Consumer Fraud Liability Study – 2013

CardHub-2013-Consumer-Fraud-Liability-StudyPayments fraud is an ever-changing beast, with fraudsters and law enforcement officials effectively playing a game of personal finance one-upmanship.  Not only do consumers feel the need to worry about the traditional means by which criminals might gain access to their funds – such as shoulder surfing at ATMs, technology that makes it easy to copy one’s physical credit card, and pickpocketing – but we must also consider the likes of computer and database hacking.  There have been a number of high-profile cases in the past few years where a company’s firewall has been breached, resulting in the theft and ultimate sale of millions of consumers’ financial information.

Even so, cumulative fraud losses only amounted to about $0.09 per $100 in credit card and debit card transactions during 2006, according to the Federal Reserve Bank of Kansas City.

Nevertheless, fear of fraud has unfortunately been known to influence consumer banking and payment habits, often dictating which spending vehicles we use and, in extreme cases, fostering a debilitating level of paranoia that makes operating within the modern banking system impossible.  For evidence of this, all one must do is peruse the countless online forum questions and blog posts concerning whether this or that payment vehicle will better protect you from fraud, how to fraud-proof your finances, etc.

What many consumers don’t know is that federal law and card network policies limit their potential liability for unauthorized transactions.  However, such liability limitation is far from straightforward, as the mechanisms by which fraud may be limited often vary based on a number of factors, including card network, issuer, reporting time frame, and payment vehicle.

This study will therefore strive to provide consumers with a valuable source of information regarding their vulnerability to financial losses as a result of card-related fraud, allaying concerns and clearing up common fallacies in the process.  More specifically, we will answer the following three major questions:

  1. When are consumers shielded from fraud liability?
  2. Which payment vehicles best protect consumers from fraud liability?
  3. What is required of consumers in order to benefit from fraud liability safeguards?


The following sections can be found below:

Main Findings

Overall:

  • Credit cards offer the best fraud liability protection for consumers.
  • Discover and American Express offer the best fraud liability protection, as they are the only major card networks whose $0 fraud liability guarantees apply across the board to credit card transactions, signature debit card transactions, PIN debit card transactions, and ATM transactions.  (American Express does not offer debit-based PIN transactions).
  • With the exception of non-reloadable provisional prepaid cards, consumers do not need to take any proactive steps (such as registration) in order to qualify for fraud liability protection.  However, consumers must report fraudulent or suspicious account activity to their card’s issuer in order to benefit.

Credit Cards:

  • Consumers are NOT liable for unauthorized credit card transactions given that all four major card networks – Visa, MasterCard, Discover, and American Express – offer $0 liability guarantees.
  • Judging from the retailers that participated in this study, consumers generally are NOT liable for unauthorized store card transactions.

Debit Cards:

  • Liability for unauthorized debit card transactions depends on whether a signature or PIN is used to verify the transaction, but consumers are generally much better protected when they sign for a purchase as opposed to using their PIN.
  • Consumers are NOT liable for fraudulent signature debit card transactions, regardless of card network.
  • Discover offers the best fraud liability for PIN debit card transactions in that cardholders are NOT liable for unauthorized transactions, while Visa and MasterCard’s policies have significant shortcomings. (American Express does not offer debit-based PIN transactions).
    • Liability for a Visa PIN debit card transaction depends on whether VISA or an unaffiliated PIN network processes the transaction, but there is NO WAY for cardholders to determine how a given transaction will be processed. More specifically, cardholders will either enjoy $0 liability if a transaction is processed by VISA or get no additional coverage beyond what is available via federal law if it processed by a third-party network. In certain cases, the latter situation could result in the cardholder assuming full liability for the unauthorized transaction.
    • MasterCard does not offer added liability protection for unauthorized PIN debit card transactions.  If it cannot be proven that the cardholder furnished the PIN, liability is limited by federal law to $50 if the fraud is reported within two business days and $500 if reported within 60 days (no limit thereafter).
  • The fact that the major card networks offer better fraud liability protections for signature debit card transactions than PIN debit card transactions could be construed as a reaction to the Durbin Amendment, which restricted the interchange fees for PIN transactions more so than those for signature transactions.
  • Reloadable prepaid cards offer the same fraud liability protections as traditional debit cards.

