This is why nobody should ever use a debit card... just get credit cards.
Edit: To clarify, I understood the parent comment to mean that this lowering of limits was why I should use credit cards over debit cards.
The difference is that, when fraudsters hit your credit card, you're not out any money, ab initio. You call the card company and make them take the fraudulent charge off your bill. If they refuse, they have to sue to get your money. But if the bad boys nail your debit card, your account is dinged immediately, and you have to deal with the bank to get your funds restored.
Therefore, you should use ATM cards at ATMs only and only use credit cards to shop and travel and dine out (and enjoy the float and the points and pay in full every month). If your ATM card has a credit card logo (called a "check card"), call your bank and complain, and they'll issue you one that is only an ATM card and cannot be used to shop without a PIN.
It's worth noting that the Target case is confined to credit cards, not debit cards. To hack a debit card, the attacker must intercept both the mag stripes and the PIN that goes with them. That's hard to do, given the way PIN pads work. Reportedly, in the Target case, they did not succeed in doing that.
>If they refuse, they have to sue to get your money
First, they wouldn't refuse (at least in the USA) because Visa and Mastercard contractually require issuers to cover debit cards at the same level as they do for credit cards, which is complete protection from all liability.
Second, with credit cards you can't just decide what to pay off and what not to. If the issuer refuses fraud protection to you for whatever reason your credit rating is on the line if you don't pay off the balance. They may sue you, and they may damage your ability to get credit for a long time.
In other words, the situation between debit and credit card protection is basically the same: in both cases the issuer will almost certainly protect you, and you're screwed if they don't.
> To hack a debit card, the attacker must intercept both the mag stripes and the PIN that goes with them.
This is not true in the USA. Debit cards can be used in non-point of sale transactions (e.g. phone or internet) and point of sale non-PIN "signature" transactions where you use your debit card like a credit card.
That's true of most debit cards, namely the ones that sport a Visa or MasterCard logo. They are called "check cards" and can be used in either debit mode (enter PIN on PINpad, no signature) or credit mode (sign if over the merchant-defined limit). Either way, the charge goes against your bank account as soon as the bank receives it.
The difference between credit and debit mode is in who processes the charge. For PIN-less signature mode, the credit card network handles the transaction. For PIN debit mode, the debit network (e.g. NYCE) handles it. The debit networks are immediate: the money comes right out of your account. The credit card networks are slower. It may take a day or two for a transaction to hit your account.
I remember fifteen or twenty years ago when my bank introduced check cards. I called them and asked if the new MC logo meant the card could be used without entering a PIN. They said yes, and I said I didn't want it. A replacement minus the logo (and with a different PAN) arrived a day or two later.
As a naive non-credit-card-European I used my debit card in a Chicagoland Target a couple of years ago. There was no chip-reader, so the clerk took my card and swiped it for me, with a scathing glower.
I stood and waited for something to sign - nope. That was it, payment accepted. I was rather shocked.
I'm sure someone at some point will hack the chip, but right now you can safely lose your physical debit card, and you don't have to worry about leaks and hacks at merchants.
Credit cards with their totally outdated zero authentication methods and that allow the merchant to store all the data necessary to use the account without even physically having that card are the ones that are completely unsafe.
It's ridiculous that this system is still in use. Using credit cards instead of debit cards is really, really bad advice for anybody outside the US.
That may or may not matter to you depending on your financial situation, but it's probably much better to be in a position where you are debating/challenging what you owe rather than what someone else owes you.
Note: I know that the mechanics are slightly different when you "run it as a credit card" rather than a debit card, but you may be in the same boat if the money has already left your bank account (unless Visa or MasterCard lean on the bank to make things go faster in such situations).
What you do is you a separate list of known pins and work out the most likely pin is. Then you assume that all of your new Debit cards have that pin. Most won't have that pin, but for many of them you'll now have a working pin. For those you did not ever enter a wrong pin, so any sort of brute-force attempt detection software will never have any reason to suspect a thing.