Sure was an awkward call with the USAA security department after they worked out the exact timeline and actions of the attack. They didn't really have much to say in their own defense. Cost them about five grand in the end. The really annoying part is that now if my wife needs to call them for anything on the phone they make her jump through many hoops to identify herself. E.g. she has to answer the credit bureau-based questions every time, plus a PIN, plus a phone password. We may move banks just so we're not stuck with an online-only relationship because of this experience.
Paycheck to cards not attached does not matter, ACH transfers can still be done much easier vs a EMV/Stripe read of a debit card.
So all you are doing is amplifying your risk without any reward.
Only using it on gas & groceries, will average 16 points per dollar (approx 12-16%) when we reach $15,000 spent total.
The new deal is similarly structured but horrible in comparison, “shop small” is the category so it’s not realistic to max out the bonus spend without overspending.
There are some edge cases where one might overdraft more (delayed transactions IIRC), but again no fees.
I use a debit card for groceries and such. However, just to be sure, my paycheck goes to an account with no cards attached. I then transfer small amounts ($100 or so) every now and then to the debit card account.
This limits my exposure to card fraud, and also has the nice side benefit of giving me back some of that "spending feeling" that cash has. If I have to transfer say three days in a row it's noticeable and I can think about what I've spent it on, and maybe slow down a bit if I know I'm running low.