'It's A Big Scam': Retailers Respond To Gift Card Theft

NORTH TEXAS (CBSDFW.COM) - Larry Vining is a retired auditor who gardens with the same precision he keeps his personal books.

"I'm a little OCD I guess so I keep very good records."

That makes it pretty easy for Vining to lay out how he just got ripped off.

"Here's the receipt where we bought it -- $175," says the Dallas resident as he points to his receipts.

For years, he and his wife have bought gift cards, because they recieve a cash back bonus on them from their credit card company.

"We usually go to Kroger and buy a whole bunch of gift cards that will pretty much last us the whole year and we use them for gas and groceries."

Vining marks the amount on the cards and saves his receipts.

"Here's the last one. We spent $11 and something brought the balance to $105.16, which is the amount that is hacked."

Vining showed CBS 11 News how he diligently keeps up with his record keeping.

But when that $105 balance suddenly turned to zero, he knew he had a problem. "It's a big scam evidently."

And it's the same problem he saw CBS 11 News report just after Father's Day.

Reporter Ginger Allen mailed a gift card to her dad, and before it ever made it to California, thieves used the card in Dallas by "keying" in the card account number at a North Dallas Outback restaurant. The receipt is noted with the word "keyed."

It's the same story with Vining. Thieves drained the balance on two of his Kroger gift cards by simply using the numbers at sister grocery stores called Ralphs in California all while he and his actual cards were in Dallas.

Another Texas viewer who saw the I-Team's first story emailed CBS 11 News also. His BJ's restaurant gift card was used in Pennsylvania. In an email, he said he'd "never been to Allentown in his life."

An attorney at the Federal Trade Commission's Dallas office explained how the hackers likely got the Outback Steakhouse card number and PIN.

"Some of them will just do it the really old school way," FTC staff attorney M. Hasan Aijaz said. "They'll go into the establishment, pen and paper and start writing down numbers. In other instances, they figure it out using algorithms and lastly they'll skim it using something similar to a credit card skimmer."

What Aijaz calls "gift card draining," is a fairly new and common technique for thieves, he said.

Allen visited several Dallas-area grocery and convenience stores and found that it's easy to see the account numbers on many gift cards.

Some have silver zebra-like stickers covering the pin but the Aijaz says hackers simply buy those on line to replace the old ones once they record the numbers. They then return the cards to store shelves and use sophisticated software to track when you buy them and load them up with cash.

If this happens to you, you should contact the retailers.

--Outback gave Allen a replacement, and told the I-Team the company recently updated their cards so they are not as easily hacked.

--The viewer who had the BJ's gift card followed up telling Allen the restaurant chain sent him a new card "in less than 24 hours."

--And Kroger sent CBS 11 News the following statement:

"If a customer detects their purchased Kroger gift card has been compromised, a customer should contact customer service; information can be found on the back of the card. Our fraud department will research the transactions and inform the customer of all activities. If the card is confirmed as compromised, pending each case, a refund is issued. In some cases, we also encourage customers to work with the local police. In the case of Mr. Vining, he was indeed issued a refund on July 19. However, it takes 7- 10 business days to receive the payment. The safety of our customers is paramount and we aim to provide the best shopping experience for all of our customers. We will continue to actively monitor this issue."

Vining told Allen he will stick to gardening and detailed bookkeeping, but gift cards?

"I think the gift cards days are done," he said.

BUYING A GIFT CARD?
--You should purchase it directly from a retailer where they are right up by the register.
--Consider sending e-cards on line.
--And, if you do buy from a grocery or convenience store, dig to the back to get a card that has less likely been handled and hacked.