Debit Cards Carry Risks

One of the big selling points of debit cards, highlighted in ad campaigns and on bank websites, is that you'll have "zero liability" for losses if your card is lost or stolen—just like credit cards.

Turns out that's only sort of true.

In fact, nearly every debit card comes with restrictions in cases of theft. Some banks limit your coverage if you are slow to report a lost card or potential fraud. Some don't cover fraudulent ATM transactions. Some may require that you show "reasonable care" in protecting your card or PIN number.

The matter is a significant one. There were 38.6 billion debit-card transactions last year, far more than the nearly 23 billion credit-card transactions, according to the Nilson Report newsletter in Carpinteria, Calif. Banks encourage customers to use debit cards, since they are far more lucrative than cash or checks.

Debit cards, by contrast, are covered under a different law, and the rules are much more complex. If you call your bank within two business days of discovering your card is missing, your losses are limited to $50. But if you wait, you could be on the hook for up to $500. And if you don't report the problem within 60 days after it shows up on a statement, you might face unlimited losses.The loopholes grow out of different federal regulations for different cards. Under federal law, your losses from unauthorized charges on your credit card are limited to $50, and there is no time limit for when you must report the problem. Many issuers go further, waiving all losses due to unauthorized credit-card use.

In the late 1990s, Visa and MasterCard went beyond those requirements, promising reduced liability for their branded debit cards. But there are several loopholes: Visa's "zero-liability policy" doesn't cover ATM transactions, some business cards or PIN transactions that don't go through the Visa network. It does cover transactions where you sign, which bring in more revenue than PIN transactions.

MasterCard doesn't cover any transactions that require a PIN, and it won't cover more than two theft events in a 12-month period. You must also exercise "reasonable care" to prevent your card from being misused. But that term is subject to interpretation. Have you failed to show reasonable care if you forget your card at a restaurant? That depends on the circumstances and your bank, a spokeswoman says.

Discover Financial Services and PayPal debit-card policies require losses to be reported within two business days. Bank of America, which has been advertising its zero-liability policy heavily, offers a 60-day window, as does Wells Fargo. Like many banks, they go beyond what Visa and MasterCard offer, covering ATM and PIN transactions, for instance.

To avoid problems, you should keep cards you don't use often in a safe place, protect your PIN and check your account regularly for suspicious activity. Here are few other things to keep in mind:

• Many banks—but not all—will replace your missing funds the next day. In a 2009 survey of how the 25 largest banking companies handle debit cards, Javelin Strategy & Research found that 20% of the large banks didn't replace missing money the next day, down from 28% in 2008. Under federal law, banks have up to 10 days to replace the funds.

• Expect any additional protections to come with stepped-up fraud monitoring of both debit and credit cards. Though fraudulent dealings constitute far less than 1% of all transactions, they are costly, reaching close to $7 billion globally last year, up 7% from 2008, says Dennis Moroney, a research director at TowerGroup, which advises financial-services companies.

Sophisticated software from Fair Isaac, the company that created the FICO credit score, tracks the real-time activity of more than 2 billion cards worldwide for issuers, scoring transactions based on spending patterns, where they are made, their size and other factors.

The higher the score, the more likely the bank may decline the purchase until you clear it, or call you afterward to confirm the transaction was legitimate.

Mike Urban, senior director for FICO's fraud products, says that about 20 calls may be made to customers for each fraudulent transaction caught, a ratio that allows the majority of crooked deals to be stopped without unduly disrupting consumers.

• Though they say "debit card" on them, prepaid debit cards have fewer protections than regular ones. These cards, which have money loaded on them and aren't connected to a bank account, aren't covered by debit-card regulations.

Issuers like Wal-Mart Stores may limit losses and replace funds, and Visa and MasterCard offer the same zero-liability protections for prepaid cards as for their debit cards, with the same loopholes.

—karen.blumenthal@wsj.com