Debit fraud at Michaels Stores hit 20 states, including Oregon

Published 5:00 am Thursday, May 12, 2011

CHICAGO — Michaels Stores says the debit-card fraud stemming from tampered checkout line terminals at its stores is not isolated to the Chicago region but is spread across 20 states.

Michaels identified 90 key pads that were tampered with in the states of Illinois, Colorado, Delaware, Georgia, Iowa, Massachusetts, Maryland, North Carolina, New Hampshire, New Jersey, New Mexico, Nevada, New York, Ohio, Oregon, Pennsylvania, Rhode Island, Utah, Virginia and Washington.

Debit-card fraud is worse for consumers than credit-card fraud. In the case of Michaels’ stores, many customers had money stolen directly from their bank accounts via ATM withdrawals.

“Suspicious PIN pads were disabled and quarantined immediately,” Michaels said in a statement. “Out of an abundance of caution, Michaels has removed approximately 7,200 PIN pads comparable to the identified tampered PIN pads from its U.S. stores.” Until those pads are replaced with upgraded models, customers can use cash, credit cards and signature-based debit cards.

The company said it has started replacing PIN pads in all U.S. stores and expects the replacement to be completed within the next 15 days.

Illinois was hit the hardest, with PIN pads compromised in 14 Michaels stores, all in the Chicago region.

The fraud attack has led many banks to proactively freeze bank accounts of customers they think may be vulnerable. For example, Marquette Bank, with 24 branches in the Chicago region, said 1,900, or 3 percent, of its customers were identified as potential victims, meaning they made a PIN-based debit card transaction at Michaels over the past six months.

“We were able to identify fraud early, before Michaels went public with their data breach, so we were able to avoid large losses,” said bank spokesman Jeff McDonald. The bank posted warnings on its Web page and on social media site Twitter, while it also called customers, sent letters and began proactively replacing debit cards of some customers. “Unfortunately, we have become experts in addressing these issues quickly with minimal customer inconvenience after dealing with past retail store breaches,” he said.

Michaels’ checkout-line swipe terminals were probably tampered with or swapped out for other machines by thieves who stole account numbers and secret PIN codes, experts say. As a result, Michaels customers have reported having money taken from their bank accounts, often in the amount of $503, and often at cash machines in California.

If you made a debit-card purchase at a Michaels in recent months and have noticed unusual activity in your bank account, contact your bank and file a police report with your local police department, authorities suggest.

Federal law says debit-card users have only a limited time to report a loss or unauthorized use. Even if reported within two days, a customer can be liable for up to $50 of the fraud amount. If reported between two and 60 days, the customer can be liable for up to $500. If reported later, a customer is in danger of losing all the money.