Editorial Policy

Card stolen? What's your liability?

Matt Alderton

March 20, 2014

Whether they're physically stolen or virtually looted, your credit and debit cards are ripe for the taking.

“We have all kinds of electronic devices now in which we can actually pay for something with a credit card, and a lot of those devices don't provide a lot of security,” says Chicago attorney Stephen Lesavich. “And, of course, we've all heard about data breaches at Target, Neiman Marcus and other places. The stores themselves may be secure, but because the vendors they use have not followed proper security procedures, large amounts of credit card numbers are stolen.”

You may think fraud protection has kept up with the digital age. Unfortunately, that isn't  the case. Here are four rules you need to know about card liability before fraud strikes:

1. Know how your credit card is protected.

Thanks to the Fair Credit Billing Act (FCBA) — enacted in 1974 to give consumers a means for disputing credit card billing errors, including fraudulent charges — credit cards offer superior fraud protection.

You're liable for $50 on unauthorized charges made on your credit cards, according to law, but with Visa, MasterCard, Discover and American Express, you are basically not responsible for anything as long as you report the unauthorized charges — typically within 60 calendar days of the mailing date of the first statement showing any unauthorized transactions — says Simon Zhen, writer and community moderator at MyBankTracker.com.

But, you have to report any fraudulent charges promptly. Consumer law attorney Jeremy Heck, cofounding partner of the firm Luftman, Heck & Associates in Columbus, Ohio, says rights granted to consumers by the FCBA, such as a timely resolution of disputes or the right to withhold payment on fraudulent charges pending an investigation, are only guaranteed for 60 days after the bill with the error was mailed to you. If you do not submit a dispute in writing to your card issuer's “billing inquiries” address within that period, the law no longer applies.

You can still dispute fraudulent charges, Heck stresses, but the longer you wait, the more likely you could be hit with that $50 or more.

2. Understand your debit card's protections.

Debit card protection fall under the FCBA and the Electronic Fund Transfer Act, but are not as robust as credit cards. It's important to check with your financial institution about its policies, however, as some provide protections that extend beyond the legal limit..

Legally, if you report your debit card as stolen, missing or compromised before any unauthorized charges are made, you have zero liability, Lesavich says, who is co-author of “The Plastic Effect: How Urban Legends Influence the Use and Misuse of Credit Cards.”

If you don't act quickly, it's another story. If you report the loss or theft within two business days after you learn about it, your liability is $50, Lesavich says. If you report more than two days but less than 60 days after your debit card statement is sent to you, you are liable for $500, he says. After 60 calendar days, you essentially have unlimited liability: All the money from your bank account could be lost. Lesavich warns that if you have overdraft protection, you could be lose more money than is in your account.

3. It's not what you know; it's who.

Card issuers typically are very equitable when it comes to fraud, with one exception: when the cardholder knows the fraudster.

“Everyone knows about identity theft and big data breaches, but what happens when your husband or wife — or ex-husband or ex-wife — uses your card, and they're not authorized to do so?” Heck asks. “If it's a straight identity-theft situation, credit card companies are usually pretty good about taking care of it; you might have to jump through some hoops, but ultimately you can get it resolved. When you know the person, however, the credit card companies aren't nearly as friendly to you.”

Your relationship with the fraudster is important, because you could be liable for charges if it's found that you were negligent — for instance, if you allowed the fraudster access to your credit card, or if you kept your PIN written on a piece of paper next to your debit card in your wallet.

“You'll have to somehow prove that this person wasn't authorized to use your card,” Heck says. “For example, you might have to sign an affidavit or police report right away.”

4. You must protect yourself.

Card issuers typically are very good about monitoring accounts for fraudulent activity, and generally will notify you if they notice anything suspicious. However, you shouldn't rely on them exclusively.

“Ultimately, the responsibility lies with you,” Lesavich says. “[Card issuers] are reliable, but nothing beats logging on to your account from a secure terminal once a week, or once every couple days.”

Because time is of the essence — especially with debit card disputes — consider setting up account alerts by text message, email or phone call to ensure timely recognition of fraudulent charges.

“Chase, for example, lets me set account alerts for purchases of any amount on my debit card,” says Zhen. “If I set it at $100, and I spend $500 on a purchase, it will tell me. If you want to be alerted every single time there's a charge on your account, you can set it for a penny.”

Apps can be useful. “BillGuard is a crowd-sourced service that detects suspicious charges on your linked credit and debit card accounts,” Zhen says. “If someone reports a funky charge, BillGuard will tell everyone else in the network with that charge that they should look at it and determine if it's legitimate.”

Although alerts and apps won't prevent fraud, they'll ensure you can act quickly when it does. “Sometimes, no matter how cautious you are, your cards could get compromised,” says Lesavich, whose credit card numbers have been stolen on two separate occasions. “But if you're diligent in reporting things when they happen, you generally can get them resolved.”