card: Reach out to your bank ASAP so that you’re not responsible for any fraudulent activity during that period. If you’re in the middle of a hospital stay or lengthy travel, your bank must extend the 60-day rule [*].

In all reporting circumstances, be prepared to share:

• Your account number
• How and when your card was stolen
• The date and time when you first reported it missing
• All unauthorized transactions

If you don’t hear back from your financial institution within 10 business days, file a complaint with the CFPB online, or call (855) 411-2372.

You can also reach out to consumer advocacy groups like Privacy Rights Clearinghouse for help. If worse comes to worst, report fraud to the Federal Trade Commission (FTC) or the Office of the Comptroller of the Currency (OCC). They oversee national banks and can guide you in the right direction.

Other FAQs:

How long do bank investigations take?

Generally, your bank or credit union has 10 business days to investigate your report. If you opened your debit card within the last 30 days, they have 20 days to look into your issue. 

After the investigation period, the bank has three more days to notify you of its findings and must share the information used in the investigation if you ask for it. If the bank detects an error, it must correct the error within one business day.

Are you eligible for temporary credit?

If your bank or credit union can’t complete its investigation within 10 business days, it must send a temporary credit to your account for the transaction you’ve disputed. However, there are certain circumstances in which they do not have to issue a temporary credit.

For instance, the bank may ask you to send a written letter confirming all the details in your report. If they don’t hear from you within 10 days, they aren’t required to extend temporary credit.

When will you get your money back?

The timing depends on your bank’s investigation. Generally, once it has notified you of its findings, the bank has 45 days to refund scammed money.

But there are some exceptions. If the transactions happened in a foreign country, were point-of-sale (POS) purchases, or occurred within 30 days of opening your account, the bank has 90 days to remedy your account.

If, for some reason, the bank finds that the transactions you reported were authorized, it must give written notice before removing any money credited during the investigation.

Even the most diligent people don’t have the time or energy to track their credit and debit card transactions 24/7. That’s why many turn to an always-on credit monitoring solution like Aura.

Aura is consistently rated as a top financial protection platform — providing instant Experian credit locks, 250 times faster fraud alerts, and round-the-clock U.S.-based support for identity theft emergencies. If the worst happens, all Aura plans come with at least $1 million in insurance coverage.

It’s surprisingly easy to be more secure online. Try Aura today.