Scammers get your debit card number in five main ways: skimming or shimming devices attached to card readers, phishing emails and smishing texts that mimic your bank, data breaches at retailers and financial institutions, malware and keyloggers running on your computer or phone, and impersonation calls that pressure you into reading your card details aloud. Consumers filed more than 76,000 debit card fraud reports in 2024, with reported losses of roughly $180 million.1Federal Trade Commission. Consumer Sentinel Network Data Book 2024 Debit fraud stings harder than credit fraud because the money leaves your checking account immediately, and the federal liability rules for debit cards are narrower than those for credit cards.
Skimmers and Shimmers on Card Readers
A skimmer is a small device attached over the card slot on an ATM, gas pump, or store terminal. When you swipe, the skimmer reads the magnetic stripe and stores the data for the thief. A shimmer is the newer version: a paper-thin circuit board slipped inside a chip reader that captures data from your EMV chip when you dip the card. Either device is often paired with a hidden camera or a fake keypad overlay that records your PIN. With the card data and the PIN, a thief can clone the card and withdraw cash at any ATM.
Before inserting your card, wiggle the reader. A legitimate slot is firmly attached; a skimmer overlay tends to feel loose or crooked. At gas pumps, look for the security seal near the reader. If the label shows the word “void,” the pump panel has already been opened and may contain a skimmer.2Federal Trade Commission. Best Practices to Foil Gas Station Skimmers When you can, pay inside or use a contactless payment method that doesn’t require inserting the card at all.
Phishing Emails and Smishing Texts
Phishing messages impersonate banks, delivery services, or online retailers to trick you into typing your card details on a fake site. A typical email warns of suspicious activity or an undelivered package and pushes you to click a link. The link leads to a page built to look like your bank’s login screen, and everything you enter goes straight to the scammer. Smishing is the same trick delivered by text message, usually with a shortened link that’s hard to inspect before you tap. On a phone screen, the fake page can be almost indistinguishable from the real one.
The reliable tell is what your bank will not do. A legitimate bank does not send a text or email asking you to click a link and enter your full card number, PIN, or a one-time verification code. If an urgent security alert arrives, ignore the link and call the number printed on the back of your card.
Data Breaches at Companies That Hold Your Card
When hackers break into a retailer’s or bank’s systems, they can walk away with thousands or millions of card numbers at once. This is the one method you can’t prevent yourself, because the theft happens inside a company’s network. The stolen data typically ends up on dark web marketplaces, where card numbers with expiration dates and security codes are sold in bulk to buyers who use them for unauthorized purchases.
All 50 states, the District of Columbia, Puerto Rico, and the U.S. Virgin Islands require companies to notify you after a breach involving your personal information.3Federal Trade Commission. Data Breach Response – A Guide for Business If a notice arrives, take the free credit monitoring or identity theft insurance the company offers, and consider adding a fraud alert or credit freeze to your credit reports so no one can open new accounts in your name.4Federal Trade Commission. What to Do After a Data Breach
Malware and Keyloggers on Your Devices
Malicious software installed on your computer or phone can record everything you type, including debit card numbers and PINs. Keylogging programs run silently, capturing keystrokes as you shop online or log into your bank. A related technique, form grabbing, intercepts the data you enter into browser fields before the browser encrypts it, letting the scammer bypass the secure connection to the merchant’s site.
You typically pick these programs up through infected email attachments, fake software updates, or compromised websites. Once installed, the malware hides and keeps harvesting your financial information session after session. Keep your operating system and antivirus software current, avoid downloads from unfamiliar sources, and treat unexpected email attachments as suspect.
Vishing and Impersonation Calls
Voice phishing, or vishing, uses a live caller pretending to be a fraud investigator or a bank representative. The caller claims your account has been compromised and pressures you to “verify” your identity by reading your card number and PIN out loud. The urgency is manufactured. A skilled caller may already have some of your personal information from an earlier breach, which makes the impersonation more convincing.
The rule is the same as with phishing texts: a real bank representative will never call and ask for your full card number, PIN, or a one-time security code. If someone asks for any of that, hang up and call the number on the back of your card to check whether anything is actually wrong.
What You Owe if Your Debit Card Number Is Stolen
The Electronic Fund Transfer Act and Regulation E set the ceiling on your losses from unauthorized debit charges. Your liability depends on whether your physical card was taken and how fast you report the fraud.
If your physical card is lost or stolen and you report it within two business days of discovering the loss, your liability is capped at $50. If you report after two business days but within 60 days of receiving the bank statement showing the fraud, the cap rises to $500. If you don’t report within that 60-day statement window, there is no federal limit on your liability for fraudulent charges that appear after the window closes.5Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
Here is the distinction that matters most for the methods above. When your physical card stays in your wallet but someone steals the number through phishing, a breach, malware, or a phone scam, you owe nothing as long as you report the unauthorized charges within 60 days of the statement that shows them.6Consumer Financial Protection Bureau. Regulation E 1005.6 – Liability of Consumer for Unauthorized Transfers After that window, you can be held liable for fraudulent charges that occur going forward until you notify the bank.
Credit cards cap your liability at $50 for unauthorized charges no matter when you report. That gap is why watching your debit account closely, ideally with real-time transaction alerts turned on, matters more for debit than for credit.7Federal Trade Commission. Lost or Stolen Credit, ATM, and Debit Cards
Steps to Take Right After You Spot Fraud
Call your bank the moment you see an unauthorized charge. Ask the bank to freeze or cancel the compromised card and issue a replacement. Follow up any phone call with written notice. Some banks require written confirmation within 10 business days of an oral report, and failing to send it can affect your rights during the investigation.8Office of the Law Revision Counsel. 15 USC 1693f – Error Resolution
Under Regulation E, the bank must investigate and report results within 10 business days. It can extend the investigation to 45 days, but only if it provisionally credits your account for the disputed amount within those first 10 business days, giving you access to the money while the review continues.8Office of the Law Revision Counsel. 15 USC 1693f – Error Resolution
File a report at IdentityTheft.gov. The site generates an official identity theft report and produces a personalized recovery plan with step-by-step instructions.9Federal Trade Commission. Report Identity Theft and Get a Recovery Plan Then check your credit reports for accounts you don’t recognize. A scammer who has your card data may have other personal information as well.
Consider a fraud alert or a credit freeze. A fraud alert asks lenders to verify your identity before opening new accounts. A freeze blocks access to your credit report entirely until you lift it. Both are free and can be set up through any of the three major credit bureaus.4Federal Trade Commission. What to Do After a Data Breach Keep a written log of every call and every form you file. If a dispute over liability comes up later, documentation of your prompt reporting is what protects you.