Credit/Debit Card Readers at Self-Checkout Terminals
Frequently Asked Questions – Updated Dec. 20, 2011
What do you know so far? What has the investigation revealed?
Local, state, and federal authorities continue investigating. Currently, all the tampered card readers have been sent to the Secret Service for evaluation. We hope to know soon the timeframe that the credit/debit card readers contained an illegal skimming device. This is an ongoing criminal investigation and we are closely following law enforcement instructions on what information can be released that will not compromise their investigation.
Any transaction occurring on or after November 23 was not affected by a tampered card reader and all of the affected card readers were removed by that date. Even though our company was not fully aware of the extent of this crime nor had we received any information on fraudulent activity, we proactively inspected all credit/debit card readers in all 233 stores.
Why has the store count increased? Are there new breaches?
In our Consumer Advisory on November 23, 20 stores were originally communicated as having tampered card readers and consumer notices were posted. On December 5 we noted that three additional stores had card readers replaced prior to November 23 and were added to a later report. The stores were Lucky Sunnyvale, Lucky Novato, and Lucky on 939 Lakeville Hwy. in Petaluma.
On December 7 we were informed that our San Leandro store on 1300 Fairmont Drive also had a tampered credit/debit card reader removed and replaced prior to November 23 but was not included in the earlier report. This puts our total store count with a compromised credit/debit card reader at 24.
Again, these were not newly tampered card readers but part of the original discovery. There have been no new breaches found in any of our credit/debit card readers since the original notification.
How many customers have voiced concerns to Lucky, how many have lost money and what is the estimated total amount?
All financial institutions serving customers possibly affected by the self-checkout land card skimming scam have been alerted to closely monitor accounts for any suspicious transactions.
Unfortunately, we have no real way of determining the exact number of accounts that may have been improperly accessed since this is something customers should report to law enforcement officials and their individual financial institutions. Based on reports from our call center, it currently appears that there were fewer than 1,000 incidents of reported loss or attempted loss. We continue working with customers, law enforcement officials, the U.S. Secret Service, vendors and others to address and rectify the problems.
What should I do if I discover my account has been accessed?
Immediately contact your financial institution and follow their recommendations. Contact information for each of the three credit reporting bureaus is listed below for your convenience.
Also, consider contacting our partner, the Identify Theft Council, at www.identitytheftcouncil.org for more information and assistance on working with your financial institution.
Does Lucky have a business relationship with The Identity Theft Council? Why is the organization being highlighted by Lucky?
Lucky is working with The Identity Theft Council. The organization was referred to us by local law enforcement authorities as an effective resource for Lucky customers affected by the card reader scam. The Identity Theft Council is a local nonprofit staffed by experts in the field of identity theft who volunteer their time to help victims of identity theft and related crimes.
Why have I not been able to get through to your company on the toll-free number provided?
Our customer support team has been receiving high call volumes and our system is handling the increase as effectively as possible. Customers can email through our websites at Lucky Supermarkets.com or SaveMart.Com. We are posting news releases and updating our FAQ on the website under “Customer Alerts” which can be found at top of the webpage.
Do I need to contact your company?
While it is helpful for our ongoing investigation, it is more important to immediately contact your financial institution and consult with them. They may recommend you file a police report with your local law enforcement.
What kind of assistance can Lucky/Save Mart provide? Is Lucky going to compensate me for any charges to close my account or expenses incurred due to this crime?
To date we have verified early claims through our Asset Protection Team and going forward this verification will be handled by the respective financial institutions. We have sent our transaction data from the tampered checkout systems to our merchant services processing company who then provides the information to all financial institutions so they can verify their bank customers’ accounts.
We have provided updated Consumer Notification to be posted at all credit/debit card readers in all Bay Area stores to broaden our alert beyond just the stores affected. FAQs and media releases have been posted under special Consumer Alert tab on our websites. We have partnered with the Identity Theft Council to provide our customers with information and assistance on working with their financial institutions. We are not providing monitoring services or monetary compensation, as your financial institution should assist you.
Lucky has expanded call center hours and is directing customers to its website — www.luckysupermarkets.com – where people can easily find updated information on the investigation, and resources they can use to protect themselves.
These resources include directions on what customers should do if they believe their account information has been compromised. Also, Lucky is providing customers with links and numbers for credit reporting bureaus. Additionally, Lucky is working closely with local, state and federal law enforcement authorities in their investigation to identify suspects behind the scam.
Is it safe to continue to use my debit and/or credit card in your stores?
Yes, as of November 23 all the affected credit/debit readers were replaced and remaining credit/debit card readers were inspected. Our trained service personnel are continuing to closely monitor and inspect all card readers in our stores. We believe these steps will protect the security of our payment network and the privacy of our customers using credit and debit cards going forward. We maintain Payment Card Industry Data Security Standards (PCIDSS) and are regularly audited to ensure compliance.
