Caught up in what law enforcement sources say could become one of the Bay Area's biggest-ever cases of credit card "skimming," some customers of the Lucky grocery chain groused Wednesday that the company should have done more to keep them safe from data thieves.
"It seemed odd that this many stores could have had people doing this totally unnoticed," Barry Shiller, a public relations consultant in Burlingame, said a day after Lucky urged some shoppers to cancel their credit cards or close their checking accounts. The company did so following the discovery that self-checkout machines in 23 stores around the region had been tampered with.
Shiller -- who patronizes the Millbrae Lucky that was one of those targeted -- said two unauthorized withdrawals for "hundreds of dollars" were made from his Wells Fargo checking account over the weekend from a San Francisco ATM. Noting that store officials have said the skimming hardware was discovered in the guts of the checkout machines, he asked why clerks stationed to help customers use the kiosks wouldn't have noticed anything suspicious.
Alicia Rockwell, a spokeswoman for Lucky's Modesto-based parent, Save Mart, did not return requests for comment Wednesday. But Tuesday she said the tampering could have been performed by someone pretending to be using the checkout machines to buy groceries.
And Save Mart Chief Financial Officer Stephen Ackerman told The Associated Press that the thieves had been able to access the skimming devices wirelessly after installing them, making it unnecessary to risk discovery by returning to the stores to retrieve the devices and harvest the data.
Once a shopper's card number has been recorded by a skimming device, experts say, it's a relatively simple step to transfer that information onto new cards. That's how a fraudster would be able to take a customer's money via an ATM even if the customer's card remained in his or her wallet.
Still, one person close to the investigation suggested the outbreak may have been due more to lax security at Lucky's than to a ring of scam artists looking to target more big retail chains.
"I would not say this is a widespread thing because most retailers are cognizant of this and have procedures and technology in place to prevent it," said this person, who did not want to be identified so as not to interfere with the ongoing investigation.
At the same time, the person added, "Criminals are not stupid about the calendar. They understand that folks are loading up their savings and checking accounts with Christmas money. 'Tis the season."
Ackerman told this newspaper Tuesday that suspicions at Lucky first emerged Nov. 11, when an employee performing routine maintenance on a self-checkout machine at an unnamed store noticed something "that just didn't look right."
The company worked with the maker of the checkout machine, San Jose-based VeriFone, to confirm that the unauthorized computer board was recording customers' financial information. Save Mart simultaneously began inspecting its 237 other stores in Northern California and Nevada.
Save Mart warned customers about the problem Nov. 23, after it had removed the so-called "sniffer" devices from the affected checkout stands. Each of the 23 targeted Lucky stores contained one tampered machine, Ackerman said.
When it first announced the scam had been uncovered, the company said it was unaware of any customer accounts being compromised. But Monday, calls began pouring into the supermarket chain from people saying their bank and credit accounts had been accessed without their permission.
While the total number of those affected remains unknown, the latest reports are that more than 1,500 people have called the company's customer service hot line, and 300 of them have reported their cards had been accessed or that an attempt had been made to access them.
The company is urging people who used self-checkout lanes at the affected stores in October or November to contact their financial institutions and close their accounts.
Rockwell said Save Mart has sent transaction records from the tampered checkout machines to a data security firm that will work with banks to verify whether customers were indeed ripped off after shopping at Lucky.
Ackerman said the U.S. Secret Service, which oversees credit card fraud, counterfeiting and other financial crimes, is investigating the thefts and hopes to learn more in coming weeks about just when the card-reader tampering began.
Dan Schott, resident agent in charge at the San Jose Secret Service office, would not comment for this report, other than to praise Lucky for being "very cooperative with law enforcement during this investigation."
That was cold comfort to Bob Liu, a Sunnyvale engineer who said $2,000 was taken from his E-Trade account after he used a check card to shop at a Lucky store. The thieves used an ATM in Pasadena.
"I woke up on Monday morning getting automatic phone calls from Visa about reviewing my transactions," Liu said. "By that time, it was already too late."
Lucky isn't the only merchant that's been targeted by skimming devices. Readers contacted this newspaper Wednesday to say they'd recently been victims of card skimming after shopping at area Safeway and 7-Eleven stores.
Although it's unclear how much this will affect Lucky's bottom line, some customers are already threatening to do their shopping elsewhere.
Joseph Bautista, of Union City, said someone withdrew $180 from his Bank of America account over the weekend using a Mountain View teller machine -- while he was traveling in Ohio as a consultant for Newt Gingrich's presidential campaign.
Bautista frequently shops at the Union City Lucky that was among those where store officials discovered doctored checkout machines. But, he said, "I'm probably not going to do business at Lucky any more."
Contact Peter Delevett at 408-271-3638. Follow him at Twitter.com/mercwiretap.
Here is a list of the Lucky outlets that were affected by the skimming incident.
Fremont: 5000 Mowry Ave.; 35820 Fremont Blvd.
Hayward: 25151 Santa Clara St.
CONTRA COSTA COUNTY
1515 Sloat Blvd.
SAN MATEO COUNTY
SANTA CLARA COUNTY
San Jose: 5510 Monterey Highway; 200 El Paseo de Saratoga; 844 Blossom Hill Road; 3270 S. White Road.
Santa Clara: 234 Saratoga Ave.
Petaluma: 939 Lakeville Highway
Source: Save Mart Supermarkets