You generally share your bank account number with a small number of trusted parties: employer, landlord, creditors, utilities, tax man, etc. Exposure is low. When you start swiping a debit card around town, you hand out the same level of access to every merchant you buy anything from, and whomever might be skimming their terminals or stealing their databases.
Credit card fraud adds to your balance, but you don't have to pay it while the investigation is ongoing. Typically they revoke your card number and mail you a new one. During that time, you live off of a different credit card your debit card. Critical payments go straight to your bank account and are unaffected. When the investigation is over, the charges disappear. At no point are you deprived of actual money, you merely have an inflated short-term debt.
Good point about a check bouncing though. I would think your bank should waive any charges (after all, you weren't defrauded nor did you write a bad check), but the recipient might complain about their bank's fee (for essentially a rejected ACH transaction, but I digress). Although speaking of checks, readily handing out a printed withdrawal key seems like a poor idea if your goal is avoiding surprises!
Every second website I buy stuff at has my IBAN.
Looks like it's a vety different situation here in Europe.
Sadly, too many US websites don't allow this, I ended up having to get a CC (and pay for it!) just to deal with US bullshit websites demanding a CC. That CC cost me more in fees than I've ever kost in debit transactions.
So once you assume whatever you use will get stolen, you determine what dealing with a stolen card number will be like. With debit cards it's your own cash locked up in a transaction dispute. With credit cards its the credit card companies credit balance and you have no money locked up.
Assuming you can stomach $50 in the case that you do drop the ball notifying the issuer upon realizing your physical card was physically lost, how do the rules differ appreciably?
Also, how does not having a debit card significantly alter the exposure of a given deposit account (eg through the ACH network), besides just having one fewer network address? It seems like the better option is to get a feed of transactions in a convenient manner, whether tablet notifications or an ofx feed.
(Not that I don't want to stick it to the banks as hard as possible for perpetuating this negligent payment network and tricking customers with terms like "identity theft", but just pragmatically speaking)