Consumers are shopping scared this holiday season. And dangerously.
They've got plenty of reason to do the former. In the past year, retailer after retailer has announced they've discovered malware hidden inside their credit card swipe machines that skimmed the payment data for millions of customers' credit and debit cards. Just this week Staples announced it was investigating a new breach involving at least 13 stores in the Northeast.
Skittish, nearly half of shoppers plan on avoiding stores hit by data breaches, according to a new Creditcards.com survey.
But shoppers have no reason to shop unsafely at the stores they choose to patronize. Using a credit card gives shoppers more protections than either debit cards or cash. If your debit card is stolen in a new malware breach, hackers can drain your account dry with online purchases or clone your card and make ATM withdrawals anywhere in the world.
"With credit it’s innocent until proven guilty," said Alex Cook, a 52-year old musician in New York. Previously a scammer tried to charge $500 at a Staples in New Rochelle using her debit card info. Getting the funds back proved a trial. "Dealing with banks you’re guilty until proven innocent."
Despite this, only one in eight respondents to the Creditcards.com survey said the breaches would make them more likely to use a credit card.
Outside a Staples in New York City's Midtown, Sonia C, a 34-year-old producer who declined to give her last name for privacy reasons, said she prefers to use debit.
"It's easiest," she said, compared with carrying around a wad of cash for holiday shopping, or dealing with credit card bills and finance charges.
She's right. Instead, the money comes right out of your account. That's true whether you're shopping, or a fraudster is using your stolen card information. After a scam, it could take nearly two weeks for the money to be restored to your account, assuming the bank sides with you.
That came as news to Sonia.
"I'm freaked out," she said.
Even though credit and debit cards look and swipe the same, a 3.370 by 2.125 inch piece of plastic with numbers on the front and a magnetic strip on the back, when trouble hits they're pretty different.
A debit card, akin to an evolved ATM card, is real money from your bank account. That's true even if you select "credit" instead of "debit" at checkout.
A credit card, on the other hand, is basically a plastic loan. You can dispute questionable charges before you have to pay for them, instead of fighting to get back money into your account.
"You're just better off by and large paying with a credit card because you have more rights and you're not out the money," said Susan Grant, Director of Consumer Protection at the Consumer Federation of America.
Additionally, banks are allowed to wait up until 10 days to refund fraudulently withdrawn funds. For many, that's too long.
"Consumers find their checking account empty or almost empty and they don't have money to pay for rent," said Paul Stephens, director of policy and advocacy for the Privacy Rights Clearinghouse.
Debit cards are also harsher when it comes to how quickly you have to spot fraud and report it to get all your money back. Per federal law, if a thief goes on a spree with a credit card, you can only be liable for up to $50.
But for debit, you have two days to report it after it's fraudulently used to be liable for up to $50 only. Report it between two business days and less than 60 days of getting a statement that included the unauthorized charges and your liability jumps to $500.
Take more than 60 days and you could be on the hook for the whole thing.
That's according to statute. As a matter of customer service and policy banks can be more lenient. During the breaches this year banks have said no customer will be held responsible for any unauthorized charges.
After the Target breach that affected 40 million credit and debt cards, "Sanchez," a 67-year-old cook at a Westin in New York, who declined to give his full name out fear that fraudsters could spot it online and use it to conduct further attacks, said thieves hit his debit card with $1,200 in charges. He said the bank put the money back and in letters wrote they were temporarily restoring the funds to his account pending the results of their investigation.
Ever since, he's paid only in cash to avoid any risk of hackers stealing his account information.
"Everybody has got to open their eyes," he said. "Especially during the holiday times."
Email Ben Popken at firstname.lastname@example.org or follow him on Twitter @bpopken.