HSBC Sends Activated Debit Cards Through Mail

You know the drill: When a new ATM or debit card arrives in the mail, you must activate it before using it. It protects you. It protects the bank.

HSBC Bank often doesn't follow this fundamental security procedure: Some of their debit and ATM cards arrive in your mailbox already activated.

Since these debit cards draw money directly from your checking account, HSBC's carelessness puts all of the money in your account at risk. Should fraud occur, you may not see your stolen funds again for weeks.

This is a long-standing practice at HSBC, according to one report. When Knowzy confronted HSBC, they wouldn't commit to fixing the issue.

What is the risk to you as an HSBC customer and how do you protect yourself from it? Are banks even allowed to send out cards pre-activated? What does HSBC have to say for itself?

Find all this and more in Knowzy's "HSBC Bank Sends Pre-Activated ATM/Debit Cards in Mail."

An Overview of HSBC's Security Weakness

Knowzy has found two HSBC divisions sending pre-activated debit and ATM cards through the mail. A news item from 2004 makes the same claim, suggesting this issue is long-standing and widespread at HSBC Bank.

While credit card users are protected from fraudulent transactions, debit card users are not, at least in the short term.

While no one Knowzy talked to could point to regulations prohibiting banks from sending activated debit cards in the mail, all agreed the practice is ill advised.

The trade industry group UK Payments Administration (formerly APACS) apparently scolded HSBC for this brazen security breach in 2004. Six years later, the practice is still occurring.

While HSBC listened intently to Knowzy's report of this issue, they wouldn't address it directly for the record. They only offered vague statements, like HSBC "takes account security very seriously" and "if a customer feels that their card information may have been compromised, they should immediately call the phone number" on the back of the card.

They made no commitment to fix the issue. Given that and their reported long history of sending out activated cards in the mail, there's little reason to believe they intend to fix the issue.

As a Debit Card, You Pay for Fraud

A bank that sends an activated credit card in the mail puts their money at risk. A bank that sends out an activated debit card in the mail puts your money at risk. Since all the funds in your checking account are at stake, this security breach is a big deal.

When fraudulent charges appear on a credit card, you simply dispute them and your bank reverses them; the money never comes out of your pocket. On a debit card, fraudulent charges immediately come out of your checking account; the bank replaces the money weeks later.

Banks are obligated to replace money stolen through fraudulent debit or ATM transactions in two weeks. In reality, it may take even longer.

In reviewing the ARCO Debit card, Knowzy's reviewer was stung by a card skimmer. Criminals stole $500 from his checking account. It took Bank of America over three weeks to return the money.

If a criminal cleaned out your checking account, you may have a tough time paying your bills while you're waiting for you bank to reimburse you. This is the danger of debit cards in general; a danger that HSBC exacerbates by sending activated debit cards in the mail.

What HSBC Says About It

Knowzy first encountered HSBC sending pre-activated debit cards in the mail when reviewing the ARCO Debit card, issued by HSBC's OptiPay division. After experiencing fraud on the original card, the replacement card arrived already activated.

Kate Durham, HSBC's VP of Public Affairs, listened carefully but didn't address the issue directly for the record, saying only:

That advice will be little comfort to a customer whose checking account was just cleaned out through no fault of his or her own.

Suspecting this problem went beyond the OptiPay division, Knowzy signed up for a checking account with HSBC. Without activating the debit/ATM card, Knowzy went on a weeklong spending spree that included two trips to the ATM.

Durham forwarded Knowzy's second inquiry to Juanita Gutierrez, also a VP of Public Affairs. Again, HSBC was very interested in hearing how Knowzy ran up 30 transactions on a supposedly unactivated card. Again, no commitment to fix the issue, only a vague and cryptic official response:

If you parse this obtuse statement one way, you might get the impression that HSBC is going to "target" the issue because it is certainly one of the "most relevant risks" to account security.

But considering HSBC has reportedly been sending activated cards through the mail for six years or longer, the statement implies that HSBC doesn't believe this risk is very relevant to account security.

Are Banks Allowed to Send Pre-Activated Cards in the Mail?

No one interviewed for this article could point to a law or MasterCard regulation that forbids this practice. In fact, Knowzy found plenty of evidence of banks issuing pre-activated cards, including another yet another HSBC division.

Paul Stephens, director of policy and advocacy at the Privacy Rights Clearinghouse not only agrees that this practice is likely perfectly legal but he personally knows of another debit card that arrives pre-activated (though this debit card isn't tied to a user's checking account).

Still, Stephens chides such banks for placing consumers at unnecessary risk of fraud, "which could be avoided easily through implementation of appropriate authentication procedures."

Specifics About HSBC's Debit Card Security Weakness

Knowzy opened accounts with two different divisions of HSBC. Both sent already active debit cards through the mail, though not quite in the same way.

Learn how Knowzy's reviewer stumbled across this security weakness in the ARCO Debit card review.

HSBC Checking Account: No Activation Required

It's as bad as it sounds. Sign up for an HSBC checking account online, put money in the account and days later, an activated MasterCard debit/ATM card appears in your mailbox. A few days after that, the PIN number arrives in a separate envelope.

If someone intercepts the card on its journey from HSBC's headquarters, you could find your checking account empty.

You can protect yourself by getting an ATM-only card during the signup process. This means you wouldn't be able to use your card as a MasterCard, only as an ATM card.

A PIN code is required to use the card at an ATM. You can change the number before the pre-assigned PIN arrives in the mail.

Many consumer advocates advise against using your ATM card as a credit card or "check card" anyway. The reason is the same being discussed here: Debit cards lack the protection built-in to credit cards.

OptiPay: Additional Cards Don't Require Activation

You're a bit more protected with one of HSBC's OptiPay cards. The initial card they send out does require activation before you can use it. However, additional cards, such as a card for your spouse or a replacement for a lost or stolen card, are sent already activated.

You can protect yourself by only trusting the first OptiPay card they send you. Don't order an additional card. If the card is lost or stolen, cancel the account. If the card is about to expire, cancel the account.

Or just don't get an OptiPay card at all. That way you're not always looking over your shoulder to avoid HSBC's security weakness.

Talk About It

Do you know of other companies sending out activated cards in the mail? Have you experienced fraud on a debit card? Would you like to share your dealings with HSBC- good, bad or otherwise? Do you have questions this report doesn't answer?

Share your experiences and get answers on our Credit Card Chat page. We'd love to hear from you.

Topic Guide

Personal Finance > The World of Credit > Credit Cards