Help! A Pickpocket Used My A.T.M. Card, and Citi Won't Cover It.

New York Times

17-07-2025

Arriving at the Barcelona airport last Sept. 18, I tried to buy a transit card using my Citi business debit Mastercard, keying in my PIN on the machine. But the purchase did not go through, so I used cash. When I arrived at my accommodations, I realized my wallet was missing. So I logged on to my credit card accounts and reported those cards stolen and several recent purchases as fraudulent. That money was eventually refunded. I called Citi to cancel my debit card, alerting the representative that the thief had made two A.T.M. withdrawals of the equivalent of $586.40 each. Citi canceled the card and temporarily credited my account, but the withdrawals later reappeared. In a letter posted to my account, Citi claimed they were valid because 'there was no cash discrepancy for that location on the date in question.' I called Citi multiple times to clear things up, to no avail. Can you help? Michelle, Berkeley, Calif.
It's pretty clear from the documentation you sent along that Citi incorrectly categorized your complaint as a cash-dispensing error rather than a stolen card.
Alas, the A.T.M. in question seemed to dispense cash perfectly for the pickpocket on Sept. 18, so your misunderstood claim was rejected.
After I got in touch with the company, Citi opened an appeal on your case and reversed its decision. You have now been reimbursed $1,172.80.
'We understand how upsetting it is to be the victim of fraud,' said Colin Wright, a Citi spokesman, in an email. 'We have resolved this matter with our client and are using this experience to strengthen how we handle similar cases going forward.'
In what is an ongoing theme in 21st-century life, some human being in some call center somewhere screwed something up. And it's quite frustrating that even after what you say were multiple calls, it took my intervention to correct the error.
There are three broader issues here.
First of all, not all cards are protected equally. Mastercard indeed promises 'zero liability protection' from fraud — but not for corporate cards and certain other categories of business cards. It's also worth noting that in general, prepaid cards often have the weakest protections. Yours was a small-business card, so it was covered.
Second, even a promise of 'zero liability,' a phrase Visa also uses, is not quite zero. You may still be responsible in some cases — say, if your nephew swipes your credit card off the kitchen counter and uses it to order pizza.
Issuers typically require you to exercise a minimum of caution with your physical card, your PIN and your online accounts.
For example, as American Express puts it: 'If you have taken reasonable care to protect your account details, PIN and biometric authentication such as fingerprint, facial and iris recognition, you will not be held responsible for any fraudulent charges.'
Though perhaps you should have been more careful that no one was looking over your shoulder when typing in your PIN in the airport, card companies don't often press that issue. But in past Tripped Up cases, we've seen travelers held accountable for things like not checking to make sure a taxi driver in Paris charged the correct amount.
Although your case went awry, let's step back for a moment to think about how amazing it is that so much protection exists. Anyone who remembers the days when the primary defense against credit card fraud involved a merchant comparing a purchaser's signature with the one on the card should be thankful, even if that means you occasionally have to respond to a text message from your bank after a transaction.
Which brings us to the third issue: what travelers can do to avoid all this hassle in the first place. First, set your alerts so that you get one every time your card is used. Yes, those notifications buzzing in your pocket are a pain, and yes, every time I tap to ride the New York City subway, I check to see if a friend has sent me a vital message or hilarious meme, only to be disappointed when it's just Capital One saying I spent $2.90.
But it's worth it. You need to report fraud within a certain period — it varies depending on the card and type of transaction — so if you wait to comb through a monthly statement, that may be too late. You should also check your credit card apps or websites every few days for fraudulent transactions. It also can't hurt to check what exchange rate you're getting as well.
And when you pay, you should always confirm the total on the payment screen and ask for a receipt, saving those scraps of paper (or emails) at least until your trip is over or you've checked your accounts.
You should also be sure to activate two-step verification, which usually means receiving a code on your phone to confirm you are you, on all your accounts and that when you use public computers for anything personal, you log out fully.
A.T.M. withdrawals call for special precautions. Stick to machines at reputable banks, and avoid any janky-looking devices in convenience stores. I speak from experience here, having battled my bank for months to convince them someone had skimmed my card information and withdrawn over $500.
But again, protections can be surprisingly robust, as long as you do your part and don't get unlucky (as Michelle did). It even turns out that 'in some instances' American Express covers fraudulent card use by family members, as long as the cardholder provides a declaration, an affidavit, and/or a copy of an official police report.' Don't give those sneaky nephews any ideas.
If you need advice about a best-laid travel plan that went awry, send an email to [e-mail].
Follow New York Times Travel on Instagram and sign up for our Travel Dispatch newsletter to get expert tips on traveling smarter and inspiration for your next vacation. Dreaming up a future getaway or just armchair traveling? Check out our 52 Places to Go in 2025.