Sam Altman says OpenAI will match Anthropic’s commitment to give independent evaluators employee-like access, a day after Dario Amodei asked the industry to slow down and asked Washington for a narrow antitrust waiver so competitors could coordinate. Europe has no waiver to grant, because Brussels abolished individual exemptions in 2004, and the only soft safe harbour it has since written for competitor standards covers sustainability.

OpenAI has said it will match Anthropic’s safety commitment, a day after Dario Amodei asked the industry to slow down. “I agree with Dario that we need to pace the frontier,” Sam Altman wrote, as Axios reported.

He called independent evaluators with employee-like access a great idea, said OpenAI would do the same, and promised more to share soon. Pacing had been a primary topic of discussion inside OpenAI in recent weeks, he added.

Elon Musk, who runs xAI, was briefer. “Dario is right,” he posted.

Amodei’s essay on Saturday asked frontier labs to let outside teams verify their safety work from inside their offices. Anthropic’s own version gives them desks, badges, company laptops and the right to publish what they find. It also asked Washington for something harder.

He wants a narrow waiver, so that competitors can hold safety conversations without the conversations themselves becoming the legal problem. Governments need not take part, he wrote, only permit the discussions.

Two of the largest labs have now agreed a common commitment in public, inside a day. That is the first rung of the three-step plan Amodei set out.

In Europe there would be nobody to ask.

The Commission stopped granting individual exemptions when Regulation 1/2003 took effect in 2004. Before that, companies notified their agreements to Brussels and waited. Competitors now assess their own against Article 101 and live with the answer.

What Europe has instead is a precedent. It rewrote its horizontal cooperation guidelines in 2023, expanding them from 72 pages to 167.

The new text carries a 21-page chapter on sustainability agreements, including a soft safe harbour for standards that meet six conditions. It also reworked the chapters on standardisation and on information exchange between rivals.

That is close to the machinery Amodei is asking America to build. Europe has already built it once, for a different public good.

There is no equivalent chapter for safety standards, and nobody has asked for one.

His essay does not mention Europe, and neither did Altman’s reply. The Commission’s own tech chief said last week that global rules are needed.

cyber-crime

Phone shop staffer claimed he was paid less than $4k for in his part attacks leading to combined intended losses of $600,000

A former AT&T retail worker who used his system access to hijack customers’ phone numbers for cybercriminals has been sentenced to 16 months in federal prison.

Kenneth Carter, 44, carried out the SIM swaps at a store in Portland, Oregon, , allowing the criminals to intercept authentication codes and raid victims’ bank accounts.

Court documents show that Carter worked with at least three other people in the scheme, which ran between May 2018 and November 2019, and caused nearly $600,000 in intended losses.

Co-conspirator One, described in court documents as the operation’s main “hacker,” identified victims with online bank accounts, gathered their personal data, and sent it to Carter, who could reassign their phone numbers.

Carter abused his access to AT&T’s systems to transfer victims’ phone numbers to devices controlled by the other criminals. His role was described as “instrumental to the scheme.”

Co-conspirator Two and Co-conspirator Three would walk into the store and impersonate the victim whose number they planned to SIM-swap, and Carter would reassign the number to a phone they controlled – usually a “cheap flip phone.”

Once the swap was complete, the criminals could use the flip phone to intercept SMS-based 2FA codes and password reset messages, take over the victim’s bank account, and steal funds.

The intercepted codes were relayed to Co-conspirator One, who used them to access the victims’ bank accounts.

Court documents also refer to “an unnamed family member” who held a minor role in the scheme. They were described as someone “who occasionally passed along the two-step authentication codes” to Co-conspirator One.

According to the Justice Department, three victims incurred combined intended losses of $593,963.77, and Carter admitted carrying out additional unauthorized SIM swaps.

Carter’s plea agreement [PDF] included details of three SIM swap attacks he helped execute. Only one victim suffered an actual loss: $99,528.33 transferred to a Portuguese bank account.

The conspirators attempted to transfer $247,652.74 and $246,782.70 from the other two victims, but the banks’ fraud controls blocked both transactions.

Prosecutors said Carter was paid between $1,000 and $2,000 per swap, although he maintained that he earned less than $4,000 in total.

