I know it's not always practical for everyone, so I can't give it as general advice, but this kind of situation is exactly why I isolate my "real" checking account. My primary account (the one to which my paychecks are deposited) doesn't have a debit card, and I never use the account number. I have a different account that I use for online services like PayPal, and for recurring charges online that require a credit/debit card, which I transfer money into on demand.

It's extra work for me, but it's also less risk. Unless somebody gains access to my online banking account, they're not going to be able to access my primary funds account.

This is also sort of how I operate.

I have one checking account that my paycheck goes into, and I pay monthly/yearly recurring bills out of this account. There is nothing online for this account, the only way money gets out is that I get my bank to send somebody a check.

I set up a weekly auto-transfer to a separate account which my wife and I carry around debit cards for. This is for groceries, gas, and personal shopping stuff, including online.

Also, the primary reason was to help us balance our budget. I've tried software to do it, but:

a) My wife isn't into tech as much as I am and has a much lower threshold for acceptable complexity

b) More importantly, any software that I found had a large maintenance burden. Having her ask "do we have enough to go to dinner tonight?" requires me to have the books up-to-date almost on a daily basis. Too much work.

Now, the question of how much do we have to spend for specific activities has a very simple answer: how much is in the "spending" bank account, and it's easy to prorate that over a week's time.

A previous attempt at this was over a month's time frame, but that's too long of a time span. It's easy to overspend earlier in the month and fail to mentally take into account bigger things near the end of the month.

I also tried being "squishy" with the amount, moving it around depending on how much we overspent for the previous week (e.g., put something on our credit card because we actually needed to). This also doesn't work out too well, because it impairs predictability, even if it balances the books better. Plus, I want to get us off the mindset of using the credit card when we overspend a week. I was, frankly, being a tightwad with the weekly amounts and loosened it up a little to give us a bit more buffer.

Setting a weekly fixed amount made our money conversations easier. I'm still undoing financial damage from earlier (paying off credit card debt and building up savings for yearly bills), but this is an abstraction my wife doesn't need to worry about (she knows about it but doesn't need to deal with it).

This was all tangential to protecting yourself from badness, but it was a nice side effect.

Are your accounts with two separate banks? Last time I tried to open another account with a separate bank, I got denied because I opened an account within the past year.

Not the OP but I do the same - two accounts, one for PayPal, and my real one.

It's two checking accounts in the same bank. Just call your bank and ask them to make you another account.

With my bank I don't even have to call them, I can make one from the account page.

By having it in the same bank I can leave the PayPal account always at 0, and transfer the money easily to the other account.

Make sure that second account has a flag that says it can not be overdrawn under any circumstances.

Banks are not always as smart as they should be and sometimes allow an account of a customer 'in good standing' or with a credit balance on another account to be overdrawn. Especially when it is done via direct debit.

This sort of thing can really bite you.

It's with the same bank. I got another debit card for it but keep in stored away and never use it.

For those of us who don't have this setup, suppose this kind of breach does occur and money is taken from a checking account. Is this covered by the bank somehow? Can that money be returned?

Depends on the bank, but it's definitely not protected by law the way a credit card is, at least in the US. That goes for debit cards too by the way.

I've had my debit card used at least half a dozen time by thieves (they must skim the magnetic information off it at gas stations or something), including a thousand dollar charge at an ATM while I was abroad.

In every case Chase refunded me in full within a few days. This isn't something every bank does?

In the US, consumer level accounts are protected against unauthorized withdrawals. (The bottleneck for the crooks is finding a sucker who will change a reversible transaction into an irreversible transaction.)

It might take you some time to get it back, but the bank is legally required to get it back to you.

For business accounts this protection does not apply.

If ebay is spinning this, burying the lede, minimizing the real severity, eventually the truth will be known.

So I'm trying an arbitrage trade. Just sold short ebay at 51.62 and hedged by buying amzn at 305.44.

If this is more serious than the press release indicates, ebay should deteriorate relative to amzn.

