The following post is by Ronald Mann, a law professor at the University of Texas and expert in commercial law and electronic commerce.

Americans are worried about identity theft, if recent advertising and press coverage is any indication.  The security lapse recently disclosed by MasterCard underscores one of the risks of using payment cards, and the widespread media response underscores public fear.  But while media attention focused on credit cards, the problems of data theft and merchant fraud in the debit card context can be more serious. 

     Generally, federal law bars issuers from holding cardholders responsible for more than $50 in any series of unauthorized transactions.  While negligent debit card holders (though not credit card holders) may be liable for more than $50, Visa and MasterCard have superimposed "Zero Liability" policies that prohibit their issuers from charging cardholders even for the $50.  This means that differences in existing consumer protection laws - however wrongheaded - arguably have little practical impact when it comes to the transactions themselves.
     But those policies don’t consider the realities of fraudulent debit card transactions, where the money in your account just disappears.  Because most of us keep our balances relatively small, we usually need money returned to those accounts immediately to ensure that we have cash to make mortgage payments, pay rent, and keep our telephone and electricity service running.  Besides this, the Visa and MasterCard policies do not offer debit cardholders any protection from losses associated with fraudulent charges such as insufficient fund fees and overdraft fees.
     Elsewhere, the differences between credit and debit cards are even starker.  Consider the problem of merchant fraud or insolvency - where the cardholder makes a purchase, but the retailer does not perform.  Suppose that I purchase a ticket from United Airlines, and United goes under before the flight occurs.  If I used a credit card, I can simply refuse to pay the bill when it arrives.  Under federal law, the bank that processed United Airlines' transactions ultimately will bear the loss, not the last batch of unlucky consumers.  If I used a debit card, however, I’ll likely to bear  the entire cost of the transaction, because (under current law) this is a cash payment that cannot be recovered.  The policies that Visa and MasterCard advertise will not protect me here.  The same thing would be true if I purchased a book from an eBay store that fraudulently never showed up.
     Debit cards are clearly optimal in an economy that’s quickly becoming cashless.  As a substitute for checks, debit card payments save several dollars per transaction.  As a substitute for credit cards, they curb excessive spending patterns, which often lead  to financial distress.  But current law fails to cushion the risks they present to consumers, or even to remedy the disparity between treatment of fraud in credit and debit cards.
     Recently I have advocated the reform of payments policy to more consciously attend to the commercial realities of the underlying sales transactions and the social costs of the different payment devices.  The data theft incident highlights one area in which there is a mismatch between law and practice.