Law enforcement raided Carter’s residence in November 2019, finding copies of the personal data provided to him to carry out the SIM swaps, including the Social Security number of the one victim whose money was successfully stolen.

AT&T terminated Carter’s employment at an unspecified date in 2019. He pleaded guilty on March 24, 2026, to conspiracy to commit wire fraud and bank fraud.

In a letter to United States District Judge Stanley Blumenfeld, Jr., Carter described his offending as “a one-off situation that truly was a mistake.”

He explained that he takes care of his mother-in-law, who spends much of her time in a hospital bed located in the family living room, and two daughters, one of whom has schizophrenia.

Carter claimed that he was “propositioned by my in-law cousin with an opportunity for me to make a little extra money for my family.”

“I was told I wouldn’t have to do anything but do my job,” he added. “So, I was under the impression that this was a harmless act. As far as I knew at the time, I was never a part of a ring, nor was this an out-of-state matter.

“My incident was isolated to just Portland, OR, and the incident occurred while I was employed by AT&T. I later learned that what I found myself a part of was criminal, and I also learned after the fact the severity of what my co-conspirators were doing with the flip phones I sold under customer accounts.”

Federal prosecutors were unmoved by Carter’s letter. In their response [PDF], US attorneys argued that Carter had not provided enough evidence to show he was unaware of the criminal activity’s scope or nature, or that he was less culpable than the “hacker” who coordinated the operation.

In addition to the 16-month sentence, Judge Blumenfeld, Jr. ordered Carter to pay $99,528 in restitution. ®

security

If you’re waiting for a sign to upgrade to a fixed version: this is it

JFrog Artifactory instances continue to get hit hard. Multiple attackers are exploiting three JFrog Artifactory bugs to gain administrative control over vulnerable instances – in some cases, just days after the vendor published a patch – and then using this illicit access to install malicious plugins and backdoors.

The three vulnerabilities are:

CVE-2026-42018 is a high-severity, improper authentication flaw that can return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled. An attacker can use this token to authenticate to the repository manager and then access sensitive resources. JFrog patched this vulnerability on August 12.

CVE-2026-42016 is a high-severity privilege-escalation bug. Artifactory doesn’t properly validate the token’s scope, and this can allow an attacker with low-privileged access to elevate privileges and perform actions that they should not be allowed to do. JFrog fixed this one on July 27.

CVE-2026-82329 is a critical authentication-bypass vulnerability that allows unauthenticated attackers with network access to obtain administrative privileges. JFrog published a patch for it on August 28.

Earlier this month, security researchers told The Register that miscreants began battering internet-exposed systems vulnerable to CVE-2026-82329 just four days after JFrog disclosed the bug. In addition to creating new administrative credentials, watchTowr’s honeypot network caught miscreants “enumerating users, groups, credential sets and federated access topologies,” said Yordan Ganchev, principal threat intelligence specialist at watchTowr.

The one thing everyone agrees upon is that attackers didn’t start exploiting any of these CVEs until after JFrog issued fixes.

In a Thursday report, Wiz security researchers “confirmed in-the-wild exploitation of all three vulnerabilities across multiple environments,” and noted that “patching velocity has been slow.”

JFrog has not responded to any of The Register’s inquiries about attacks against any of the three CVEs.

‘Patching velocity has been slow’

Six weeks after JFrog disclosed CVE-2026-42016, 59 percent of organizations remain vulnerable, and 62 percent remain vulnerable to CVE-2026-42018 after four weeks. Organizations have been quicker to remediate the critical bug, CVE-2026-82329, although 49 percent remain vulnerable two weeks after its publication, according to Wiz.

Beginning August 15 and running through September 8, Wiz spotted “multiple” attackers chaining CVE-2026-42018 and CVE-2026-42016 against self-hosted Artifactory instances to gain admin access. Many of these intruders then dropped a custom Rust backdoor to establish command-and-control (C2) capabilities. 

While the post-exploitation activity varies, Wiz reports observing attackers doing all types of mischief with their administrative access to compromised Artifactory instances, including establishing persistent admin accounts, installing Groovy plugins to achieve remote code execution on the server, executing shell commands run through the plugin to perform reconnaissance and scan for sensitive files, deliver second-stage payloads, and upload web shells.

