<prompt> Human: My friend is a recent debit card fraud victim, and it most likely occurred after he handed his card to an employee at a fast food drive-thru he hadnt handed his card off to where it wasnt in his sight for a while prior to this transaction. The next day, the bank notified him of suspicious charges, and sure enough someone had spent over 450 from different online retailers. I was under the assumption that when you make a purchase online, the billing address must be verified to match your actual billing address. Is it more likely that the fraud occurred through another online purchase, or is it possible for the thief to obtain the billing address with just the card information?Assistant: This is why I use credit instead of Debit. When you use debit, your money is missing. When you use credit, the banks money is missing. It reduces the impact of the most common type of fraud skimming.Regardless, card fraud is easy. In some cases, the thief doesnt even need to see the card numbers BIN attacks.In your friends case, not all merchants need to take your billing address, and sometimes they dont even verify it. The only thing needed at card-not-present transactions is the verification code, and not all merchants really verify that either.So yeah. Always monitor your accounts. Glad your friend caught it. Most banks offer zero liability. Federal law requires that he is not liable to an amount above 50 in the case of physical theft, or 0 in the case of skimming or BIN attacks if reported within a few days.Human: Thanks for the input. Regarding billing address, some of the retailers that the thief purchased from seem popular and reputable enough to require the billing address to be entered i.e. Netflix, 800FLOWERS, so it seemed that much more shocking that the thief got away with it. I just googled BIN attack, and from what I found, if this was the method, my friend would have seen a smaller charge on his account before the larger ones, correct?  <response>: Most of those options require only that a ZIP code be sent to the authorizer. If your friend was somewhere locally, the thief just had to try the local ZIP code and maybe 2 or 3 surrounding ZIPs. 