Debit-Card Heist Lasted Months

Wall Street Journal
By Ann Zimmerman

Thieves tampered with debit-card processing equipment at Michaels arts-and-crafts stores as early as Feb. 8, nearly three months before customers who had used their bank cards at the chain first reported that their bank accounts had been looted, the retailer said.

The company began removing the compromised equipment, which it found at 80 stores in 20 states, on May 6. It says that fewer than 100 customers have reported fraudulent transactions.

Earlier in the week, Michaels Stores Inc. of Irving, Texas, reported that crooks had subverted its equipment and collected customers' debit-card data, including personal identification numbers. The gang created duplicate cards and, using the stolen PINs, withdrew cash from victims' bank accounts, in some cases more than once.

The company said that it uncovered almost 90 improperly altered debit-card processing devices. The U.S. Secret Service is investigating the incident.

Michaels said it has since learned from law enforcement that thieves may target older devices, known as PIN pads. The company was in the process of upgrading its equipment when the attack occurred, it said.

"Those pads have all been removed from every U.S. Michaels store, and are being replaced with tamper-proof equipment within the next two weeks," the company said, adding, "We have adopted additional security measures to prevent future tampering."

While Michaels has not revealed details of how its equipment was compromised, retail experts say that the thieves probably installed devices called skimmers, which can read and copy information in the magnetic strips on the backs of debit cards. PINs can be collected using tiny cameras or by membranes installed over keypads to collect keystrokes.

Retailers and banks expressed concern about the attack on Michaels, which resembles a similar assault on debit card readers at grocer Aldi Inc.'s stores in 11 states last fall. Banks generally reimburse customers for unauthorized withdrawals reported within 60 days.

Retailers said similar frauds could be prevented if the card networks would issue safer chip and PIN cards, which are expensive to produce but harder to copy.

"But banks and credit card networks want to keep the status quo, so they can justify the fees they charge retailers" to process transactions, said Brian Dodge, a spokesman for trade group Retail Industry Leaders Association.

The banking industry says it is not to blame. Retailers would have to spend money on equipment capable of reading the new cards. "It's a cost that small and mid-size retailers are balking at," said Doug Johnson, vice president of risk management policy at trade group American Bankers Association.

Thieves Swipe Debit Card Data

Wall Street Journal
By Ann Zimmerman and Miguel Bustillo

Brandi Ramundo of West Chicago, Ill., rushed out to a Michaels arts-and-crafts store April 16 to cobble together corsages for her seven-year-old twins, who were going to a father-daughter dance.

It turned out cute," Ms. Ramundo says of the fake-flower crafts project. "But it wound up costing me 1,400 bucks."

Ms. Ramundo is one of an unknown number of shoppers at Michaels stores in 20 states whose bank accounts were looted after they had used their bank debit cards at the retailer.



WSJ's Ann Zimmerman reports Michaels arts and crafts stores are warning customers across the country that their credit card information may have been obtained by hackers. (AP Photo/Donna McWilliam)
.Thieves tampered with the retailer's debit-card processing equipment at about 80 stores from Massachusetts to Washington, according to the chain's corporate parent, Michaels Stores Inc.

The thefts apparently involved the use of electronic devices called skimmers that allowed crooks to record information from shoppers' debit cards and steal their personal identification numbers, or PINs.

The Irving, Texas, company said Wednesday that it uncovered almost 90 improperly altered debit-card processing devices called PIN pads.

Michaels Stores Affected by Tampering
View Interactive
.See a list of stores where tampered PIN pads have been found.
.Thieves were able to use the stolen data to create duplicate debit cards and use them at automated teller machines to steal money directly from victims' bank accounts, primarily in denominations of $500.

Michaels Stores said it first became aware of the fraud scheme in early May after police departments around Chicago began receiving reports from consumers alleging their bank accounts had been looted, primarily from thieves using ATMs in California.

The company said it is working with federal and state law-enforcement authorities, and is replacing all of its 7,200 card-processing terminals as a precaution. The U.S. Secret Service, which investigates financial fraud, said that it is investigating the Michaels incident.

The scam resembles one perpetrated last summer at Aldi Inc. grocery stores in a dozen major cities across the country, and highlights what experts says is the growing appeal of debit cards to criminals.

Fraud involving debit cards, PIN numbers and card processing equipment has increased fivefold over the past five years, said Avivah Litan, a payment-fraud analyst at Gartner Research. While gangs initially targeted bank ATMs, such schemes have expanded to include card processors at gasoline pumps and now at retail chains.

A type of debit card embedded with a microchip instead of a magnetic strip is considered more secure and is standard issue in Europe, said Ms. Litan. But U.S. retailers have resisted the cards because of the cost involved in replacing existing card processors to read the microchip.

Details on the Michaels' breach are sketchy, but criminals have been known to install the devices by distracting cashiers or posing as repairmen, said Joseph LaRocca, senior advisor for asset protection at the National Retail Federation. Frequently, thieves will simply replace the stores' card processing machines with ones already embedded with skimmers.

To capture the cards' PIN numbers, thieves often place tiny cameras, as small as pin heads, on the processors or install a membrane over key pads that can record keystrokes. In either case, a thief must have physical access to the store.

The devices are typically homemade, put together by easily obtainable electronic parts, said Julie McNelley, a fraud and risk analyst at financial consultancy Aite Group, who recently attended a U.S. Secret Service presentation on debit-card fraud where the electronic devices were displayed.

She called the Michaels fraud "a very audacious, coordinated attack. These guys did their homework, identified the vulnerability of the particular key pad and maximized their efforts in a relatively short time."

Marquette Bank, an Illinois bank with 24 branches, noticed suspicious activity on 58 accounts last week and quickly found a common denominator: recent purchases at Michaels. It reimbursed the customers and replaced their cards.

"We caught it so early, there was not a great loss for our bank," said Jeff MacDonald, a bank spokesman.

Mary Allen, a 49-year-old teacher from Libertyville, Ill., visited her local Harris Bank branch last Wednesday to make a routine withdrawal and learned that she had insufficient funds.

A clerk printed out her recent account activity, and she saw two $503 transactions that she did not recognize.

Both withdrawals had been made in California, including one in the city of Monrovia.

"I can tell you one thing, I'm not sure I will ever use an ATM card again," said Ms. Allen.

Police in nearby Plainfield, Ill., also began receiving complaints earlier this month from consumers about strange transactions, said Sgt. Kevin McQuaid. They are set to meet with federal investigators soon to share what they have learned.

"It's frustrating when you can't really do anything for them other than direct them to the federal government," he said of local citizens.

"It is happening everywhere, and these financial criminals are becoming quite sophisticated in their methods."