Then, between September 1 and 8, Wiz saw “several” attackers exploiting CVE-2026-82329. These intrusions were not a “unified attack chain by a single threat actor,” but spanned multiple illicit behaviors including exfiltration of configuration details, establishing persistent admin accounts, token minting for long-lived credentials, stealing keys, attaching their own SSH keys to created users in some cases, and enumerating users, repositories, and tokens.

If you haven’t already, patch vulnerable instances

Wiz advises – and we strongly concur – upgrading to a fixed Artifactory version as soon as possible.

“Given that exploitation may be possible remotely without authentication under the default configuration, organizations should prioritize internet-accessible Artifactory instances and restrict network access to trusted users and systems where possible,” the researchers added. “Organizations should also review Artifactory authentication and administrative activity for unexpected privileged access.”

These latest exploits follow a rough few months for JFrog’s package management system, which has been under fire from both human and AI attackers.

OpenAI and JFrog revealed that OpenAI’s models broke out of their cages to hack Hugging Face by exploiting an Artifactory zero-day in July, and at Black Hat, the model provider said agents used Artifactory to build message boards and help each other access the open internet.   ®

Google may be preparing a successor to the Fitbit Charge 6, and it could bring a major software change to the fitness band. A mystery device identified as G8BL6 has appeared at the FCC with Bluetooth LE, built-in GNSS, and what appears to be a display. 9to5Google believes the device could run Wear OS and says it would make sense as a successor to the Charge line.

The Charge 6 has not been refreshed since 2023. Google also showed an unidentified fitness band in Pixel 11 ads in August. The device had a tall display and looked closer to a Fitbit Charge than a Pixel Watch. Google never identified it, but the FCC device could be the same product.

Wear OS would be a major change for the Charge line

The Charge 6 already supports Google Maps, Google Wallet, YouTube Music controls, notifications, and dozens of exercise modes without running Wear OS. Moving a future Charge to Wear OS could give it access to a broader app ecosystem and deeper Google integration. It would also be unusual for a fitness band. Devices in this category generally use lighter software that requires less processing power and consumes less energy.

A full Wear OS experience would also require more capable hardware than a conventional fitness tracker. Google would likely need a modern wearable processor, more memory, and substantially more storage.

Battery life could be the difficult part

The Charge 6 is rated for up to seven days of battery life, although Google notes that features such as the always-on display can reduce that figure.

Matching that endurance with Wear OS could prove difficult in a slim fitness-band design. Google could instead develop a stripped-down version of Wear OS for this form factor and remove some of the apps, background services, and other smartwatch features that demand more hardware and power.

For now, though, that is all speculation. Both ideas depend on clues from the FCC filing and the assumption that this is the same mystery tracker Google previously showed in its advertising.

After a tumultuous week, which saw WordPress founder Matt Mullenweg ousted from his position as CEO of Automattic, WordPress.com’s parent company, by way of a board vote, the company has now issued a statement confirming that Mullenweg has returned to his position.

“Matt Mullenweg is the chairman and CEO of Automattic, with full support of the board and if you search online you can see many top executives and Automatticians supporting him as well,” a company spokesperson shared with TechCrunch via email just after 5 PM ET on Saturday evening. (The mention of online support appears to refer to supportive posts on X that Mullenweg has been reposting from his X account.)

Automattic’s board had voted earlier this week to put Mullenweg on a paid leave of absence for unknown reasons. The move seemingly came as a surprise to Mullenweg, who posted on Automattic’s Slack, accusing the board members of “conspiring” against him.

Automattic confirmed Mullenweg’s removal to TechCrunch on Wednesday, saying that Mullenweg was “currently on leave” and that Automattic’s Chief Financial Officer, Mark Davies, would lead as interim CEO with “full confidence” of the board.

However, the board’s plan did not go smoothly. Seemingly declining to depart, Mullenweg booted other admins out of the company Slack and told employees everything had been worked out and that he was back in control of Automattic, multiple sources told TechCrunch. At one point, he also posted to Slack, “I’m a pirate now” and cursed, which is something Mullenweg famously did not do. “If this is an HR problem, please wrangle me in since my normal wranglers are with Mark Davies,” he wrote.

When TechCrunch asked Mullenweg if his comments about being back as CEO were legitimate, he promised a blog post was coming. When it arrived, however, it was about him buying a houseboat. When we asked if his comments about being back were also him trolling, he replied, “I’m not a troll I’m a pirate, obviously.” Mullenweg never provided any official comment about his return, but noted on X that this was likely the fifth time he’s faced a “coup.”

