Consumer Watch: Protect Yourself Against Credit Fraud

Illustration: Christoph Niemann
You won't find a more enthusiastic online shopper than me. Clothes, wine, kitchenware, pet food--if it's available online, I've probably bought it there. In fact, I've purchased so much stuff on the Web over the years that my UPS driver waves when he sees me on the street.

I buy most of my gifts online, too; and as we enter the home stretch of the holiday season, I'll have more company than ever. Who wouldn't prefer pointing and clicking to trudging on foot (sometimes in inclement weather) from store to store and braving long lines of fellow shoppers?

Of course, seasoned buyers occasionally encounter dubious shopping sites, and the general state of leaky security should encourage anyone to be cautious with credit cards. True, the credit card fraud rate, once as high as 0.15 percent, has been holding steady at about 0.06 percent for some years now, meaning that, for every $100 charged on credit cards, only 6 cents goes for unauthorized purchases. And if you ignore phishing e-mail and scrupulously shop at reputable sites with secure servers (look for https: at the beginning of the URL), you're far less likely to lose your credit card information online than to someone who captures the data by swiping the physical card through a skimmer. Even so, you can take these steps to make your online shopping trips safer still.

Virtual Credit Cards

What if you could complete an online purchase with a credit card that functioned solely at one store, or for the duration of one transaction? That's the benefit of virtual cards, from credit card issuers such as Citibank, Discover, and MBNA.

The virtual card service for MBNA (my MasterCard issuer) is called ShopSafe, and it's available free to anyone who signs up for MBNA's Net Access service for tracking and paying MBNA credit-card bills online. You can use ShopSafe either through your browser or with free downloadable desktop software. When creating a virtual card, you specify how long it should remain good (choices range from 2 to 12 months) and a spending limit (you can change this later on). Then the service generates a card number, along with an expiration date based on your request and a CVC2 number (a number printed on the card that some sites ask for as an additional fraud prevention measure).

Now you can use that information to pay any merchant site that accepts the underlying credit card (in this case, MasterCard). The charges show up on your regular bill. You can create as many cards as you want (but you can use each one at just a single merchant site). The software helps you keep track of your various virtual cards and the transactions you've used them for. Of course, you can't use virtual cards in the real world (to rent a car or pick up movie tickets, say). But they do minimize exposure of your account information online.

Pay by E-Pay

A newer option available at some online merchants relies on electronic payment systems that many people already use to deal with their monthly bills. Where offered, ModaSolutions' Secure-eBill typically appears alongside credit cards or PayPal as a payment option. If you choose it, you get an invoice in your e-mail from the merchant; if you're a first-time customer, you must set up that merchant as a payee with your bank or electronic bill-paying service. After making the required payment, you should receive e-mail confirmation that your payment has reached the merchant. Merchants never get your bank information; ModaSolutions simply notifies them that a payment has been posted to their account in your name.

The disadvantages: You might have to wait a few days for the payment to be processed, and you might set up a lot of payees that you'll never revisit. Also, because the payment is a direct debit from your bank account, you won't have any chargeback recourse if the purchase is unsatisfactory for some reason.

The PayPal Option

Perhaps the best-known credit card alternative is PayPal, which eBay owns. To make payments via PayPal, you must provide the service with a source of funds--either your bank account or a credit card. But you don't provide that account data directly to a seller; instead, you instruct PayPal to transfer your payment to the seller's account. PayPal identifies you to the payment recipient by your e-mail address only. Though most big commercial sites don't accept PayPal, a growing number of smaller merchants do.

PayPal, too, has its downside. Like credit cards, it promises complete refunds for transactions by people who spoof your identity. But its protections against unethical merchants are far less extensive. It covers payments of up to $1000 for qualified eBay purchases that go sour (you don't get the item, or it's "significantly not as described"). But "qualified" here means that the seller meets certain requirements (including 98 percent or better positive feedback) and that the item is tangible and physical (as opposed to a service or software). For non-eBay transactions, even if PayPal finds your claim valid, PayPal will get you a refund only if the seller's PayPal account has enough money to cover the claim.

If you use a credit card to fund your PayPal account, you might be able to recover your money via a chargeback through the credit card company. But because PayPal is on the hook for the entire amount, it expects you to exhaust its dispute resolution process before turning to your credit card company, and the wait might result in your missing your credit card issuer's own deadlines for redress requests.

Being a Careful Shopper

I worry more about my credit card falling victim to physical theft than to online fraud: A few years ago, someone stole my wallet and used my credit cards to charge thousands of dollars' worth of merchandise and restaurant meals. But I didn't have to pay a dime of those charges: Major credit cards have zero-liability policies for consumers whose cards are used without their authorization, regardless of where the purchases occur.

But if your credit card or credit card number gets stolen, cleaning up afterward is a big hassle. So for an additional layer of protection, look for online merchants that participate in the Verified by Visa or Verified by MasterCard programs. To shop at a participating merchant, you must enroll with your card issuer and create a user ID and password that you then enter on the merchant's site. Relatively few retailers use these two programs, though. Many more ask you to furnish the aforementioned CVC2 number printed on your card, which eliminates fraudsters who have obtained the account number but not the card itself.

Going online can help you catch fraud early. Shirley Rooker, president of Call for Action, a Bethesda, Maryland-based nonprofit coalition of radio and TV consumer help lines, recommends that you monitor your credit card activity online for unauthorized charges, which can be a sign of identity theft, a far more serious problem than credit card fraud. "Just because your credit card has been stolen does not mean you're the victim of identity theft," Rooker says. "But you have to make sure it's not something greater."

Rooker also urges people to take advantage of the federal law requiring each of the national credit reporting agencies--Equifax, Experian, and TransUnion--to provide you with a free copy of your credit report once every 12 months. These reports will show if someone has opened a credit account in your name. You can request one free report from a different agency every four months at AnnualCreditReport.com. Don't be fooled by sites with similar names that request a credit card number before providing you with a report, and then bill you for a "credit monitoring" service.

Security is on everyone's mind these days, and with good reason. But if you're careful and take a few simple steps to prevent problems, you shouldn't have anything to worry about.

Yardena Arar is a senior editor for PC World. E-mail her at consumerwatch@pcworld.com. To read previously published Consumer Watch columns, click here.

Subscribe to the The Advisor Newsletter

Comments