T-Mobile Credit Punishment Contradicts Expert Advice On Preventing Financial Harm From Data Breaches

According to the Michigan State Attorney General's Office consumer protections division,

"If you have the option to choose between using a credit or debit card for online purchases, most experts recommend using a credit card. While the risk of fraud is always present, credit cards have additional protections that debit cards do not.

Most credit cards come with zero-fraud liability.
Using a credit card provides an extra layer of protection against fraud and makes getting a refund easier.  Certain protections are extended to both debit and credit card transactions under federal law, but most credit cards take these protections a step further by offering their own form of zero-fraud liability.

If someone gets your credit card number and makes a purchase online, chances are good you won’t be held liable for a single cent of it, if you report it in a timely manner.  However, the same can’t be said about purchases made with debit cards.

Federal protections are greater for purchases made on credit.
Thanks to the Fair Credit Billing Act, liability for unauthorized charges made with a credit card is limited to $50 for both in-person and online credit transactions, but you need to report the incident within 60 days.

However, as noted above, most credit cards offer zero-fraud liability, meaning you won’t be on the hook for a penny.  Most credit card issuers will put the fraudulent charge on hold while they conduct an investigation, so you won’t be out the money in the interim.

Debit cards are a different story.  Because the money you spend comes out of your bank account, your liability depends on how quickly the fraudulent charges are reported.  If reported within two business days, your maximum loss will be $50; more than two business days but less than 60 calendar days, your maximum loss will be $500; and after 60 calendar days, your liability will be 100% of the loss, possibly more if money in other accounts are linked to your debit account.

When you do report fraud you may have to wait days or weeks to get a refund for a fraudulent transaction made with your card, even if your bank account was drained.