ATMs:

  • Discover and American Express cardholders are NOT liable for unauthorized ATM transactions.
  • VISA and MasterCard do not offer added liability protection for ATM transactions, although a card’s respective issuer might.  In the absence of added issuer protection, the cardholder will NOT be reimbursed for the amount removed from their account if it can be proven that a cardholder furnished the PIN.  If it cannot be proven that the cardholder furnished the PIN, liability is limited by federal law to $50 if the fraud is reported within two business days and $500 if reported within 60 days.  Past 60 days, consumers are NOT afforded ANY liability protection.

Best & Worst-Case Scenarios By Spending Vehicle:

Back to Top
Type of Unauthorized Transaction Best Case Scenario Worst Case Scenario Most Likely Outcome Best Network(s)
If I use a credit card… $0 liability; I won’t have to pay for any fraudulent transactions $0 liability; I won’t have to pay for any fraudulent transactions The unauthorized transactions ultimately won’t cost me any money given that the major card networks have $0 fraud liability guarantees Any
If I use my debit card and sign for the transaction … $0 liability; I will be reimbursed for any funds fraudulently removed from my account Unlimited liability; Any funds removed from my account are lost to me for good (assuming you’re using a MasterCard debit card and your account isn’t in good standing) The unauthorized transactions ultimately won’t cost me any money given that the major card networks have $0 fraud liability guarantees Any
If I use my debit card and input my PIN… $0 liability; I will be reimbursed for any funds fraudulently removed from my account (only applies to Discover debit card users) Unlimited liability; Any funds removed from my account are lost to me for good I will notice the fraud after two business days but before 60 days, and I will be reimbursed for charges in excess of $500 Discover
If I make an ATM transaction… $0 liability; I will be reimbursed for any funds fraudulently removed from my account Unlimited liability; Any funds removed from my account are lost to me for good I will notice the fraud after two business days but before 60 days, and my maximum liability will be $500 (depending on my bank, my liability might be as low as $0) American Express & Discover
Back to Top

Methodology

The information provided in this study was gleaned from a combination of federal law, marketing copy, and a survey of both the largest card networks (i.e. VISA, MasterCard, Discover, and American Express) and a number of major national retailers.

More specifically, we sought to determine the consumer fraud liability safeguards in place for credit card purchases, debit card transactions (both PIN and signature), and ATM withdrawals.  Prepaid cards were not evaluated separately because they offer the same fraud liability protections as traditional debit cards.  We also unearthed the requirements that consumers must fulfill in order to benefit from these protections, where applicable.

Viewing this information in concert, we determined the minimum and maximum level of consumer liability for unauthorized account access when using different spending vehicles and making various types of transactions and, ultimately, came to overall conclusions that will help consumers better understand and manage the potential impact of fraud on their personal finances.

Detailed Findings

Federal Law

Liability Limits:

  • Credit:  $50
  • Debit – Signature:  If you report the loss to the issuer within two business days:  liability limited to $50; If you report within 60 days: liability limited to $500; If you report after 60 days:  no liability limit.
  • Debit – PIN: 
    • Assuming it can be proven that you furnished the PIN used to make the transaction(s) in question: no liability coverage.
    • Assuming it can’t be proven that you furnished the PIN used to make the transaction(s) in question:  If you report the loss to the issuer within two business days:  liability limited to $50; If you report within 60 days: liability limited to $500; If you report after 60 days: no liability limit.
  • ATM transactions:
    • Assuming it can be proven that you furnished the PIN used to make the transaction(s) in question: no liability coverage.
    • Assuming it can’t be proven that you furnished the PIN used to make the transaction(s) in question:  If you report the loss to the issuer within two business days:  liability limited to $50; If you report within 60 days: liability limited to $500; If you report after 60 days: no liability limit.

Consumer Requirements: 

  • Credit:  Send letter to creditor including name, address, account number, and details of unauthorized charge(s) so that it arrives at “billing inquiries” address within 60 days of first statement containing error being made available.
  • Debit – Signature:  Send letter to bank including name, address, account number, and details of unauthorized charge(s) within aforementioned timeframes.
  • Debit – PIN:  You must report fraud within aforementioned timeframes. & officials must not be able to prove that you furnished PIN.
  • ATM transactions:  You must report fraud within aforementioned timeframes & officials must not be able to prove that you furnished PIN.