Automattic also did not respond to repeated requests for comment on Friday, nor to reports we heard about board member Toni Schneider stepping down. Schneider, a founding CEO of Automattic, now leads Bluesky. He did not return requests for comment at his personal email or via requests sent to Bluesky.

We have since asked Automattic again about this and other changes to the board’s composition, which we’re hearing still may be in flux.

It helps on a number of levels, it turns out.

Benefits of restarting your gaming handheld regularly

Yes, hibernating and powering off helps too

oleschwander/Shutterstock

LEGAL

Even if regulators did somehow unwind the $20B deal, there’s a growing list of alternatives ready to take Groq’s place, no merger required

Nvidia spent a whopping $20 billion late last year to license Groq’s AI accelerator tech and hire away key members of its engineering team in an everything-but-the-kitchen-sink deal.

The acquihire technically left Groq’s core inference-as-a-service business intact, but was clearly architected in such a way as to fly under regulators’ radar.

Only it didn’t.

This week, The New York Times reported that the US Department of Justice had launched an antitrust probe into the deal.

It’s hard to argue that Nvidia didn’t strip the startup for parts. It may not have been a merger in the traditional sense, but without its engineering staff, Groq may as well be Nvidia’s puppet at this point.

Despite this, Nvidia contends the deal is a great American success story. 

“The Groq story is a prime example of the American system working as designed to promote innovation, reward entrepreneurs, and benefit consumers. The law is designed to encourage America’s startup ecosystem and promote the fundamental rights of inventors and workers to pursue their dreams,” an Nvidia statement provided to El Reg and other media reads.  

Whether the acquihire of Groq actually harmed competition is another matter entirely. But, even if the Justice Department did force Nvidia to unwind the team, it’s probably too late.

What exactly did Nvidia buy?

Nvidia’s Groq acquihire bought it two key assets: mature silicon and the talent necessary to continue its development.

Groq – which, by the way, is completely unrelated to Elon Musk’s Grok model series – made a name for itself using SRAM-heavy dataflow accelerators to speed up LLM inference to hundreds and now thousands of tokens a second, something that GPU-based systems from Nvidia had struggled to do on their own.

But while faster than GPUs, the accelerators couldn’t achieve rapid throughput. Think of it this way: If Groq’s LPUs were the F1 cars, Nvidia’s GPUs were more like a city bus. But combine the two and you get something more akin to a sport pickup.

At GTC in March, Nvidia unveiled its LPX racks, which are powered by 256 Groq-3 accelerators. As we understand it, they are really lightly modified versions of the startup’s existing Groq-2 chip designs, which makes sense, because three months is absurdly fast to tape out new silicon.

Nvidia CEO Jensen Huang promised Groq-3 combined with its Vera Rubin GPU racks would deliver optimal performance across the entire spectrum of inference workloads.

But, as we’ve discussed at length now, disaggregated compute architectures are not unique to Groq. Nvidia rival Cerebras is building similar systems with AWS and AMD, SambaNova is working with Intel, and d-Matrix and its partners are combining its in-memory compute platform with Nvidia GPUs to the same end as Nvidia’s Vera Rubin-LPX rack combo.

The damage, if any, has been done

Deals of this sort that are engineered to avoid regulatory scrutiny should get it anyway, several US senators have argued. While Nvidia didn’t outright buy Groq on paper, it may as well have. 

However, the real question for the DOJ is whether the deal was harmful to competition, and given the competitive landscape, proving harm may be easier said than done.

But even if the DOJ found reason to litigate and was successful in unwinding the deal — it certainly wouldn’t be the first time regulators had torpedoed an Nvidia deal — it probably wouldn’t change much.

Before Nvidia and Groq announced their licensing deal, the GPU giant was already laying the foundations for an ecosystem with its networking business at its center.

In late 2024, the company contributed its MGX rack designs to the Open Compute Project (OCP) making it possible for any chipmaker to put their chips in racks originally designed for Nvidia GPUs.

Then in mid-2025, GPUzilla opened its high-speed interconnect tech — the secret sauce that makes six dozen GPUs behave as one — to the broader industry through a licensing scheme called NVLink Fusion.

