If your debit card never left your wallet but charges you did not make are hitting your account, someone almost certainly captured your card number, expiration date, and three-digit security code and used them without the plastic. That data leaks through skimmers on gas pumps and ATMs, breaches at retailers you have shopped with, phishing emails, malware on your devices, and even automated software that guesses valid card numbers at random. Understanding how someone could use your debit card without having it matters less than acting fast: federal law caps your liability at $50 if you notify your bank within two business days, and the cap rises sharply the longer you wait.
How Thieves Get Your Card Number Without the Card
Skimmers and Shimmers on Physical Terminals
A skimmer is a shell that fits over a real card slot at a gas pump, outdoor ATM, or self-checkout kiosk, copying the magnetic stripe as you swipe or insert. Skimmers are often paired with a pinhole camera or a fake keypad overlay that records your PIN. The genuine terminal keeps working underneath, so nothing seems wrong.
Shimming goes after the EMV chip. A shim is a paper-thin circuit board slipped inside the reader slot, sitting between the chip and the terminal’s contacts and intercepting the data the chip sends. The chip generates a unique code for each purchase, which makes a perfect clone difficult, but the stolen data can still be written to a magnetic stripe and used anywhere swipe transactions are accepted. A single skimmer on a busy pump can harvest hundreds of numbers in a day, either stored on the device or transmitted wirelessly to a nearby receiver.
Merchant Breaches and Digital Skimming
When hackers break into a retailer’s payment system, they can pull card numbers, expiration dates, and security codes from millions of accounts and sell the records on dark web marketplaces, sometimes for a few dollars per card.
Digital skimming, sometimes called a Magecart attack, works differently. Attackers inject malicious code into a legitimate retailer’s checkout page. When you type your card number into what looks like a normal payment form, a hidden script copies the data and sends it to the attacker’s server. The merchant’s own database may never be touched, which makes the theft harder to detect.
Phishing and Malware
Phishing uses an email or text that mimics a bank alert to steer you to a convincing fake site, where you enter your card details yourself. Keylogger malware, installed through an infected attachment or download, records every keystroke and captures card numbers as you type them into shopping sites. Either method hands the attacker everything needed to make card-not-present purchases.
BIN Attacks and Automated Guessing
Some fraud has nothing to do with any information ever taken from you. In a BIN attack, criminals start with the Bank Identification Number, the first six digits of a card (eight under newer international standards), which identifies the issuing bank and card type. Automated software then generates thousands of random combinations for the remaining digits, expiration dates, and security codes, testing each one against online merchants that allow unlimited attempts or skip the security code on small purchases. A hit is flagged as verified and either used or resold. Because the guessing is purely mathematical, any active card number is a potential target, which is why fraud can appear on a brand-new card that barely left the envelope.
What You Owe Depends on How Fast You Report
The Electronic Fund Transfer Act sets a three-tier liability structure based on when you notify your bank of an unauthorized transaction or a lost or stolen card:
- Within two business days: your maximum liability is $50, or the amount of unauthorized charges before you notified the bank, whichever is less.1GovInfo. 15 USC 1693g – Consumer Liability
- After two business days but within 60 days of the statement showing the fraud: liability can rise to $500.1GovInfo. 15 USC 1693g – Consumer Liability
- More than 60 days after that statement: you can be responsible for every dollar of unauthorized charges that occurred after the 60-day window, with no upper limit.2eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
The bank carries the burden of proving a transaction was authorized, not you.1GovInfo. 15 USC 1693g – Consumer Liability Many banks offer zero-liability policies that go beyond the federal minimums, but those are contractual promises that can change. The statute is the floor you can always rely on.
What to Do Right Now
Speed matters more with debit fraud than with most other kinds because the money is already out of your checking account.
- Freeze or lock the card in your banking app so no new charges clear while you sort things out.
- Call the bank’s fraud department, request a new card with a different number, and formally dispute every unauthorized transaction. Note the date and time of the call, because that starts the clock on the bank’s investigation obligations.