Other Information: 

  • Online Source(s):
    • http://www.ftc.gov/bcp/edu/pubs/consumer/credit/cre04.shtm
    • http://www.occ.gov/publications/publications-by-type/comptrollers-handbook/efteare.pdf
    • http://www.ftc.gov/bcp/edu/pubs/consumer/credit/cre16.shtm
Back to Top

VISA

Liability Limits:

  • Credit:  $0
    • “Visa’s Zero Liability policy is our guarantee that you won’t be held responsible for fraudulent charges made with your card or account information.”
  • Debit – Signature:  $0
    • “Visa monitors your account 24 hours a day to help prevent, detect and resolve fraud on your Visa Debit card. With Visa Zero Liability, you are not responsible for unauthorized purchases. Any funds taken from your account due to fraudulent use will be returned to you.”
  • Debit – PIN:  $0 liability if transaction is processed by Visa; No liability protection above what the law provides if transaction is not processed by Visa.
    • Consumer has no way of knowing what network transactions are processed on and therefore how much coverage they have.
  • ATM transactions:  None
    • “The liability is with the issuer.”

Consumer Requirements: 

  • Credit:  You must notify your financial institution immediately of any unauthorized use. Transaction at issue must be posted to your account before provisional credit may be issued. For specific restrictions, limitations and other details, please consult your issuer.
    • Definition of Immediately:  “Per our Zero liability policy, the cardholder liability is $0 for 120 days from the posting date of transaction or 60 calendar days from cardholder notification to issuer (if evidence of previous negotiation with Merchant).”
  • Debit – Signature:  Same as above
  • Debit – PIN:  Same as above
  • ATM transactions:  N/A

Other Information:

  • “Visa protections are provided to transactions made over Visa’s network. This includes signing for a purchase at the point of sale, using a Visa card for Internet or phone purchases, contactless card transactions and PIN debit transactions that are processed over Interlink, Visa’ PIN debit network. When a cardholder signs for their purchase (or uses their Visa debit card for purchases made online or over the phone), those transactions go over Visa’s network. Certain PIN transactions may go over Visa’s network as well. However, the merchant may choose to use another PIN debit network to process that transaction. Some financial institutions also offer liability protections for PIN transactions that go over other networks – however, the best way for consumers to ensure they are protected is to sign for their purchases. Additionally, if a merchant participates in Visa’s No Signature Required program, purchases under $25 may not require a signature or a PIN and still receive Visa’s suite of protections.”
  • “Visa’s Zero Liability policy does not apply to ATM transactions, PIN transactions not processed by Visa, or certain commercial card transactions. Individual provisional credit amounts are provided on a provisional basis and may be withheld, delayed, limited, or rescinded by the cardholder’s issuer based on factors such as gross negligence or fraud, delay in reporting unauthorized use, investigation and verification of claim and account standing and history. Card holders must notify their financial institution immediately of any unauthorized use. Transaction at issue must be posted to the cardholder’s account before provisional credit may be issued. For specific restrictions, limitations and other details, cardholder’s should consult their issuer. Verified by Visa requires online activation and Identity Theft Assistance offers access to a toll-free number. Consult issuer for additional details or visit www.visa.com/security.”
  • “For Visa Consumer Cards and Visa Business Cards issued in the U.S. Region, upon receipt of notification from its Cardholder of unauthorized Visa transactions, a U.S. issuer must limit the cardholder’s liability for those transactions to zero. This requirement is not applicable for ATM Cash Disbursements or Visa Corporate Card or Visa Purchasing Card Transactions.”
  • Online Source(s): http://usa.visa.com/personal/security/visa_security_program/zero_liability.html
Back to Top

MasterCard

Liability Limits:

  • Credit:  $0
  • Debit – Signature:  $0
  • Debit – PIN:  None
    • “With respect to any PIN debit transaction where the cardholder is alleging fraud, MasterCard’s rules require the issuer to comply with federal regulation (we have an overarching rule that requires compliance with applicable law and regulation).”
  • ATM transactions:  None
    • “For ATM transactions, the issuer has the discretion to establish its own policy regarding cardholder liability, in compliance with the law.  The issuer will outline its policy in the cardholder agreement, and provide information about how the cardholder can report a lost or stolen card or a transaction that the cardholder did not authorize.”