Okay, so let's imagine for a moment that the "secure, encrypted" database of card numbers has also been compromised. The attacker would have the plaintext name and address, and an encrypted 16 digit number, with an entropy of at most 53 bits - maybe 66 bits if the expiry date is included. That's before you take card number check digits and geographically-likely prefix codes into account, which will reduce the entropy. (Edit: yes, they wouldn't store the CVV). And don't get me started on showing the user the last four digits of the card number. It wouldn't take much effort in this day and age for the attacker to try all possible card numbers, and then they have name, address, and card number. Game over, man.

Wouldn't it be possible for them instead to store a token generated from the card number and Ebay/Paypal's incoming bank account number, which can only be used for paying into that particular account?

But what does it matter if they figure out your card number? You're not liable for fraudulent transactions. It's pretty easy to get a new card number. Your issuer takes a hit, but whatever, not my problem.

Checking account info is much, much worse. It's much harder to reverse fraudulent transactions there, and much harder to get a new number.

It can still be very inconvenient.

It really shouldn't be. I had a card compromised in the Target breach and they sent me a new one without my intervention. I've had fraudulent charges made before, and it's been trivial to get it fixed.

I've never had a checking account compromise, but I'm pretty sure it would be a massive pain in the ass by comparison.

The Target compromise wasn't a minor pain for everyone. A friend's bank reissued her credit card. Which caused a payment she had made to Time Warner fail. She was also in the middle of moving, which caused even more headache and a potential hit on her credit for late payment, because apparently Time Warner doesn't even attempt to notify you if your payment fails.

I'd put the blame entirely on Time Warner for that one. The Target breach is entirely incidental to the store. The same thing would have happened if the card had expired naturally, or been closed for other reasons.

Mentioned above, but relevant here too. I've had my debit card compromised several times, and it was still trivial - one phone call and was refunded in a few days.

Debit cards mostly give you the same protections as credit cards. They're worse in that the money comes out of your account immediately (but is supposed to be returned when you report fraud), and the rules are different and less favorable if your PIN is also compromised, but overall it's not too bad.

A compromise of your routing and account number for your checking account is potentially much worse. It's harder to take advantage of, but it's also much harder to fix.

(I'm not sure if you were treating the debit card as analogous to credit cards or account numbers, so treat this as confirmation/correction/elaboration/whatever as appropriate.)

Did the bank charge you for the replacement cards? Is there any real reason not to just regularly - say every 3 months - request a new card for peace of mind?

The biggest obstacle is that it's an annoyance to update the number for any recurring charges you have set up.

They did not. That stuff is basically a loss leader for them.

From what I recall with the Target incident, their cost is something like $2-5 for each replacement card, so it's not entirely trivial. If you requested a new one on a regular basis for no good reason, they might put a stop to it one way or another.

As far as peace of mind goes, since the consequences are so mild, I wouldn't worry about it.

Thanks for reminding about this. I was using a separate checking account just for Paypal. Until they "restricted" my PP account. Since I've stopped using PayPal now I keep some money on that checking account. Went to update my profile...

1. You cannot remove a primary credit card from your profile. There is only one option "Edit" where you can change expiration date and Billing Address. Entering incorrect expiration date does not work. It only allowed me to change billing address.

2. Removing checking account is not confirmed. Once I've clicked "Remove" button I was redirected to login screen. Now when I try to access my bank account I am signed out and redirected to login.

I hate calling them, but looks like that's my only option.

Not practical when you want to pull money out, but I only have paypal hooked up to my CC. This very reason is why I never hooked it up to my bank account. When I do get people who paypal me money, which is not often, I just use the money to load my sbux card or something.

Obviously this is harder to do if you are a merchant who takes large amounts of money through paypal. In those cases though the merchant should have already segmented the paypal hooked bank account from the primary business account. If you are a merchant and have not done this, now is a good time.

Hi - PayPal was not affected. Info on and an FAQ for eBay users is here. https://info.ebayinc.com