If you pay before you choose to purchase gas with a card and select "pay outside," officials suggest you tap with a chip card instead of inserting a visa or debit card to prevent theft from card skimmers who install devices on gas station pumps.
Photo exmaple of a scam text asking for banking information.
Elena Herrada, 67, of Detroit looks through paperwork and holds a police report she filed in June on Thursday, Oct. 24, 2024. Herrada lives on a small pension and her Social Security check each month. But she couldn't buy a cup of coffee when her debit card was declined. The money should have been there, she said but it wasn't. She soon discovered that money was withdrawn from her account at Michigan First Credit Union and she wasn't able to get the credit union to reimburse her.

It's not your run-of-the-mill scam — if there is even such a thing anymore. It starts out with a fake text, just like many scams do these days, but surprisingly morphs further into crooks even showing up at your door.

Sophisticated crime rings engineered yet another way to turn stolen mail or packages into cold cash.

Here's how it works: You get a call or text from someone who is impersonating your bank. You're told you must act quickly because your account has been or is about to be compromised. But then these crooks take things one step further.

Here's the oh-my-gosh-they're-doing-what twist: They're ready to pounce — sometimes after hiring accomplices — to attempt to steal mail that contains new replacement debit cards being sent by the bank to a customer's home.

Once they intercept the new debit card, the crooks plan to use those debit cards to further drain bank accounts.

Crooks aren't just out to steal paper checks; they're figuring out ways to steal debit cards from the mail, too, as a way to get your money.

How a new debit card scam went down in metro Detroit

An elaborately engineered debit card scam hit several consumers throughout metro Detroit this year, according to police, including some customers at Chase Bank.

On Sept. 21, Troy police officers arrested David Andrew Williams, 30, of Chicago, in connection with what police called "a complex identity theft and financial fraud scheme targeting residents across the metro Detroit area."

According to Troy police, the investigation began after a UPS delivery driver had been approached by a man attempting to intercept a package. A surveillance effort was put into place at the address where the package was to be delivered.

The bank's customer was contacted and the package with the new debit card later was delivered by the UPS driver, according to Troy police. Police observed a man approaching the porch and attempting to steal the package.

Williams was charged with identity theft, as well as two counts of stealing and retaining a "financial transaction device without consent," and driving without an operator’s license on him.

Williams pleaded not guilty during a recent hearing. The court system did not include contact information for his court-appointed attorney.

Crooks use various tactics to be able to use the new replacement cards to withdraw money from bank accounts.

In some cases, consumer watchdogs indicate the fraud victims might have disclosed some information to the criminals through the spoofed texts or the criminals already had some account information on hand. Chase Bank declined to comment on the fraud when asked about the scheme by the Detroit Free Press, part of the USA TODAY Network.

Crooks also engage in card skimming. Crooks are able to harvest data, including your PIN number, when you make a purchase at a compromised point-of-sale terminal at a gas station or grocery store or withdraw money at an ATM.

Check fraud and debit card fraud both saw an uptick

We've heard much about the risks of check fraud, as the federal government moved toward a Sept. 30 deadline to stop to issuing paper checks for benefits issued by Veterans Affairs and Social Security and federal income tax refunds to the extent permitted by law.

Check fraud is on the rise, with a significant portion being fueled by mail theft, according to the FBI and the United States Postal Inspection Service. In many cases, compromised checks can clear and the money can be withdrawn by bad actors before the fraud is detected, according to an alert issued in January.

More than 1 in 5 adults have or know someone who has experienced check fraud, even though two-thirds rarely or never use paper checks, according to polling conducted by Morning Consult in June for the Independent Community Bankers of America.

Yet it's important to be aware of increasingly complex fraud involving debit cards, including mail theft.

Debit cards ranked as the top payment method for both attempted fraud and actual dollar losses in 2024, with 73% of financial institutions surveyed by the Federal Reserve Financial Services saying they experienced such attempts.

Forgery, counterfeits, stolen mail and impersonating authorized parties were highlighted as primary drivers of fraud involving debit cards and checks.

In September, the Manhattan district attorney seized 12 domain names that were involved with selling stolen debit card and credit information and personal identifying information on the dark web. The ongoing investigation indicated that the vendors had information from more than 1 million cards stolen from people across the United States.

Unfortunately, bank customers aren't always reimbursed when they're hit by some scams, including when they're deceived into making a payment to a con artist, such as in a romance scam. It's best to notify your bank immediately when a scam takes place, including when a debit card is lost or stolen to limit your liability.

Under federal law, consumer protections exist that can limit what you have to pay if your ATM or debit cards are lost or stolen.

Victims have the unauthorized use and error resolution protections of the Electronic Fund Transfer Act for lost and stolen debit cards.

"The amount that a consumer may be on the hook for depends on when the consumer discovers the stolen debit card and reports it," said Carla Sanchez-Adams, staff attorney at the National Consumer Law Center.

If a consumer doesn't discover a problem until a charge was made, she said, the consumer must notify the bank of the theft of the card within two business days to keep their liability for any future charges at $50. They will not be liable for the initial fraud charge.

"The rationale there is that a victim is never on the hook for the very first unauthorized charge, only the subsequent charges that could have been prevented by the bank canceling the card if they had been timely notified by the consumer," she said.

