Debit Card Fraud–Introduction
Canadians use debit cards millions of times a day at banking machines and cash registers to see their account information and make purchases. While most of these transactions are problem free, there have been a growing number of cases of debit card fraud in recent years. Taking steps to protect your debit card and personal identification number (PIN) will help lower your risk of being a victim of fraud.
Financial institutions may cover losses in cases of fraud occurring in Canada (does not include signature based debit cards or on-line or telephone banking transactions). It is important to understand that you may be held liable for losses if you are negligent with your PIN and card. In some cases, your losses may be more than the balance in your account if the thief keys in an amount to increase your balance and inserts an empty deposit envelope.
There are a number of steps you can take to protect yourself against debit card fraud. The following provides you with tips on protecting yourself, along with information about how debit card fraud can occur, what to do if you are the victim of fraud, situations in which you may be held liable, and your potential liability.
- How can you protect yourself against debit card fraud?
- How does fraud occur?
- What should you do if you are a victim of debit card fraud?
- When would you be liable for losses?
- How much could you lose?
It is important to remember that the responsibilities and liabilities for debit cards are different than for credit cards.
How can you protect yourself against debit card fraud?
Protect your debit card and PIN:
Never disclose your PIN to anyone – including family, friends, financial institution employees or law enforcement agencies.
Keep your debit card in a safe place and never lend it to anyone. If you suspect that someone knows your PIN, change it immediately or contact your financial institution to cancel the card.
Memorize your PIN. Avoid writing down your PIN. If you must do so, make sure that it is well disguised, for example, by re-arranging the numerals or substituting other numerals or symbols, and by keeping it within a record of other information.
When selecting a PIN, do not use obvious information. You could be liable if you use your name, address, telephone number, date of birth or social insurance number.
If your card is lost, stolen, retained by an ATM, or you find that there has been an unauthorized transaction, notify your financial institution immediately.
If you have made a purchase which does not appear on your monthly statement, change your PIN immediately and notify your financial institution as the information on your card and PIN may have been stolen at a bogus machine (see "How does fraud occur?") and you may be targeted for theft. Always check with your financial institution to determine if any additional action is required to protect your card.
When purchasing goods or services or when using an ATM:
Never let your debit card out of your sight; swipe the card yourself, if you can't – watch to make sure that it is not being double swiped.
Watch out for "shoulder surfers" – people who read your PIN as you enter it.
Use your hand or body to shield the pin pad to prevent others from seeing you enter your PIN.
Only conduct debit transactions when and where you feel secure.
If anyone tries to distract you at a banking machine, complete what you are doing and retrieve your card before talking to them.
After completing a transaction remember to take your card and the transaction record.
There are concrete actions you can take to manage your accounts to help reduce your risk from fraud. You may also want to discuss precautions with other family members if they are particularly vulnerable to fraud. Talk to your financial institution to explore possibilities. Consider the following precautions, remembering that some of them may reduce flexibility and convenience as you manage your accounts:
- Regularly check your statements or passbook updates and look for any discrepancies or suspicious transactions.
- Know your daily cash withdrawals and daily purchase limits. If they exceed your needs, you may want to ask your financial institution to reduce those limits.
- Check your authorized daily limits regularly. Financial institutions reserve the right to change withdrawal limits and thus you may not have noticed that your limits have increased.
- Check which accounts your debit card currently accesses, e.g. lines of credit, overdraft, savings accounts, and contact your financial institution if you want to change this arrangement.
- If you feel that a family member or dependent may be vulnerable to fraud, encourage them to talk with their financial institution about lowering their daily withdrawal limits. They could also ask their institution to hold the funds deposited by cheques until such cheques are verified to avoid the possibility of withdrawals being made against fraudulent deposits.
How does fraud occur?
In order for fraud to occur, a thief needs both your PIN and the magnetic stripe information on the back of your card. The PIN is not stored on the card's magnetic stripe. So, if your card is stolen or duplicated, the thief has to find some way to get your PIN. Common methods used to steal or duplicate cards and obtain the PIN are:
- Easily identified PINs – Your purse or wallet is stolen and the thief finds your PIN written down somewhere close to your card, or, successfully tries a commonly used PIN, such as your birth date, based on information found in your wallet. In this instance, you would be liable for your loss.
- Surf and Pick Pocket – A thief watches as you enter the PIN and subsequently distracts you and steals your debit card. If you are a proven victim of such a fraud, your losses would be covered by your financial institution.
- Card Jam – Various devices are used to jam your card in the bank machine. After your card becomes jammed, a helpful stranger suggests that you try to input your PIN a few times, but the card remains stuck. After you leave, they remove your card and have your PIN. Again, if you are a proven victim of such a fraud, your losses would be covered by your financial institution.
- Skim and Clone (Transaction is sent to the financial institution) – There have been cases of equipment being set up at a business to illegally collect your PIN and card information. For example, when you hand over your card to make a purchase, the card is run through a device that sends your magnetic stripe information to the financial institution. The person then swipes the card a second time to record the information into a hidden device which allows them to make a duplicate of the card. At the same time, a camera records your PIN information. In these cases, if you are a proven victim of such a fraud, your losses would be covered by your financial institution.