Consumer Requirements: 

  • Credit:
    • “As a MasterCard cardholder you will not be responsible in the event of unauthorized purchases provided that the following preconditions are met:  – Your account is in good standing; You have exercised reasonable care in safeguarding your card from any unauthorized use. (Failure to register certain cards will be considered as not safeguarding your card.) Unauthorized use means that you did not provide, directly, by implication or otherwise, the right to use your card and you received no benefit from the ‘unauthorized’ purchase; – You have not reported two or more unauthorized events in the past 12 months.”
    • Explanation of Registration:  “This applies in situations where the issuer does not know the identity of the cardholder. In order for zero liability to apply, the cardholder must register his or her identity with the issuer. This provision applies to non-reloadable prepaid cards, until such time as the cardholder notifies the cardholder or its agent that he or she is the cardholder; the issuer then performs ‘know your customer’ procedures and may opt to make the card reloadable. The instructions for this will be attached to the card when purchased, if the issuer offers this option.”
    • “If you have questions regarding zero liability coverage or you suspect unauthorized use of your card, contact your issuing financial institution IMMEDIATELY.”
  • Debit – Signature:  Same as above
  • Debit – PIN:  N/A
  • ATM transactions:  N/A

Other Information:

  • “Zero liability applies to purchases made in the store, over the telephone or made online.  However, Zero Liability does not apply to MasterCard cards (i) issued for commercial, business or agricultural purposes, except for MasterCard commercial cards used for small businesses as listed on www.mastercardbusiness.com; or (ii) if a PIN for a debit transaction is used for the unauthorized purchase.”
  • “The rule refers to fraud that the cardholder identifies and reports to the issuer; zero liability does not pertain to any identification of fraud by MasterCard. If the issuer decides to keep the same account open (the same account number and expiration date), then the issuer must still credit the cardholder for subsequent fraud, but if the conditions for zero liability are not met, then they only need to refund the amount of a fraud transaction that exceeds $50. Also, the issuer will lose fraud-related chargeback rights for transactions authorized after the date of the second fraud chargeback on the account. If the issuer issues a new card with a different account number, then MasterCard considers that to be a new account for chargeback and fraud reporting purposes.”
  • Online Source(s):  http://www.mastercard.us/zero-liability.html
Back to Top

Discover

Liability Limits:

  • Credit:  $0
    • “$0 Fraud Liability guarantee—You’re not responsible for any unauthorized charges on your Account—online, offline, anytime, anywhere, with absolutely NO deductible.”
  • Debit – Signature:  $0
    • “$0 Fraud Liability guarantee—You’re not responsible for any unauthorized charges on your Account—online, offline, anytime, anywhere, with absolutely NO deductible.”
  • Debit – PIN:  $0
    • “$0 Fraud Liability guarantee—You’re not responsible for any unauthorized charges on your Account—online, offline, anytime, anywhere, with absolutely NO deductible.”
  • ATM transactions:  $0
    • “Our $0 Fraud liability covers ATM transactions. If a person reports an unauthorized ATM transaction on their card, they will be immediately credited. Cardholder generally has at least 180 days to report the fraudulent transaction.”
    • What happens if they don’t report it?  “Unless it is flagged as suspicious activity, we wouldn’t know it was fraudulent unless it was reported. An example of suspicious activity would be if a cardmember had never taken out a cash advance thru an ATM before. We’d contact them, We generally allow 180 for a cardmember to file a dispute on a transaction, sometimes more.”

Consumer Requirements: 

  • Credit:  “Please notify us immediately* at 1-800-DISCOVER (1-800-347-2683). Your assistance in determining the facts related to any theft or unauthorized use will be very helpful.”
    • “*We don’t have a set number of days required to report fraud, You’re generally covered whenever you report it, We say that on our website to prevent future fraud from happening before putting a hold on the account number.”
  • Debit – Signature:  “Please notify us immediately* at 1-800-DISCOVER (1-800-347-2683). Your assistance in determining the facts related to any theft or unauthorized use will be very helpful.”
    • “*We don’t have a set number of days required to report fraud, You’re generally covered whenever you report it, We say that on our website to prevent future fraud from happening before putting a hold on the account number.”
  • Debit – PIN:  “Please notify us immediately* at 1-800-DISCOVER (1-800-347-2683). Your assistance in determining the facts related to any theft or unauthorized use will be very helpful.”
    • “*We don’t have a set number of days required to report fraud, You’re generally covered whenever you report it, We say that on our website to prevent future fraud from happening before putting a hold on the account number.”
  • ATM transactions:  Must report the fraud (generally within 180 days).

Other Information:

  • Online Source(s):  https://www.discover.com/credit-cards/member-benefits/security/fraud-protection/protect-yourself.html
Back to Top

American Express

Liability Limits:

  • Credit:  $0
    • “Use the American Express® Card online or off, and you won’t be held responsible for any fraudulent charges. Period.  No fine print, no deductible –just pure protection, so you can shop with confidence.”
  • Debit – Signature:  $0
    • This pertains to prepaid debit cards, as American Express does not offer traditional debit cards.
    • “With fraud protection, if your Card is lost or stolen, you won’t be responsible for fraudulent Card charges.”
  • Debit – PIN:  N/A
    • American Express does not offer debit-based PIN transactions.
  • ATM transactions:  $0
  • “Cardmembers are not liable for unauthorized ATM withdrawals. As always, if Cardmembers suspect unusual activity on their Cards, they should let American Express know as soon as possible.”

Consumer Requirements: 

  • Credit:  “If any fraudulent charge appears on your statement, simply notify us at the 800 number on the back of your Card, or access your account at americanexpress.com/myca and notify us by e-mail. In most cases, a temporary credit is given immediately.”
  • Debit – Signature: “If any fraudulent charge appears on your statement, simply notify us at the 800 number on the back of your Card, or access your account at americanexpress.com/myca and notify us by e-mail. In most cases, a temporary credit is given immediately.”
  • Debit – PIN:  N/A
  • ATM transactions:  “As always, if Cardmembers suspect unusual activity on their Cards, they should let American Express know as soon as possible.”
    • “Regarding ATMs in Corporate Cardmembers – not all Corporate Cardmembers have access to the Express Cash program. That is offered to Corporate Cardmembers at their company’s discretion and Cardmembers must receive authorization from their company to participate in the program. If the Corporate Cardmember has access to the Express Cash program they are covered from fraudulent ATM transactions.”

Other Information: 

  • Online Source(s):  https://www212.americanexpress.com/dsmlive/dsm/dom/us/en/phaseib/fraudprotectionguarantee_shareddetailsall.do?vgnextoid=fb6e4959f3156010VgnVCM100000cef4ad94RCRD&vgnextchannel=e2cb0db3915e7010VgnVCM10000084b3ad94RCRD&name=fraudprotectionguarantee_shareddetailsall&type=intbenefitdetail
Back to Top


Target – Store Credit Card

Liability Limit:  $0

Consumer Requirements:  None; Card is issued by Capital One, which proactively monitors for fraud.

 

Costco – Store Credit Card

Liability Limit:  $0

Consumer Requirements:  None; Card is issued by Capital One, which proactively monitors for fraud.

 

Home Depot – Store Credit Card

Liability Limit:  $0

Consumer Requirements:  Notify issuer as soon as possible.

 

Lowe’s – Store Credit Card

Liability Limit:  $0

Consumer Requirements:  Notify issuer as soon as possible.

 

Chevron – Store Credit Card

Liability Limit:  $0

Consumer Requirements:  Notify issuer as soon as possible.

 Back to Top
Previous Credit Card & Debit Card Fraud Statistics   Ask The Experts: The Argument Against Financial Literacy Programs? Next

Our content is intended for general educational purposes and should not be relied upon as the sole basis for managing your finances. Furthermore, the materials on this website do not constitute legal advice and should not be relied upon as such. If you have any legal questions, please consult an attorney. Please let us know if you have any questions or suggestions.