Zero-liability policies: How they work, what to do when they don't
Don't assume you're covered, or that you can take your time with fraud
So you found some suspicious-looking charges to your credit card or bank account. No big deal. You're covered by the bank's zero-liability policy, right?
Typically, yes. But sometimes, depending on what type of card you use and how you use it, you could still end up eating the fraudulent costs.
Virtually all banks have some sort of zero-liability policy for their debit and credit cards that keeps cardholders from losing any money if they're victimized by fraud. However, these policies aren't all alike when it comes to fraud reporting deadlines, coverage for various types of transactions and even replacement time.
There are "gotchas" in how transactions are handled, says Robert Vamosi, security risk and fraud analyst for Javelin Strategy & Research. "One difference is liability coverage for fraud associated with an ATM account. While 92 percent of banks offer it, only 81 percent of card issuers do. Some cover fraudulent PIN transactions, but there's a lot of fine print. Each bank has a list of what they will or won't cover."
Knowing that, here are four things to keep in mind about zero-liability policy for your credit and debit cards, so you know when you're covered by the card issuer --and when you're out your own money.
No. 1: Different rules apply to debit, credit cards
While debit cards are near level with credit cards in having zero-liability policies, coverage isn't always the same, says Paul Stephens, director of policy and advocacy for the Privacy Rights Clearinghouse. "Rules for credit-card liability are a little more consumer-friendly. With a debit card, you can theoretically lose all the money in your account if you don't promptly notify your bank."
Why the difference? Debit and credit cards are covered under different federal regulations. Credit card purchases are protected under the Truth In Lending Act (Federal Reserve Board Regulation Z), so your liability for any unauthorized transactions made before you report a lost or stolen card is limited to $50.
Debit cards are covered under the Electronic Funds Transfer Act (Federal Reserve Board Regulation E). Under Reg E, your liability is $50 if you notify the bank within two days of discovering the fraud, but that number rockets up to $500 if you take more than two days. If you still haven't notified your bank within 60 days after you received your card statement with the unauthorized transactions on it, you could be liable for the entire stolen amount.
Most banks go beyond what regulations require and limit debit card liability to $50, but be sure to ask yours about its written policy. "There are different time periods and amounts covered if you make certain milestones, but 60 days is the typical cutoff time," says Vamosi. "So you should be checking your accounts regularly."
What happens if you‘re more than 60 days late? Most banks review on a case-by-case basis. "They don't necessarily get zero liability, but we'll review every case," says Edward Kadletz, executive vice president of debit and prepaid cards at Wells Fargo Bank. "If someone says he was out of the country on business or was traveling, those could be situations in which we waive liability."
No. 2: No signature, no coverage
Card issuers don't cover certain types of typical everyday transactions. For example, neither MasterCard nor Visa offer zero liability for PIN-based debit transactions, which utilize the same regional and national EFT/electronic funds transfer networks (like Interlink, Maestro and Pulse) as ATMs for real-time authorization at the point of sale and settlement from the customer’s checking account. Such coverage is offered by the major card brands as an incentive for consumers to choose Signature debit over PIN debit, as Signature debit earns significantly higher interchange fee income from merchants.*
"Visa and MasterCard's zero-liability policies only apply to signature-based transactions," says Stephens. "Even if you always sign for your card instead of using a PIN, you're not covered. If your card is lost, stolen or skimmed, you have no way of knowing whether the crook is using a signature- or PIN-based transaction, and you have no control over it."
Financial institutions may offer their own zero-liability policy for PIN transactions. To find out what protection you get, look at the back of your card to see which networks can handle your transactions, then ask your bank what you're guaranteed for fraudulent PIN transactions.
No. 3: Your bank may not do everything for you
If you discover fraud, the first step is to contact your bank, but don't assume it will immediately take the matter out of your hands. When this reporter discovered two suspicious transactions on her MasterCard debit card issued by USAA Bank and called to report it, the bank's reply was that she should call the merchants where the transactions were made and ask them to clear the transactions for her. Luckily, they did. But what would happen if they refused?
Visa, American Express and Discover said the banks issuing their cards take over fraud investigations for customers, but MasterCard's policy is the cardholder should first resolve it with the merchant. "If you can't, the next step is for the bank to investigate it with the merchant," says MasterCard spokeswoman Joanne Trout. "If they can't come to a decision, then we get engaged and become the arbitrator."
No. 4: Your money may not be replaced right away
According to Javelin Strategy & Research, 82 percent of the 25 largest banks give next-day availability to compromised funds. Visa and MasterCard say its debit cardholders have quick access to their funds while fraud is being investigated.
Still, banks legally have 10 business days to investigate fraud, and Stephens says individual cases, like new accounts, have taken longer to resolve. Some victims of debit-card scams have told the Privacy Rights Clearinghouse they had no access to money for several weeks while their banks did investigations. "Sometimes if you have a good, long-standing relationship with your bank, they'll replenish funds right away," says Stephens. "But I've heard of people who've had the same bank for 25 years and they've still had to wait for two weeks."
So, debit or credit?
The 25 largest banks and credit unions offer zero-liability policies for both debit and credit cards, as well as next-day replacement of lost or stolen debit cards. Still, fraud experts say credit cards are safer overall for everyday use, while debit cards should be used sparingly. That's because it's better to argue with the card issuer about charges you supposedly owe -- when your money is still in your possession -- instead of about money already taken from your bank account.
"Even with a good zero-liability policy attached, (a debit card) is still the key to your kingdom," says Vamosi.
|Comparing zero-liability policies for debit cards and credit cards|
|Credit cards||Debit cards|
|What happens with a fraudulent transaction?||It's canceled immediately, and you don't have to pay charges.||Money from your bank account is immediately withdrawn because the bank won't cancel transactions before they're processed. That means you're out those funds until the bank restores them.|
|How much are you officially liable for?||$50 for any unauthorized transactions, even before you report a lost or stolen card.||$50 if you notify your bank within two days of the fraud; $500 after two days and before 60 days; and after 60 days, you're potentially liable for the entire stolen amount.|
|What transactions aren't covered?||Card networks vary. Visa doesn't cover ATM transactions or PIN transactions, since they're not processed through its network. MasterCard also doesn't cover PIN transactions, or accounts that have reported two fraudulent transactions within 12 months. American Express and Discover say they cover all transactions.||Because many banks issue Visa and MasterCard debit cards, they follow those companies' coverage policies. Some banks offer their own additional coverage for ATM, PIN and signature-based transactions, so ask yours what transactions they do cover.|
|How are fraud investigations handled?||American Express, Discover and Visa are in charge of the cases. (MasterCard wants cardholders to first contact merchants directly and request that fraudulent transactions be erased) and customers typically have full account access restored.||Banks are legally allowed up to 10 business days to investigate fraud, and can also freeze cardholders' account access during that time.|
Correction: As originally published, the article incorrectly characterized the way PIN-based debit card transactions are processed. See CreditCards.com's editorial corrections policy.
- As banks talk with Facebook, time to review your privacy rights – With Facebook seeking customer data from banks, federal privacy protections let you opt out of some data sharing by financial institutions ...
- As data breaches increase, here's how to cut your identity fraud risk – As data breaches increase, it is easier to cut the risk that your card data and other personal info will be stolen. Dark web scans, free credit reports and virtual card numbers can ease your anxiety about identity theft ...
- Protect your card details, identity from being doxxed – Even if you’re not in the public eye, just the fact that you have a digital footprint means you and your sensitive financial information could be exposed to the growing doxxing epidemic ...