Thieves Swipe Debit Card Data

Brandi Ramundo of West Chicago, Ill., rushed out to a Michaels arts-and-crafts store April 16 to cobble together corsages for her seven-year-old twins, who were going to a father-daughter dance.

"It turned out cute," Ms. Ramundo says of the fake-flower crafts project. "But it wound up costing me 1,400 bucks."

Ms. Ramundo is one of an unknown number of shoppers at Michaels stores in 20 states whose bank accounts were looted after they had used their bank debit cards at the retailer.

Thieves tampered with the retailer's debit-card processing equipment at about 80 stores from Massachusetts to Washington, according to the chain's corporate parent, Michaels Stores Inc.

The thefts apparently involved the use of electronic devices called skimmers that allowed crooks to record information from shoppers' debit cards and steal their personal identification numbers, or PINs.

The Irving, Texas, company said Wednesday that it uncovered almost 90 improperly altered debit-card processing devices called PIN pads.

Thieves were able to use the stolen data to create duplicate debit cards and use them at automated teller machines to steal money directly from victims' bank accounts, primarily in denominations of $500.

Michaels Stores said it first became aware of the fraud scheme in early May after police departments around Chicago began receiving reports from consumers alleging their bank accounts had been looted, primarily from thieves using ATMs in California.

The company said it is working with federal and state law-enforcement authorities, and is replacing all of its 7,200 card-processing terminals as a precaution. The U.S. Secret Service, which investigates financial fraud, said that it is investigating the Michaels incident.

The scam resembles one perpetrated last summer at Aldi Inc. grocery stores in a dozen major cities across the country, and highlights what experts says is the growing appeal of debit cards to criminals.

Fraud involving debit cards, PIN numbers and card processing equipment has increased fivefold over the past five years, said Avivah Litan, a payment-fraud analyst at Gartner Research. While gangs initially targeted bank ATMs, such schemes have expanded to include card processors at gasoline pumps and now at retail chains.

A type of debit card embedded with a microchip instead of a magnetic strip is considered more secure and is standard issue in Europe, said Ms. Litan. But U.S. retailers have resisted the cards because of the cost involved in replacing existing card processors to read the microchip.

Details on the Michaels' breach are sketchy, but criminals have been known to install the devices by distracting cashiers or posing as repairmen, said Joseph LaRocca, senior advisor for asset protection at the National Retail Federation. Frequently, thieves will simply replace the stores' card processing machines with ones already embedded with skimmers.

To capture the cards' PIN numbers, thieves often place tiny cameras, as small as pin heads, on the processors or install a membrane over key pads that can record keystrokes. In either case, a thief must have physical access to the store.

The devices are typically homemade, put together by easily obtainable electronic parts, said Julie McNelley, a fraud and risk analyst at financial consultancy Aite Group, who recently attended a U.S. Secret Service presentation on debit-card fraud where the electronic devices were displayed.

She called the Michaels fraud "a very audacious, coordinated attack. These guys did their homework, identified the vulnerability of the particular key pad and maximized their efforts in a relatively short time."

Marquette Bank, an Illinois bank with 24 branches, noticed suspicious activity on 58 accounts last week and quickly found a common denominator: recent purchases at Michaels. It reimbursed the customers and replaced their cards.

"We caught it so early, there was not a great loss for our bank," said Jeff MacDonald, a bank spokesman.


Mary Allen, a 49-year-old teacher from Libertyville, Ill., visited her local Harris Bank branch last Wednesday to make a routine withdrawal and learned that she had insufficient funds.

A clerk printed out her recent account activity, and she saw two $503 transactions that she did not recognize.

Both withdrawals had been made in California, including one in the city of Monrovia.

"I can tell you one thing, I'm not sure I will ever use an ATM card again," said Ms. Allen.

Police in nearby Plainfield, Ill., also began receiving complaints earlier this month from consumers about strange transactions, said Sgt. Kevin McQuaid. They are set to meet with federal investigators soon to share what they have learned.

"It's frustrating when you can't really do anything for them other than direct them to the federal government," he said of local citizens.

"It is happening everywhere, and these financial criminals are becoming quite sophisticated in their methods."

LWDLIK- Blimey!