Fraud and Your Personal Identification Number

You may recall that last year there was a drawn-out battle over whether the government would crack down on debit card interchange fees, which are the fees that banks charge merchants every time you pay with a debit card.  The argument went something like this: Visa and Mastercard have an enormous amount of market power, and debit card interchange fees are higher than they are in other countries. Also, the fees are very slightly regressive, because merchants charge higher prices to offset them, which disadvantages anyone who uses cash.

I didn't find this argument very convincing at the time:

Merchants would like to pay lower fees, a cause to which I am of course sympathetic, but not one that actually motivates me to undertake a teary-eyed march upon 1600 Pennsylvania Avenue to demand that the government do something. When I moderated a panel on interchange fees in June, Felix Salmon was frustrated by the fact that we didn't spend more time on his concerns about things like Visa's market power, and I was frustrated that I couldn't get any of the advocates of interchange regulation to specify any benefits beyond richer merchants, or explain to my satisfaction why the rest of us should want to intervene on the behalf of an enormously powerful lobby.

To be sure, the current system benefits the wealthy most. But that is broadly true of many business models; shall we outlaw Costco because the poor cannot afford lavish pantries and large chest freezers in which to store their warehouse-club bounty?
However, Senator Dick Durbin did, and so we passed it.

The results have been fairly predictable: merchants who were previously indifferent between using your debit card as a credit card ("signature debit"), and using it with a PIN, have suddenly become very interested in encouraging you to go debit rather than credit.  Have you noticed that your supermarket and drugstore have now set up their swipe pads so that they default to debit, and it's often rather tricky to figure out how to use it as a credit card?  That little software change is saving them considerable money; many customers who want to use signature debit will instead give up and use the PIN.

Perversely, of course, I now go out of my way to use Signature Debit.  (Also, I like the frequent flier miles--but I used to use PIN debit whenever I could because I knew the fees are slightly lower for the merchants.  Now that they're trying to manipulate me, I feel duty bound to resist.)

I assume that nationwide, however, large retailers are successfully steering customers towards using their PINs.  Which has made me wonder: what about fraud?

To be sure, signature debit is significantly more vulnerable to fraud than PIN debit, because it's a lot easier to steal someone's credit card number than their password, and a lot easier to fake a signature than a PIN.  But PIN debit is not invulnerable, and as I understand it, the liability protections are much weaker for PIN transactions than for signature debit or credit cards: if you don't notice the withdrawals quickly, you are on the hook for much bigger losses than the $50 limit on credit card liability.  As transactions shift towards PIN use, I expect that the criminals will follow, which means that debit PIN fraud will probably become a larger problem.

Even beyond the liability limits, of course, both signature and PIN debit fraud can screw up your finances in a way that credit card fraud can't--if a lot of money goes missing from your account, you may miss payments on other bills, racking up late fees and overdraft charges.  And this is an especially big problem with PIN transactions, because of course they can withdraw cash and drain your account, rather than just ordering goods.  You can cancel fraudulent Amazon purchases.  You can't suck the cash back into an ATM machine.

I've also heard a few people argue that it's harder to prove PIN fraud, at least if the fraud is committed in your geographic area.  It's relatively easy to show that a signature (or the IP address on an internet transaction) isn't yours.  It's pretty difficult to demonstrate that you didn't buy $700 worth of groceries at Safeway, unless the Safeway is in another city where you incontrovertibly weren't.

Such is life of course: everything has risks, and lots of financial gurus (and me) think that the benefits of using a debit card rather than a credit card outweigh the potential costs.  But I worry that most people are not aware that they're being subtly encouraged to use their PIN more often, and that PIN fraud may have special risks that they should guard against.  Debit PIN fraud has been so low in part because it has debit PIN usage has been so rare in many contexts; as that shifts, people should be aware that the risks will shift as well.

Ultimately Todd Zywicki thinks that we'll end up moving to something more secure, like the chip-and-pin systems used in Europe.  But as he points out, it's very expensive to make this move: both the retailers and the card issuers will need to invest substantial sums in upgrading their payment infrastructure.  And will they be willing to do this if they can't recover the money in interchange fees?

They did it in Europe, where the interchange fees are, I believe, quite a bit lower.  On the other hand, they did it much earlier, before so many parties had invested in so much equipment.  The only answer I have right now is "We'll see".