(September 17, 2004) Debit card fraud in Canada last year amounted to $44 million ($34 million U.S.), which criminals drained from some 27,000 accounts, according to data recently compiled by Interac, the national electronic funds transfer network. The study represents the first attempt in Canada to measure fraud losses sustained by holders of debit cards secured by personal identification numbers, a type of debit that is far more popular in Canada than in the U.S. and one often touted by experts as far more secure than other forms of electronic payment. The results also throw into relief the extent to which consumers are vulnerable to so-called skimming, the criminal practice that caused all or most of the losses. In a skimming fraud, one or more criminals affix devices to ATMs and certain point-of-sale terminals, such as those at gasoline pumps, to capture account data encoded on the magnetic stripes of debit cards as consumers insert them. They also capture consumers' PINs, usually by spying on users as they enter the numbers, and use the PINs along with fake cards bearing the encoded account data to access the compromised accounts.

While the losses raise concerns among some observers because of the sense of security surrounding PINs and the fact that debit cards are linked to deposit accounts, Interac officials argue that they represent a tiny slice of all debit card transactions and debit card holders in Canada. "You're talking about fraud being a fraction of a fraction," says Sara Feldman, spokesperson for the network, which gathered the fraud statistics from its 103 member issuers, a roster that includes the major financial institutions in Canada. "People have a high degree of confidence [in the PIN debit system] and rightfully so." Feldman says the network intends to repeat the fraud study annually. There are 35 million PIN debit cards in circulation in Canada, of which 19.5 million are active, with total POS and ATM volume amounting to $226 billion ($174 billion U.S.) in 2003. All debit cards in Canada are linked to PINs; none is secured by signature.

Both Interac and the Canadian Bankers Association also point to a voluntary set of rules, called the Debit Code of Practice, that most banks abide by and that calls for the reimbursement of cardholders who have suffered fraud losses. The code, developed by the banking industry in conjunction with various government agencies, was put in place in 1992 and is overseen by the Financial Consumer Agency of Canada, a government entity. Critics of the code, however, point out that banks at times freeze accounts while investigating instances of fraud to determine whether reimbursement is warranted, causing problems for innocent accountholders. Dissatisfied consumers can appeal to their banks' ombudsmen, and ultimately to the Ombudsman for Banking Services and Investments, an independent agency sponsored by the banking and investments industry. Michael Lauber, chief executive of the OBSI, says about 17% of the investigations his office becomes involved in are related to debit card fraud. "People can get hit hard," he says. "We see people getting hit with $15,000 or $20,000 in debit card fraud."