- Bogus machines (Transaction is not sent to the financial institution) – A bogus machine, that replaces the real PIN Pad, lifts your card and PIN information and issues a transaction receipt but does not actually send the transaction to the FI. The implicated employee covers your purchase by putting cash in the till so that the owner is unaware of any fraud since the outlet's books balance. At a future date, the employee uses the stolen data to create a card to empty the funds from your bank account. The evidence of the fraud could be that you have a transaction receipt (if indeed you received one) for a purchase but the purchase does not appear on your bank statement. In these cases, if you are a proven victim of such a fraud, your losses would be covered by your financial institution.
What should you do if you are a victim of debit card fraud?
If you are, or think you are a victim of fraud, it is important to deal with the incident as soon as possible. When you report the incident, your financial institution will probably want to ask you questions about the circumstances of the loss to ensure that you did not authorize the transaction or that you did not contribute to the loss. As well, you should keep a written record outlining the circumstances of the incident, all correspondence and notes on who you spoke to, when, and issues covered.
- Notify your financial institution immediately in order to commence an investigation. Your financial institution must inform you that:
- they will investigate the unauthorized/fraudulent transaction;
- a determination of any reimbursement will stem from this investigation;
- they will respond to your report of an unauthorized transaction as soon as possible, but in no later than 10 business days; and
- during the course of an investigation, they may require a signed written statement or affidavit, which may result in a temporary suspension of the 10 day time limit (until the requested information is received).
- Call the police to make a report.
- Research your rights.
- Be aware that if – as a result of the investigation – your financial institution is not reimbursing your full losses, they are responsible for showing that, on the balance of probabilities, you contributed to the unauthorized use of your debit card. If you are not satisfied with this explanation, speak with your branch manager.
- If the matter cannot be settled at the branch level, the financial institution must provide information on how their dispute resolution process works, who to contact next and how long each step should take. You are entitled to this information in writing if your problem cannot be resolved after you first complained, or if you have not received a response to your complaint.
- If you have contacted your bank or trust and loan company's Ombudsman (Note: An Ombudsman is an impartial body that investigates complaints from individuals and small businesses about financial institution services) and the problem still can't be settled, contact the Ombudsman for Banking Services and Investments (OBSI), formerly the Canadian Banking Ombudsman (CBO).
- If you have an account with a credit union or a caisse populaire, and your problem has not been resolved at the branch level contact your provincial or territorial regulator.
- You can also contact the Financial Consumer Agency of Canada if you believe your financial institution has not lived up to the Canadian Code of Practice for Consumer Debit Card Services or to find out about your financial institution's complaint resolution process. The FCAC is the federal government agency that monitors banks and trust and loan companies' adherence to the Code.
Reminder: During the dispute resolution process, financial institutions have agreed that cardholders should not be unreasonably restricted from the use of funds that are the subject of the dispute.
When would you be liable for losses?
The Canadian Code of Practice for Consumer Debit Card Services has been developed to help protect consumers in their use of debit card services in Canada by clarifying consumer and industry responsibilities. Most financial institutions have committed to maintaining or exceeding the level of consumer protection the Code establishes.
The Code says that:
You are not liable for losses resulting from circumstances beyond your control as long as you report the incident as soon as you are aware of the loss and cooperate in any subsequent investigation. Circumstances beyond your control include but are not limited to:
- Situations in which you were the victim of trickery, force, intimidation or theft.
- Technical problems with a banking machine or debit card terminal.
- Losses relating to cards that are forged, faulty, expired, or cancelled.
You may be liable for losses if you have contributed to the unauthorized use of your debit card by:
Writing your PIN on or near your card.
Keeping a poorly disguised copy of your PIN in close proximity to your card. For example, writing down "Bank-1286".
Choosing an unacceptable PIN selected from your name, telephone number, date of birth, address, or social insurance number.
Voluntarily giving your PIN to someone who subsequently contributes to the fraud.
Failing to notify your financial institution, as soon as you are aware, that your card has been lost, stolen or misused or that your PIN may have become known to someone else.
Failing to cooperate in the investigation of the loss.
Your financial institution will probably want to ask you questions about the circumstances of the loss to ensure that you did not authorize the transaction or that you did not contribute to the loss in any of the above ways.
How much could you lose?
If you have not contributed to the unauthorized use, you should not be held liable.
But, if you have contributed to the unauthorized use, your liability is normally limited to the daily limits set by your financial institution. Most set a daily limit for cash withdrawals at ATMs and a separate daily limit for purchases at point of sale terminals. For example, the following daily transaction limits could apply:
Note: limits vary depending on the institution and the cardholder's agreement
Be aware that the funds taken could far exceed the balance of your chequing account. For example, if you have only a few dollars in your account you could still lose an amount up to your daily limit, every day. This could occur if your account is linked to overdraft protection, a line of credit, other accounts, or if a thief, who obtains your card and PIN information, deposits a false cheque into your account for a large amount, and then withdraws cash and makes purchases against the false deposit.
- Date modified: