1

My bank gave me a debit card I can use to run small errands, especially online. I recently started using it for paying also meals and/or drinks.

I noticed that sometimes it is not necessary for the owner of the card (me) to enter the PIN number in order to get the card to process the payment. This happened:

  • At the bar, using contactless payment.
  • On some online stores where neither the CVV2 nor any PIN where required.
  • At some places, such as highway toll stations, where asking for the PIN number would be a burden for both customers and seller (the customer line would simply increase due to the time spent entering the PIN not to mention the need to give a pinpad to someone in a car).

I thought the CVV2 or the PIN were required for a payment to be authorized in case the physical card is not detected by a payment device. This is clearly not true and now I'm afraid that if some online store leaks my data (as it often happens nowadays), the card might be used from someone else. The risk is contained since there is always not a lot of money on the card, but still, I'd have to make a lot of paperwork. I know I can use Paypal, but not every store online accepts it (sadly for us customers, but understandably for them because of the high fees).

Can someone enlighten me as to when and how companies (especially online ones) are authorized to process a payment made through a debit card without asking for the PIN number? Are all online stores able to do this? I'm not that concerned with physical shops accepting cards without requesting PIN since if you loose your card then you immediately block it.

By the way, the card uses the Maestro circuit.

  • 1
    You might want to add a country tag, as this has some impact. – Aganju Jul 5 '18 at 18:57
4

I thought the CVV2 or the PIN were required for a payment to be authorized in case the physical card is not detected by a payment device.

It's not. Depending on the size of the merchant it's their risk management call. Some merchants require some sort of authorization when the transaction is above $x. Some have agreements with the network that they're on the hook for any fraud below some dollar value, so it's up to them to determine their cost benefit. Smaller merchants have agreements in place with their bank that would dictate their risk management process. This might sound unfair to you since it's your money that's at risk, but there it is.

This is clearly not true and now I'm afraid that if some online store leaks my data (as it often happens nowadays), the card might be used from someone else.

That's a real threat. I don't ever use my debit card anywhere other than at the issuing bank's ATM machines or branches. Have a credit card, pay the bill every month in full. Keep a spare one on you in case there's an issue with your primary card. Put a bank's money at risk, not yours.

  • 1
    I can only agree. At least in the US, using a debit card comes with high personal risk, and actually people start to understand that, so the usage it going down. – Aganju Jul 5 '18 at 18:58
  • OTOH, SEPA direct debit as used in Germany counterbalances this risk for the card holder by giving them the right to cancel any such transaction within ca. 6 weeks (45 days) without the need to give a reason (and IIRC 13 months if the transaction was fraudulent). E.g. my bank displays a "revoke" button behind such transactions. So while it is easy to revoke false transactions, as account holder you'll have to check your bank statements regularly and in detail. There may be a possibility to completely switch off such transactions (but then you obviously cannot use such direct debits to pay). – cbeleites Jul 5 '18 at 21:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.