As we recently discussed, the combination of open racks and Nvidia networking effectively meant that any chipmaker licensing the tech could slot their designs directly into Nvidia’s racks.

If the DOJ blocked the acquihire and unwound the deal, Nvidia might lose direct control of LPU development and any revenues from the sale of the chips, but it wouldn’t necessarily be the end of its Groq LPX racks.

Groq would just join the growing number of Nvidia hardware partners designing around the company’s AI factory ecosystem. In fact, if anything, the acquihire ensures that even if regulators eventually derail the deal, there will be plenty of alternatives lined up and ready to fill the void. ®

The four potential collaborators initially formed an equal-partnership ad-tech joint venture in 2023.

Four of Europe’s largest telecom operators are said to be in talks to create a consortium that will bid on satellite spectrums and offer direct-to-mobile service in Europe, Bloomberg reported earlier this week.

The mooted partners – Germany’s Deutsche Telekom, France’s Orange, Spain’s Telefonica and the UK-headquartered Vodafone – are expected to make a joint bid for a share of airwaves that the EU has planned to reserve for local operators in order to strengthen home-grown European sovereign satellite communication capabilities, according to Bloomberg.

The sector is currently dominated by Elon Musk’s SpaceX.

The talks are in early stages, sources told Bloomberg. The four potential co-bidders initially formed an equal-partnership ad-tech joint venture in 2023.

Earlier this year, the EU adopted a proposal to select mobile satellite services providers who will be authorised to use the 2GHz frequency band beyond 2027, when the current licences expire. These licences were first handed out in 2008.

Under new rules, one-third of the band will be dedicated to government use, while the remaining two-thirds will be used commercially to provide direct-to-device services for mobile users.

SpaceX – which currently provides its satellite broadband to much of Europe with Starlink – has pushed back on the European Commission’s plans to boost satellite sovereignty in the region.

In June, the company said that the proposal creates a “significant likelihood that Europeans will be left without direct-to-device satellite services or that new European operations will create global interference problems, including to emergency services like those in Ukraine”.

SpaceX already has a partnership with Deutsche Telekom to provide direct-to-device services in the EU – something it cannot do independently.

Last year, Vodafone and AST SpaceMobile, a US company building a space-based cellular broadband network, announced a joint venture called SatCo with the aim of providing exclusive direct-to-device satellite broadband services to European mobile network operators.

Don’t miss out on the knowledge you need to succeed. Sign up for the Daily Brief, Silicon Republic’s digest of need-to-know sci-tech news.

For U.S. consumers, a credit card is generally safer than a debit card for online shopping when the main concern is unauthorized transactions, covered merchant disputes, or keeping checking-account funds available while a problem is investigated. Debit cards still have important protections, but their direct connection to a deposit account and their timing-sensitive federal liability rules can make fraud more disruptive.

That does not make a credit card the best financial choice in every situation. If using credit leads you to carry an unaffordable balance and pay interest, avoiding debt may be the more important risk. The useful comparison is what happens when an online transaction goes wrong.

The first difference is where the purchase is funded. A debit card normally uses money already held in the linked checking account. A credit card uses credit provided by the card issuer. The Federal Trade Commission’s comparison of payment cards explains both this funding difference and the different legal protections that apply.

Suppose an unauthorized $800 online purchase appears on each type of card. With a debit card, that transaction can reduce the money available in the linked account while the matter is investigated. With a credit card, the disputed transaction normally affects the credit account rather than directly removing $800 from checking.

That difference matters even when the consumer ultimately has no financial loss. A temporarily reduced checking balance can interfere with rent, utilities, scheduled transfers, or other payments. Final fraud liability and short-term access to cash are separate risks.

Credit cards also have a relatively simple federal limit for qualifying unauthorized use. Under Regulation Z’s credit-card provisions, a cardholder’s liability generally cannot exceed the lesser of $50 or the amount obtained through unauthorized use before the issuer is notified, provided the regulation’s conditions for imposing liability are met.

Credit Card vs Debit Card: Safety Comparison at a Glance

The most useful comparison is not whether both cards advertise fraud protection. It is how federal liability, access to checking-account funds, merchant-dispute rights, network policies, and debt risk differ.

