Arts-and-crafts retailer Michaels Stores Inc. said Thursday that some customer debit and credit card information has been compromised by PIN pad tampering in its Chicago-area stores.Authorities have confirmed that thieves have plundered some victims bank accounts, often for hundreds of dollars each.
Consumers who have bought items from a Michaels store with a debit or credit card are encouraged to monitor their statements, report suspicious account activity and change debit-card PIN numbers and other account security settings.
The Bloomingdale Police Department alone is investigating 16 reports of fraud. All victims had used debit cards at a Michaels. "That number may be climbing," said Bloomingdale Police Chief Frank Giammarese. "They're filtering in as awareness grows from news coverage, or people notice withdrawals from their accounts."
ATM cash withdrawals from victims' bank accounts have been happening in recent days. However, the timeframe for making purchases at Michaels stretches back months, perhaps as early as December, Giammarese said. Withdrawals are being made out of state, including California and possibly Nevada, he said.
"It appears Michaels stores in the Chicagoland area have been targeted," he said. "I can confidently say all 16 of our victims have visited a Micheals store."
The U.S. Secret Service began an investigation Wednesday but said it was too early to give an update on its progress. "At this point right now, it's a brand new case for us," said Derrick Golden, spokesman for the Chicago field office of the secret service.
There are a number of ways thieves steal PIN pad information, including placing an electronic skimming device or bug on the machines that captures card information or personal identification numbers. In some cases, thieves or accomplice employees can swap out the entire PIN pad with one that captures data, he said. As far as the Michael's breach, "it's too early to say," Golden said.
Among the victims was Mary Allen, 49, of Libertyville. She shopped at the Michaels in Vernon Hills about a month ago to buy a craft kit for her son's school project. She didn't find out until Wednesday about two fraudulent withdrawals from her account of $503 each until she tried to get cash at an ATM and her debit card was declined.
"Your heart stops the minute your card is declined at the ATM machine," Allen said. "You think someone has stolen your ID and that's your worst nightmare."
She said her bank, Harris Bank, told her she would be reimbursed for the $1,006 within five business days. While she was happy with the service from Harris Bank, she is frustrated that as a victim, she is still carrying the burden.
"We're inconvenienced," she said. "I have to wait five days for my money to come back, and it wasn't my negligence," she said. "I always have a buffer. I have withdrawal protection, just in case. But thinking of other people who don't have overdraft protection -- to wait a week to get $1,000 back -- that's a long time."
Debit card fraud is typically a greater hassle than credit card fraud because money is withdrawn from a victim's bank account. It can take up to a couple weeks to get the money replaced after reporting the fraud.
Consumers who believe their accounts were used without authorization should contact the card issuer directly and file a report with their local police department. More consumer protection tips are available at the Federal Trade Commission website.
Michael's, based in Irving, Texas, is working to assist authorities in the investigation. For additional information and updates, visit its website.