What do you mean when you say the criminal activity was a highly sophisticated scam?
According to law enforcement officials, the scam relied on wireless technology that enabled perpetrators to remotely retrieve credit/debit card data. This is apparently more advanced than previous known attempts that required criminals to physically retrieve devices out of retailers’ stores to obtain stolen information.
This is an ongoing criminal investigation and Lucky is closely following law enforcement instructions on what information can be released that will not compromise their investigation.
How can I protect myself in the future?
Recommendations from law enforcement and financial institutions have suggested if you use a credit or debit card then always be vigilant in tracking all transactions and closely watching account activity.
Is this the first time Lucky has ever been targeted?
In 2007, prior to our purchase of the store, an Albertsons store in San Leandro had a breach of their credit/debit card readers. Shortly after the purchase, law enforcement and card processors notified our company that there had been a confirmed breach of the systems in that store. We responded swiftly by notifying customers and reinspecting all card readers in the chain. Following that assessment we purchased and replaced in Spring of 2007 all credit/debit card readers in all check-lanes at the Albertsons stores we had purchased in early 2007.
FAQs Previously POSTED on 12/5/11
How did you discover the tampering in card readers?
Save Mart/Lucky’s standard operating practice is to inspect the credit/debit card readers regularly. It was during this regular review that we discovered a credit/debit card reader on a self-checkout lane looked suspicious. We immediately sent the card reader into the manufacturer for inspection and they verified the device had been tampered with. While waiting for this manufacturer review, we immediately began aggressive checks of the card readers in all 233 stores especially those in our self-checkout terminals.
How did you respond? What did you do to protect your customers?
Once our chain-wide review of all credit/debit card readers was completed and we knew the extent of the tampering, Save Mart’s Asset Protection Department began working with law enforcement authorities. An investigation is underway and we are working closely with authorities to uncover the person/persons responsible for this incident.
We promptly replaced all the credit/debit card readers in the affected stores self-checkout terminals and enhanced the security of the remaining credit/debit card readers.
In addition, we immediately posted Consumer Notices in all affected stores and on our websites as well as issued a press release to all media outlets.
Do you know if customer account information was compromised or misused?
Save Mart/Lucky's has worked diligently in its efforts to resolve this incident and identify any and all potential security breaches into customer information. Initially, we did not know of any customers who had compromised accounts.
We have since been contacted by 80 employees and customers reporting account issues. Our Asset Protection team is working with all appropriate authorities to verify the source of every account that has had problems. Some of these notifications have resulted in a confirmed or attempted breach of account data from the affected self-checkout card readers.
Save Mart/Lucky's is committed to its customers and their privacy and will continue aggressively investigating in partnership with law enforcement until this incident is resolved.
What do you know so far? What has the investigation revealed?
As stated above, local, state, and federal authorities are investigating every report we receive. We hope to know soon the timeframe that the credit/debit card readers contained an illegal skimming device.
How widespread is this issue?
The tampering has been confined to the self-checkout terminals ONLY and was found to have occurred in *24 Lucky store locations.
How do I know if my credit or debit card information was stolen?
Only by verifying and monitoring your credit/debit card accounts with your financial institution can you know if your information has been compromised.
To assist you, we have contacted our business partners, such as credit and debit processors, so that any potential or future discovery of customer account information being compromised can be identified in a timely manner.
What should I do if I used the self-checkout in the affected stores?
Save Mart/Lucky recommends that our customers who used credit/debit cards in the self-checkout lanes of the affected stores not only carefully monitor their bank or credit card statements relating to such cards but strongly consider closing their account and opening a new one. They should contact the applicable bank or credit card issuer immediately in the event of any fraudulent transactions.
We also strongly suggest contacting each of the three credit reporting bureaus and request they place a 90day fraud alert on your accounts.
Will you pay for credit monitoring?
If you are affected by fraudulent use of your credit/debit accounts and it is verified to have occurred at our store; we will assist you and work with your bank as well, on appropriate protection measures. Please contact our Customer Support Center toll-free at (800) 692-5710 for assistance.
Were your own employees involved?
At this point, we have no reason to believe that our employees were involved. Some of our employees have notified us of fraudulent activity on their accounts and we are investigating for them along with any reports from our shoppers.
Who can I contact at Save Mart to discuss this matter?
We sincerely regret this incident and apologize to you for any inconvenience or concern this may cause you. Please feel free to contact us toll-free at 1-800-692-5710 (MF 8 AM to 4:30PM).
If you have further questions, you may also contact the California Office of Privacy Protection at www.privacy.ca.gov.
*previously 23 stores