PIN Pads Hacked At Michaels, Robert Siciliano for @Mcafee

14 May 2011 · 2 min

Watch on YouTube

1:30

Hackers tampered with PIN pads at Michaels stores across 20 states from February to May 2011, affecting at least 80 locations. Fewer than 100 customers reported fraud, but the chain is replacing all 7,000 PIN pads. Security expert Robert Siciliano recommends using credit cards instead of debit cards to limit exposure to PIN theft.

Chapters

Secret Service is investigating a massive case of fraud at a popular chain of arts and crafts stores. It happened at Michaels stores in 20 states. Now, the Michaels chain is saying California is not one of those states. However, experts say this is an important lesson for anyone who uses a debit card. It's known for homey crafts and now unknowingly a crafty scheme intended to rob customers who pay by debit card. Slide it again?
No, no, you're good. All done.
The Secret Service says crooks have tampered with PIN pads at at least 80 Michaels stores, secretly installing devices enabling them to capture customers' debit card and PIN numbers.
This is a pretty big one.
Security expert Robert Siciliano suspects the hackers probably did their work in plain sight by pretending to be part of the chain's support staff.
They pose as, uh, the technologist responsible for maintaining the devices And once they're successful, they apply that same strategy to every single store.
The tampering took place between February 8th and May 6th. Michaels says so far fewer than 100 customers have reported fraudulent transactions. Today it said it's replacing all 7,000 of the PIN pads at all its stores. Siciliano says this should be a wake-up call for consumers that debit card transactions are risky. He advises doing as few as possible.
The bad guys aren't just targeting this one store. They're targeting every store.