This depends heavily on the country you’re in. In the UK banks are required to refund you within a single business day if they don’t have any evidence that the customer isn’t trying to defraud the bank themselves.

They try to squirm out of that of course. But in general getting your money back isn’t too tricky even with a debit card.

Oh yeah. I should definitely caveat: I am in the US. I think banks here are required to cap your loss to $50 USD if you report unauthorized fraud within two business days. But still, the onus is on you. Meanwhile, virtually all credit cards in the US offer $0 liability protection. Which means at most you pay nothing.