[bcrescimanno]

That fear isn't irrational at all (at least, it wasn't). About 20 years ago, I had a debit card number stolen and my account was cleared out. It took about a month to get resolved an, in that time, I had some very unpleasant conversations with quite a few people including my landlord about my inability to pay my bills. In the grand scheme, I suppose it didn't harm me--but it was an extremely unpleasant situation to deal with.

Since then, I've only used a debit card very sparingly and usually more as an ATM card in the event I need cash.

[njarboe]

If you want only an ATM card and not a debit card, you might be able to get one. Banks don't advertise it, but I got an ATM only card from Bank of America.

[travisporter]

I don’t understand the difference and Google doesn’t help.

[erikig]

ATM cards only allow you to withdraw cash at a PLUS ATM - https://en.wikipedia.org/wiki/Plus_(interbank_network) , but they don't allow you to make purchases via the MasterCard/VISA interchange network.

[supertrope]

An ATM only card lacks the Visa or Mastercard logo. It can only be used on interbank networks like NYCE PLUS STAR. Or maybe only at that bank’s branches. You always have to key in your PIN and there is often withdrawal limit of $500/day because a debit card and PIN is immediate cash.

[mcv]

How can someone clean out your account with just the card number? Was there no 2FA?

[bcrescimanno]

A couple of things. First, I used the phrase "debit card number" to basically mean, "they didn't have my physical card--but they did have the information to be able to use it."

Second, this happened circa 2004-2005. In the US, at the time, all card use was magnetic strip swipes. Debit cards occasionally used a pin at terminals equipped to do so; but, it wasn't a requirement and most use didn't involve the pin. As an example: a grocery store terminal at the cash register might require your pin; but, if you paid the bill at a restaurant, it would get swiped like any Visa/MC.

At the time, in an online setting, asking for additional information like CVV or using address for AVS wasn't standardized so not all merchants required anything beyond a card number and expiration date.

In that era, nearly everyone I knew had experienced a debit card or credit card stolen and used in this manner--and those with debit cards paid the extra price of actually losing our money for a time.

[crysin]

Debit cards in the US are still mostly swipe + PIN or chip. With the ATM there's daily limits of withdrawal amount but that's it. Maybe some issuers have a 2FA feature but none of the banks I've used have.

[kube-system]

Chip+PIN is 2FA. Something you have + something you know.

The issue is that you can process most debit cards through the credit network without the PIN for convenience.

[mcv]

When contactless payment was new in NL, it was possible to pay up to € 25 without PIN, which set of all sorts of alarm bells in my head. € 25 isn't much, but the idea that payments could be done without my PIN felt deeply wrong, so I disabled it. I only really started doing contactless payment when it was supported by the banking app on my phone, which always asks for PIN.

That said, PIN isn't terribly secure either; for a common 4-digit PIN, there are only 10,000 possibilities. Too many to test by hand, but trivial to automate if you have access to the algorithm. And for the first PIN cards, the data was on a trivially readable magnetic strip. So if you have the algorithm and the contents of that mag strip, it's trivial to just run through all possibilities. That algorithm was a closely guarded secret, but still, security by obscurity isn't great, so later they replaced the mag strip with a chip that doesn't spill its contents so easily.

So not all 2FA is a guarantee for good security.