Credit Card vs Debit Card for Online Purchases

For online-payment protection, credit generally has the advantage. That does not mean it wins every financial criterion. A shopper who is likely to carry expensive credit-card debt may reasonably give greater weight to borrowing risk.

What Happens If Someone Uses Your Card Without Permission?

Credit-card unauthorized use

Federal credit-card rules provide a relatively straightforward liability ceiling. Regulation Z states that qualifying liability for unauthorized credit-card use cannot exceed the lesser of $50 or the value obtained before the issuer is notified.

The protection can be stronger when the physical card remains in your possession. According to the Consumer Financial Protection Bureau’s guidance on unauthorized credit-card charges, if someone steals and uses only the account number and you have not lost the card itself, you generally have no liability for that unauthorized use.

“Unauthorized use” has a specific legal meaning. Regulation Z defines it as use by someone other than the cardholder who lacks actual, implied, or apparent authority and from which the cardholder receives no benefit. A disagreement involving a family member, employee, or another person who was previously allowed to use the card can therefore be more complicated than a straightforward stolen-number case.

Debit-card unauthorized transfers

Debit cards also have federal protections, but reporting timing can materially affect potential liability. Under Regulation E’s unauthorized-transfer rules, a consumer who notifies the financial institution within two business days after learning that an access device was lost or stolen generally faces liability of no more than the lesser of $50 or the unauthorized transfers that occurred before notice.

If the consumer waits longer than two business days, potential liability can rise. Regulation E describes circumstances in which the applicable ceiling can reach $500, although the actual amount depends on when the transfers occurred and whether the institution establishes that later transfers could have been prevented by timely notice.

The often-repeated “60-day rule” also needs precision. If an unauthorized electronic fund transfer appears on a periodic statement, the consumer generally must report it within 60 days after the institution transmits that statement to avoid potential liability for later unauthorized transfers that timely notice could have prevented. It is misleading to say that every unauthorized dollar automatically becomes the consumer’s responsibility on day 61.

Because reporting time can affect the outcome, responding to an unauthorized online card purchase should include prompt notice to the issuer or financial institution and preservation of the relevant transaction records.

A consumer can ultimately have little or no liability and still experience temporary disruption. That distinction is particularly important with debit cards because the disputed transfer can affect money already sitting in the linked account.

Under Regulation E’s error-resolution procedures, a financial institution generally must investigate promptly and determine whether an error occurred within 10 business days after receiving a qualifying notice of error.

If the institution cannot complete the investigation within that period, it can generally take up to 45 days if it provisionally credits the consumer’s account within the required period and satisfies the other conditions in the rule. Regulation E provides longer investigation periods for specified categories, including certain point-of-sale debit-card transactions, transfers initiated outside a state, and qualifying new-account cases.

Provisional credit is a temporary credit placed in the account while the investigation continues. It is not necessarily a final determination that the consumer’s claim is valid.

Consider the $800 fraud example again. If an unauthorized debit transaction reduces the checking balance shortly before rent is due, the consumer may face a cash-flow problem before the investigation or provisional-credit process restores access to those funds. An unauthorized credit-card transaction ordinarily does not remove that $800 from checking in the first place.

Credit Cards Have Federal Billing-Error Rights for Some Merchant Problems

Online-shopping problems are not limited to card theft. A merchant might bill twice, charge the wrong amount, fail to deliver an order, send the wrong quantity, or deliver an order somewhere other than the location agreed upon.

Regulation Z’s billing-error rules cover several categories of problems with open-end credit accounts. One category includes charges for property or services that the consumer did not accept or that were not delivered as agreed. The CFPB’s official interpretation gives examples including different property than agreed, the wrong quantity, late delivery, and delivery to the wrong location.

For the formal billing-error process, the consumer’s written notice generally must reach the creditor no later than 60 days after the creditor transmitted the first periodic statement reflecting the alleged error. The notice must also contain enough information for the creditor to identify the account and understand the alleged problem.

Once a qualifying notice is received, the creditor generally must acknowledge it in writing within 30 days unless the matter has already been resolved, and complete the applicable resolution procedures within two complete billing cycles, but no later than 90 days.

There is an important limit. Regulation Z expressly says this billing-error category does not cover a dispute merely about the quality of property or services that the consumer accepted. Whether the consumer legally accepted the goods can depend on state or other applicable law.