- Pull up your statement and record the merchant name, date, and dollar amount of each charge you did not make. A unique transaction reference number, if the statement shows one, helps the bank trace the payment.
- Sign a written fraud affidavit if the bank asks for one. Some banks also request a police report, especially where identity theft is involved.
- File a report at IdentityTheft.gov, which generates a personalized recovery plan and pre-filled letters you can send to banks and creditors.3IdentityTheft.gov. What To Do Right Away
Once you have notified the bank, it generally has ten business days to investigate and decide whether an error occurred. The bank can extend the investigation to 45 days, but only if it provisionally credits your account within the initial ten business days so you have access to the disputed funds during the review.4Office of the Law Revision Counsel. 15 USC 1693f – Error Resolution For transactions on a new account (opened within the past 30 days), point-of-sale purchases, or foreign-initiated transfers, the investigation window is 90 days and the provisional credit deadline is 20 business days.5eCFR. 12 CFR Part 1005 – Electronic Fund Transfers (Regulation E)
You will get written or electronic notice of the decision. If the bank confirms fraud, the provisional credit becomes permanent. If it finds no error, it will explain why and reverse the provisional credit.
If the Bank Denies Your Claim
Banks sometimes deny fraud claims because their investigation concluded the transaction was authorized or because the dispute was filed too late. Start by asking for the bank’s written explanation and any evidence it relied on. You are entitled to these under the error resolution rules.
If the bank will not reverse its decision, file a complaint with the Consumer Financial Protection Bureau, which handles complaints about checking accounts, fraud, and electronic fund transfers.6Consumer Financial Protection Bureau. Submit a Complaint The CFPB forwards the complaint to the bank, which must respond, and you then have 60 days to review and reply. You can also report the fraud to your state attorney general’s office or to the Federal Trade Commission.
Overdraft Fees and Recurring Payments
Fraudulent charges can drain the balance, trigger overdraft fees, and bounce legitimate payments like rent or utilities, creating a cascade of returned-item charges. When the bank confirms the fraud, it must refund the stolen funds and any fees the bank itself charged as a result, such as overdraft or insufficient-funds fees.5eCFR. 12 CFR Part 1005 – Electronic Fund Transfers (Regulation E)
Fees charged by other companies, such as a landlord’s late penalty or a utility reconnection charge, are not covered by federal banking rules. Contact those payees directly, explain what happened, and ask them to waive the charges. A copy of the bank’s fraud confirmation letter helps.
Once the compromised card is canceled, recurring payments tied to it (subscriptions, insurance premiums, loan payments) will fail. Some card networks offer an automatic billing updater that forwards your new card number to participating merchants, but not every merchant participates. Review your recurring charges and update payment information manually for anything critical, so you do not lose service or pick up late fees.
How to Make Your Account a Harder Target
No single step eliminates the risk, but a few layered habits reduce it:
- Turn on transaction alerts so you get a push notification or text for every purchase and can spot fraud within minutes instead of at month-end.
- Pay with a digital wallet like Apple Pay or Google Pay where possible. Contactless payments use tokenization, replacing your real card number with a one-time stand-in for each transaction, so the merchant never sees or stores your actual account data.7Mastercard. Tokenization Explained: Protecting Sensitive Data and Strengthening Every Transaction
- Ask your bank whether it issues virtual debit card numbers for online shopping. These are tied to your account but different from the number on your physical card, and they can be limited to a single use or one merchant.
- Tug on card slots at ATMs and gas pumps before inserting. A skimmer overlay often feels loose or bulky, and a terminal that looks different from the one at the next pump is a reason to walk away.
- Avoid entering card details over public Wi-Fi. Use your phone’s cellular connection if you must shop away from home.
- Review statements at least weekly. The 60-day reporting window under federal law starts when the bank sends the statement, not when you open it.2eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
Be careful with one-time passcodes sent by text. If anyone contacts you asking for a code your bank just messaged you, do not share it. Your bank will never ask you to relay that code to a third party.