We're also warned about a scam to steal chips on a card

Consumers, though, increasingly must realize that con artists are often impersonating banks, government agencies and others in authority. The scams are odd — but fraudsters can sound incredibly convincing.

The FBI issued one of the more bizarre alerts a year ago.

Like other well-known schemes, crooks start out impersonating a bank employee who asks about recent transactions on a customer's account.

The consumer is led to believe there is a fraudulent activity involving their account — and they're tricked with working with a scammer to fix a fake problem. The call seems legitimate when it's not.

Bank customers are then advised to destroy their bank card — but they're told to leave the small computer chip on the front of the card intact for so-called security reasons. The chip is designed to make it harder to produce counterfeit plastic.

Now, scammers are out to steal the chips.

Crooks tell the unsuspecting customer that the chip must be returned to the bank.

"Next, the impersonator arranges for an accomplice, also allegedly 'from the bank,' to pick up the bank card (with chip intact) from the customer's residence," according to the FBI alert.

If the impersonators do not currently have the customer's PIN, the accomplice or impersonator will use social engineering techniques to obtain this from the customer.

"With the chip and PIN, the impersonators can steal funds from the bank customer's account," the FBI alert stated.

The FBI said it is unknown how the impersonators are obtaining personal information, such as name, address and bank account information. The FBI requests that fraudulent or suspicious activities be reported to the FBI Internet Crime Complaint Center at www.ic3.gov as quickly as possible.

An important scam alert: The FBI's IC3 "will never directly contact you for information or money." Yes, con artists are impersonating the FBI's central hub for reporting cyber-enabled crime, too.

Fraud losses can exceed loan losses for some banks

"We're seeing a lot of creativity on the part of fraudsters," said Scott Anchin, senior vice president of strategic initiatives and policy for the Independent Community Bankers of America.

At some community banks, fraud losses now exceed losses from loans, Anchin said, noting that bankers have indicated that debit cards and checks are often the payment methods most susceptible to fraud.

Many times, he said, community banks can control credit risks associated with making loans but face less control when it comes to ever-evolving fraudulent schemes.

"Mail theft has become one of the top fraud vectors," Anchin told the Detroit Free Press.

The Independent Community Bankers of America — which represents community banks with nearly 45,000 locations nationwide — has worked with the U.S. Postal Inspection Service to develop an in-branch handout to start conversations with customers about check fraud. These handouts have been shipped to more than 800 community banks across the country. Michigan has 89 community banks operating in the state with 734 branches; 78 of those banks are headquartered in Michigan.

While alerting customers to fraud online is important, Anchin said, it's also essential to have conversations with customers about how they can protect themselves. As artificial intelligence grows, he warned, schemes could become even more sophisticated in the future.

Michigan banker Michael J. Burke Jr. said education on the front end is necessary to help consumers, both young and old, avoid getting tripped up by some very convincing bad actors.

Many times, con artists will pitch the story that they believe will get you to act quickly — a fake job offer, phony programs to forgive student loan debt, a text demanding that you pay a small toll to avoid bigger penalties, a warning that your Netflix account has been compromised.

"All it takes is a weak moment where maybe they were having problems with their Netflix by chance, totally by chance," said Burke, who is president of ChoiceOne Bank, an independent Michigan-based bank with 56 locations in the state.

Burke said fraudsters don't know you have Netflix when they send out the texts, they just hope you do — much like when they impersonate bank employees of a financial institution. It's already very easy for con artists to spoof a phone number to make it look like a call is coming from your bank.

"They'll flood our market. They don't know anyone has a ChoiceOne account. That's not public information. But they hope you do," he said.

The more legitimate the text or call seems, the more vulnerable the consumer is to clicking on a link or responding in some way.

He noted that his bank saw a really bad rash of toll road scams at one point this year.

Sometimes, people think they did drive through Chicago or another area with toll roads and do owe money. But the texts aren't real. If you click and pay a $7 or so, you give scammers more room to use your banking information to drain your bank account.

"What's happened is, now they have their debit card, right?" Burke said. "And then they go out and use it until the person cancels it."

The customer has to notify the bank right away after paying fake tolls to limit their losses, he said.

The American Bankers Association — which ran a "Banks Never Ask That" campaign, notes: "Banks will not ask you for account passwords, PIN, one-time text codes, or other sensitive information when calling you."

The five warning signs of a scam listed: Con artists ask you to open a link. They send an attachment. They request personal info like PINs, passwords or Social Security numbers. They pressure you to log into or send money with payment apps. They ask you to keep it a secret.

Unfortunately, consumers are living in a world where we now must be extremely skeptical of every email, text and phone call.

Anchin's top tip to consumers: Anytime you're contacted by someone claiming to be from a financial institution, do not engage in a conversation immediately. Instead, hang up and dial the phone number that's listed on your bank card or your bank statement to discuss any issues. Or visit a bank branch in person to ask about a concern.

No one is being rude by not talking to someone who calls out of the blue, he said. Instead, the customer is being prudent when taking an extra step to call on their own or visit a bank branch to make sure that they're not talking with an imposter who is eager to drain your savings.

Contact personal finance columnist Susan Tompor: stompor@freepress.com. Follow her on X @tompor.

This article originally appeared on Detroit Free Press: Debit and ATM card scam involves fake texts and porch piracy. How to protect yourself.

Reporting by Susan Tompor, Detroit Free Press / Detroit Free Press

USA TODAY Network via Reuters Connect