also there are all sorts of checks when you try to wire or withdraw more than $10,000, not to mention wire hundreds of millions. Such transaction will manually cross a desk of at least 2 different bank managers.
Anecdote time. My wife and I have a shared checking account that got hacked and drained. First her debit card got skimmed. Then the perp called USAA a half dozen times claiming to be her and asking for account credentials. Finally they got a helpful account rep to reset the password, disable MFA, and tell them the username. Yep. You heard that right. Social engineering works even on bank tellers who should know better.
Fortunately it's just a daily use account and I'm paranoid, so there was only 5K they could access there. USAA owned up to the whole thing and restored the funds, but now they punish my wife with a 10-minute interrogation to prove her identity if she ever has to get them on the phone for a legitimate reason.
Convenience and security are often in direct competition with each other. Almost all of us would expect convenience in this situation. You should know better more than most the cost of choosing convenience and even you want that convenience. Is there any wonder why businesses select convenience over security?
If the company is going to provide some level of support to people they haven't verified, that support will be abused as a means of passing the verification.
Back when this happened, that was my first question to USAA and one for which the security guy didn't have a ready answer, though probably it boils down to some version of "we are heavily regulated and continue to rely on software built for mainframes."
There are so many possible ways to mitigate the risk which should be triggered well before a half dozen attempts finally gets to a teller credulous enough to believe their excuses for ignorance.
How is that punishment? If USAA knows you or your wife were a target of somewhat sophisticated attack that ultimately broke their security barriers, wouldn't you yourself actually want some extra protection? If anything, this is a positive sign for USAA, I doubt with my Bank of America anyone would care with any sort of extra layers of security if my account would ever get hacked in a sophisticated way.
I can't explain why it took many consecutive withdrawals in a short time, in a city that I've never visited, 3000 miles away from the most recent use of the card, to trigger USAA's protection algorithms.
USAA did finally take care of it. My biggest beefs with them are 1) they dragged their feet a couple days on the investigation until I called them myself (I'm the veteran, my wife is not, and they were much more responsive to me), and 2) they really do punish my wife for something not her fault. You know those questions you get which are sourced from your credit file? What street did you live on, what's your mortgage payment, things like that? That's what they ask every time, after asking for a secret password and PIN code to be used for phone calls.
I'll give them credit though, for actually sharing the gory details with me once they were done tracking down everything, and admitting that one of their own employees had broken their rules and handed over the credentials to my wife's account.
The mechanisms for restoring the charge on your credit card are much stronger than on your debit card. And a credit card is a FUTURE charge, so you have time to fix the problem. Whereas a debit card is your CURRENT money, so it's just gone unless you get it back.
I do not understand why people use debit cards linked to their actual bank account out in the world. Paying bills securely through the utility is the only thing we use that for.
It's not paranoia when they really are out to get you...
Because this advice is USA only. All of my credit cards (well... two) are linked to the bank account and I don't even think there's a way to get a credit card without bank connection.
Given how quick and painless it is to transfer money between accounts, leaving substantial amounts of money in accounts linked with mechanisms that can remove that money is insane to me.
1. My debit cards allow me to directly import transactions into my personal accounting software while my credit cards don’t; and
2. when I shop online, my debit cards allow me to use them as a 2nd factor (using a USB card reader) while my credit cards require either an iOS or Android device for 2FA.
You’re right in that a credit card is a future charge and debit isn’t. But are debit cards really so much more insecure? What threat model do you have in mind?
Credit cards also come with all sorts of benefits. You can easily get 1-2% off all purchases through cash-back or gift card rewards. You can get free insurance with car rentals. Many cards also offer an extra one year warranty on most purchases, so if you paid for your laptop or phone with your credit card and it dies just outside of the manufacturer warranty, you might still be covered.
Citation needed.
The scenario you described will absolutely fall under most card networks' transaction dispute rules. In day-to-day spending a debit card is just as safe as a credit card when it comes to fraud or malicious merchants.
The only time a credit card will be better is grey areas where a card network dispute doesn't succeed, in which case the law in most countries forces the credit card provider to eat the loss. In some of those cases, the reason why a credit card chargeback succeeds is not necessarily because you are right (if you were, the dispute process would've succeeded anyway) but because the amount is too low for the issuer to care so they just eat it to not have to investigate and/or litigate the issue.
If your debit card gets compromised, your rent check bounces.
Plus, frankly, banks are generally more protective of THIER money than YOUR money.
I guess that depends on the bank and the country you live in.
Well, or to use it with sites that require 3D Secure, but that’s still something to help the merchant not you.
EU-wide regulation requires all banks to force 2FA onto their customers for logging into their accounts.
(Apologies, saw the wrong parent comment) How many utilities, credit card companies require a checking account for autopay? How many times have you thrown out an old checkbook that contains routing and account numbers on a carbon copy pages?
Bank accounts are not especially secure, we mostly hope to limit the risk/reward calculation for hacking them and basic security controls.
In my experience, this is getting better! I now have all but one of my bills being paid by my credit card. Used to be that the utility companies made you pay extra and use a third party service if you wanted to use your credit card.
Not all, though. Verizon, for example, will let you pay with a credit card, but they give a substantial discount if you use a debit card instead. For obvious reasons. I hope that does not become normal. I'm used to Verizon being scummy, I hope it doesn't become the default behavior for the other utilities I pay for.
In Britain, most people¹ pay bills (electricity, water, phone, internet, insurance, car loan, credit card etc) by "Direct Debit"². (Most European countries have a similar system with similar guarantees, but this one is described in English.)
If anything should go wrong, the bank must fix it. There's a list of direct debits in the bank's interface, and they can be cancelled/suspended with one click (or by phoning or going to the bank).
It isn't perfect (see 3 from two weeks ago) but that sort of problem is rare enough that it was reported in newspapers.
¹ "Direct Debits are used by nine in ten UK consumers to pay some or all of their regular bills".
² https://www.directdebit.co.uk/DirectDebitExplained/Pages/Dir...
³ https://www.moneysavingexpert.com/news/2022/03/tsb-customers...
I tell you this story in the hopes that it helps you recognize if you have similar flaws in your own security.
I used to run a VNC server on my home PC (flaw 1). Chinese hackers discovered it and spent three weeks brute-forcing the password (flaw 2). Once in, they installed TeamViewer to allow themselves future access. Then, they logged in at 3am and used my browser-saved PayPal credentials (flaw 3) to paypal themselves $5k from my linked chequing account (flaw 4).
I discovered this several days afterwards when I saw the withdrawals hit my bank account. I then found a few further pending Paypal transactions, and pieced the rest together from VNC and router logs.
Thankfully my credit union believed me that I didn't authorize the transactions and reversed them, making me whole again.
But damn, it's a scary feeling having someone break into your computer, not knowing what they might have looked at or accessed. Very similar to having your home broken into.
https://www.cnbc.com/2019/09/11/email-wire-fraud-cost-26-bil...
We talk about eth/btc as if they're just covering the function of the checking account, but it's also covering the function of the checks, wire transfers, ACH transfers, etc. So for a real comparison you'd have to count up all the related fraud from legacy checking accounts and their various mechanisms to move money between them.