1

My bank gave me a debit card I can use to run small errands, especially online. I recently started using it for paying also meals and/or drinks.

I noticed that sometimes it is not necessary for the owner of the card (me) to enter the PIN number in order to get the card to process the payment. This happened:

  • At the bar, using contactless payment.
  • On some online stores where neither the CVV2 nor any PIN where required.
  • At some places, such as highway toll stations, where asking for the PIN number would be a burden for both customers and seller (the customer line would simply increase due to the time spent entering the PIN not to mention the need to give a pinpad to someone in a car).

I thought the CVV2 or the PIN were required for a payment to be authorized in case the physical card is not detected by a payment device. This is clearly not true and now I'm afraid that if some online store leaks my data (as it often happens nowadays), the card might be used from someone else. The risk is contained since there is always not a lot of money on the card, but still, I'd have to make a lot of paperwork. I know I can use Paypal, but not every store online accepts it (sadly for us customers, but understandably for them because of the high fees).

Can someone enlighten me as to when and how companies (especially online ones) are authorized to process a payment made through a debit card without asking for the PIN number? Are all online stores able to do this? I'm not that concerned with physical shops accepting cards without requesting PIN since if you loose your card then you immediately block it.

By the way, the card uses the Maestro circuit.

Improve this question
1
  • 1
    You might want to add a country tag, as this has some impact.
    – Aganju
    Commented Jul 5, 2018 at 18:57

2 Answers 2

Reset to default
5

I thought the CVV2 or the PIN were required for a payment to be authorized in case the physical card is not detected by a payment device.

It's not. Depending on the size of the merchant it's their risk management call. Some merchants require some sort of authorization when the transaction is above $x. Some have agreements with the network that they're on the hook for any fraud below some dollar value, so it's up to them to determine their cost benefit. Smaller merchants have agreements in place with their bank that would dictate their risk management process. This might sound unfair to you since it's your money that's at risk, but there it is.

This is clearly not true and now I'm afraid that if some online store leaks my data (as it often happens nowadays), the card might be used from someone else.

That's a real threat. I don't ever use my debit card anywhere other than at the issuing bank's ATM machines or branches. Have a credit card, pay the bill every month in full. Keep a spare one on you in case there's an issue with your primary card. Put a bank's money at risk, not yours.

Improve this answer
2
  • 1
    I can only agree. At least in the US, using a debit card comes with high personal risk, and actually people start to understand that, so the usage it going down.
    – Aganju
    Commented Jul 5, 2018 at 18:58
  • OTOH, SEPA direct debit as used in Germany counterbalances this risk for the card holder by giving them the right to cancel any such transaction within ca. 6 weeks (45 days) without the need to give a reason (and IIRC 13 months if the transaction was fraudulent). E.g. my bank displays a "revoke" button behind such transactions. So while it is easy to revoke false transactions, as account holder you'll have to check your bank statements regularly and in detail. There may be a possibility to completely switch off such transactions (but then you obviously cannot use such direct debits to pay).
    – cbeleites
    Commented Jul 5, 2018 at 21:02
0

In general the way things work with credit and with debit cards that use the credit card networks (AIUI maestro is part of mastercard, though in some countries maestro debit cards may also work on local networks) is that the merchant has discretion in how much fraud protection they apply.

A merchant CAN run a card transaction with only the basic card number and expiry date (and for some card types also the start date) but if that transaction is reported as fraudulent then the merchant is going to be the one who ends up eating the cost. The merchant can reduce their liability by using extra security measures like EMV (chip/contactless) for in-person transactions, CVV2 for non-in person transactions (both online and phone) and 3D secure for online transactions.

EMV contactless has it's own special rules, the transactions don't normally require a pin, but there are normally limits on the number and/or value of contactless transactions between chip and pin transactions.

The trouble is of course from your point of view is that dispute processes can take time and effort and lack of money can cause you problems in the meantime while the dispute is sorted out. For this reason I would be wary of using a card linked directly to my main bank account for online shopping.

You don't say where you live, if you were here in the UK then I would recommend getting a credit card as they have stronger legal protections than other card types but I don't know if similar things apply in other countries.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .