Earlier this month, debit PIN pads were tampered with at Michael's locations throughout the Chicago area, which exposed the credit and debit card information of the craft store's customers. Now, the company has discovered that the fraud reached throughout 20 states, which include 90 keypads in 80 stores in the country. The security breech impacted check line terminals in Illinois, Colorado, Delaware, Georgia, Iowa, Massachusetts, Maryland, North Carolina, New Hampshire, New Jersey, New Mexico, Nevada, New York, Ohio, Oregon, Pennsylvania, Rhode Island, Utah, Virginia and Washington. Over the years, consumers have become dependent on debit cards. The surprising news about the breech at Michael's is a huge blow as many customers view debit cards as a reliable, safe and easy method of payment.
Michael’s originally removed 964 pads that showed signs of tampering. But now with the discovered extent of the problem, they're removing another 7,200 as a precautionary measure. All PIN pads are being carefully scrutinized in each one of its Canadian stores as well. Until the replacement of all of the pads with new models is complete, consumers are advised to use cash, credit cards or signature-based debit cards.
Breeches with these types of terminals are not uncommon. Often, they occur when criminals pretending to be keypad repair contractors gain access to employees' machines. Scammers then switch the pads in the machines with fraudulent ones. These new pads then record account numbers from the magnetic stripe and PIN codes of customers' cards. As soon as the devices become filled with card data, scammers can upload the information from the terminals through a cellular network. With this data, scammers can produce forgeries of cards. The process is relatively simple and usually only requires a white piece of plastic.
While the company refused to provide specific details, we do know that banking and law enforcement executives reached out to Michael’s to inform the company of the fraudulent transactions. Credit card companies are working with Michael’s to target the specific cause of the fraud.
In the mean time, Michael's advises customers to check with their financial institutions for signs of potential tampering. Any customer who notices fraudulent activity on their accounts should immediately contact Michael’s. Customers are quick to react to the fraud with a number of customers freezing their bank accounts. At Marquette Bank, 3% of customers that are possible victims of the crime are freezing their accounts.
Although closing accounts and freezing debit cards can help protect customers after the fact, questions remain about how consumers and retailers can prevent such breeches from occurring. Should retailers eliminate electronic PIN pads entirely and return to requiring signatures for transactions? And should customers consider credit card offers instead of debit cards since signatures are generally necessary for their use? Keeping a close eye on the situation with Michael's in the coming weeks could lead to answers to these important questions.