For example, a laptop that never arrives can fit the non-delivery framework more readily than a laptop that arrives as ordered but feels less premium than the buyer expected.

Credit cards also have a separate federal claims-and-defenses provision. Under Regulation Z’s claims-and-defenses rules, a cardholder can in qualifying circumstances assert certain merchant-related claims or defenses against the card issuer after the merchant fails to resolve the dispute satisfactorily.

That right has conditions and should not be presented as a universal guarantee. The regulation generally requires a good-faith effort to resolve the dispute with the merchant and includes transaction-value and geographic requirements. Its official interpretation also notes that internet orders can qualify as credit-card purchases, while the location of an internet or telephone transaction for the geographic condition can depend on state or other applicable law.

For that reason, “you can always charge it back” is too broad. The applicable right depends on the type of dispute, the facts, the account, and the governing rules.

What About Debit Cards With Zero-Liability Policies?

Network and issuer policies can improve the protection available to debit-card users beyond the federal statutory minimum. They do not make Regulation E and Regulation Z identical.

For example, Visa’s current Zero Liability Policy says qualifying Visa credit and debit cardholders are not held responsible for unauthorized charges made with the account or account information. Visa states that the policy covers most credit and debit cards but excludes certain commercial-card and anonymous prepaid-card transactions and transactions not processed by Visa.

Visa also instructs cardholders to notify their issuing financial institution immediately and tells consumers to check with the issuer about coverage for a specific card.

This creates two distinct layers. Federal law sets statutory rights and liability rules. A network or issuer can then provide contractual protections that are more favorable to the cardholder. A network policy should therefore be described as an additional protection, not as evidence that every debit card has identical rights or that statutory debit and credit protections are the same.

When Using a Debit Card Online Can Still Make Sense

A debit card can still be a reasonable choice when avoiding revolving debt is the higher financial priority. Debit purchases normally use money already held in the linked account rather than creating an ordinary credit-card balance.

The FTC notes that credit cards can charge interest when balances are carried from month to month. It also explains that on most cards, paying the whole bill by the due date can avoid purchase interest, although the exact account terms control.

Debit may therefore make sense for someone who does not have a credit card, prefers not to borrow, or knows that available credit tends to lead to balances that are difficult to repay. In that situation, it is particularly important to understand the bank’s reporting procedures, review account activity regularly, use available transaction alerts, and report suspicious transfers promptly.

If you want to avoid conventional credit, consider other ways to pay online without a credit card and compare their fees, privacy implications and consumer protections.

How to Shop More Safely With Either Card

Choosing credit instead of debit does not make an untrustworthy merchant safe. Payment protections matter after something goes wrong, while merchant checks can reduce the chance of entering the transaction in the first place.

• Check an unfamiliar seller before paying. Look for independent information about the business and search its name with terms such as “complaint” or “scam.”
• Do not treat HTTPS as proof that a seller is legitimate. The FTC explains that HTTPS means the connection is encrypted, but fraudulent sites can use encryption too.
• Keep transaction records. Save the order confirmation, price, promised delivery information, return or refund terms, and important communications with the seller.
• Review account activity regularly. Detecting an unauthorized transaction sooner can make it easier to report within applicable deadlines.
• Use transaction alerts when your issuer offers them. They can make unexpected activity easier to notice.
• Report suspicious activity promptly. Follow the card issuer’s or financial institution’s stated reporting process rather than waiting to see whether another transaction appears.

The FTC’s online-shopping guidance specifically recommends paying by credit card when possible because of the protections available when a scam or covered purchase problem occurs. The FTC also recommends keeping purchase records and warns that an encrypted website is not necessarily legitimate.

How the card credentials themselves are exposed is a separate security question. Virtual card vs physical card for online shopping can be evaluated separately from the legal differences between debit and credit accounts.

For most U.S. shoppers who can use a credit card without carrying unaffordable debt, credit is the safer default for online purchases. Its advantage comes from federal unauthorized-use limits, specific billing-error protections for several merchant problems, and the practical separation between a disputed purchase and money held in checking.

Debit is not inherently unsafe. It simply makes rapid detection and reporting more consequential and exposes the linked account more directly when fraud occurs. Whichever card you use, verify unfamiliar sellers, keep transaction records, review account activity, and report suspicious transactions promptly.