3 Big Credit Card Data Breach Secrets

3. We’re Not Just Being Nice

Card issuers are going out of their way to emphasize that consumers won’t be responsible for any fraudulent charges as a result of a breach. That’s true. MasterCard and Visa both have pretty robust “zero liability” policies. But although they make a point of emphasizing that their policies go beyond the requirements of federal law, in this case, the laws themselves offer comprehensive protection.

Under the Fair Credit Billing Act, which protects consumers in the case of credit card fraud, federal law limits liability for fraudulent charges to $50 in most cases. But if the card is not presented in the actual transaction; i.e. the card number is stolen and used online, then cardholders aren’t responsible for any fraudulent charges.

Debit cards are covered by a different law, the Electronic Funds Transfer Act. Under the EFTA, consumers have no liability for unauthorized access when the card (or “access device”) was not lost or stolen.

I am not implying that card issuers would try to hold consumers liable for fraudulent transactions as the result of a data breach. But cardholders who do run into any problems as the result of one should realize that federal law is on their side.