The Diabolical Duplicate Debit Debacle

This column was written by Evan Schuman.

In all cases, the retailers thought initial debit card swipes didn't work and asked the customer to try again, sometimes twice more. And in both cases, the banks removed money from the consumer's bank account equivalent to two and three times the price of the product.

With the recession dragging on, many consumers are shifting credit purchases to debit cards, in an attempt to avoid high interest payments. And retailers, who pay much lower fees with debit and therefore make more profit when a customer debits, are only too happy to encourage the change. But as near the midpoint for 2009, there are some serious reasons consumers should think repeatedly (twice just won't cut it) about leaving their debit card in their wallets.

The most frightening part about debit card transactions today is that they subject consumers to a payment double whammy. First, there's a much greater chance of a glitch with a debit card than with a credit credit, although both payment sorts work just fine the overwhelming majority of the time. Secondly, when it does glitch, it can deliver dramatically more damage, potentially cleaning out a customer's bank account and causing them to unknowingly bounce checks to everyone they're trying to pay. Few retail glitches have the potential to get a loyal customer in trouble with the police, but debit card glitches have that distinction.

Much of this has little to do with technology and involves the very nature of the two payment methods. If there is a multiple charge with a credit card, it will often be detected and a credit can be issued. The consumer may never be aware of it until the bill arrives. If the error is still on the bill, the consumer can call and the bank can issue a temporary credit while checking it all out. For the consumer, little or no pain.

But a debit card goes directly into the bank account and takes out the money. By reducing the balance (or even wiping it all out), lots of legitimately written checks start to bounce. That's when the angry phonecalls can start. Few banks will temporarily give the customer money while the matter is being investigated.
How frightening is it that the transaction type that can inflict the most damage has the weakest safeguards? How weak, in fact, are those protections? Andy Orrock is a payment consultant who works with some of the largest retail chains and he details the huge number of points where a debit transaction has to visit, arguing that an error in any of those points can cause a double- or triple charge.

"Everything has to go perfectly on a PIN debit in order for it to work and all the actors have to do their job correctly, from the issuer to the acquirer and any stations in the middle," Orrock said. "You've got gateways and a regional debit processor. So, for a transaction to go from Best Buy, there were most probably four institutions involved, the acquirer, the acquirer's gateway, the regional debit network and the issuer. All the message exchanges have to happen properly."

From the consumer's perspective, what typically happens is that the shopper presents a debit card and it's swiped. The cashier will say that it seemed to not go through and will ask the customer to swipe the card again. If it still doesn't work, sometimes the cashier might for a third try.
Behind the scenes, that first swipe might have worked perfectly and the error code was itself an error. This is especially possible when there are a lot of transactions happening (think Macy's in late December) and the response from authorization systems is slowed down. When this happens, it's best to call your bank right away to check on what is being charged.

In the Macy's incident, the retailer initially said outside contractors were to blame. At least that was what Macy's CEO Terry Lundgren told me when I caught up with him at a tradeshow dinner party shortly after the incident. He put the blame squarely on one of the chain's outside payment processors. With a few days, though, Macy's stepped back from that and said it turned out to be a glitch with the chain's own software.

It's not clear how many customers were impacted by the Best Buy debit situation, but one Mississippi man provided documentation of a $300 microwave oven that was charged three times, wiping out his bank account and causing quite a few bounced checks and related problems. Best Buy has acknowledged "errors" that caused Jackson, MS, resident Myreon Williams' checking account to slip nearly $1,000 in the red, said Best Buy Spokesperson Jill Nezworski, but the retailer has been unwilling to provide specific details explaining why its payment system allowed the triple charges to take place.

When Williams' debit card was first swiped, the system said he'd exceeded his daily limit but the transaction was apparently approved anyway. The message, which was unrecognized by the cashier, seemed to be little more than an FYI note. One problem was that no receipt was printed, which is what prompted the cashier to conclude the mysterious message meant the transaction had been rejected. According to the customer's bank statement, that transaction was sufficiently accepted so that the bank account was debited.

Williams was then asked to re-enter his PIN and to re-swipe his card. The POS then spit out a piece of paper which the cashier kept, Williams said, and the cashier wouldn't let Williams see what it said. He said the cashier told him he needed to call for authorization. Apparently getting the authorization, the cashier asked Williams to swipe the card a third time, according to Williams, who said he was then given a receipt and allowed to leave with the microwave. The next day, Williams logged onto his online banking page and was shocked to see three charges from Best Buy for $299.59-the exact price of the microwave oven-plus a charge of $300 listed as "931240 POS PRE AUTH CREDIT CARD MERCHANT UNKNOWN US."

Orrock said he could envision several explanations for Williams' experience, and most of those explanations "have to do with error codes being properly translated." Perhaps the acquirer might have received a code from a system in the middle saying the transaction was taking too long and timed out. He said the message that Williams exceeded his daily limit, an unusual message for a POS to see, could have been caused by a mistranslation of the 'response code' as the message is passed back from institution to institution."

Banks have systems that are supposed to look for and prevent these exact duplicate charge problems, but those systems are only as effective as the data they are allowed to access. Many retailers do not check the exact product number, which creates an opportunity for multiple charges.

This is not to say that debit cards should be shunned. (But if you ever receive one of the new so-called contactless payment debit cards-the ones that you can waive instead of swipe, called PayPass by MasterCard and PayWave by Visa-take 'em back to the back for a nice old-fashioned card. Having a card that constantly beams my payment specs to whoever is walking by is not my idea of a secure financial future.) As I said before I interrupted myself, this is not to say that debit cards should be shunned. But if the store associate/cashier asks you to reswipe your debit, it might not be a bad idea to excuse yourself and call your bank first to see if the charge had indeed been accepted. No sense in letting a debit card turn you into an inadvertent debtor.

This column was written by Evan Schuman, the editor of StorefrontBacktalk.com, a site that tracks retail technology, e-Commerce and security issues. He can be reached by e-mail and on Twitter. The Retail Realities column appears every Friday.

By Evan Schuman
Special to CBSNews.com