Debit card PIN pads at five Western Washington Michaels stores are among 90 nationwide that show signs of tampering, the Texas-based crafts store chain said this week.
Pads in stores in Tukwila, Marysville, Lynnwood, Kirkland and Everett were identified as having shown signs of tampering, the company said. Those pads and 7,200 debit card terminals of similar design have been removed from the company’s 964 stores across the country.
Michaels’ investigation began after customers in some of its Chicago stores complained of unauthorized withdrawals from their bank accounts. Michaels Stores says the debit-card fraud has spread across 20 states.
Michaels identified 90 key pads that were tampered with in Illinois, Colorado, Delaware, Georgia, Iowa, Massachusetts, Maryland, North Carolina, New Hampshire, New Jersey, New Mexico, Nevada, New York, Ohio, Oregon, Pennsylvania, Rhode Island, Utah, Virginia and Washington.
Never miss a local story.
The company said it is using cash register terminals to authorize debit and credit card transactions at the stores affected by the PIN pad removals until those pads can be replaced.
Replacement is expected to take about two weeks.
The company urged customers to carefully scrutinize their bank account transactions for unauthorized activities. Those who discover suspicious withdrawals should notify their card issuers, said the retailer.
Michaels is working with credit card companies to identify customers who used cards on the suspect terminals so that they can be notified to take steps to protect their accounts from fraud.
Illinois was hit the hardest, with PIN pads compromised in 14 Michaels stores, all in the Chicago region.
Michaels’ checkout-line swipe terminals were probably tampered with or swapped out for other machines by thieves who stole account numbers and secret PIN codes, experts say. As a result, Michaels customers have reported having money taken from their bank accounts, often in the amount of $503, and often at cash machines in California.
Most victims reported some multiple of $100 was withdrawn from their accounts, plus an ATM fee.
If you made a debit-card purchase at a Michaels in recent months and have noticed unusual activity in your bank account, contact your bank and file a report with your local police department, authorities suggest.
Federal law says debit-card users have only a limited time to report a loss or unauthorized use.
Even if reported within two days, a customer can be liable for up to $50 of the fraud amount. If reported between two and 60 days, the customer can be liable for up to $500. If reported later, a customer is in danger of losing all the money. Further, a bank can take up to 10 business days – essentially two weeks – to put back into the account any stolen money, according to the Identity Theft Resource Center.
However, banks can decide to be more generous than the federal law limits.
The Chicago Tribune contributed to this report.