Debit Card Fraud Strikes Aldi Grocery-Store Customers

A rash of debit card fraud has hit customers of the discount supermarket chain Aldi, though its extent and methodology have not been divulged. Criminals obtained customers’ PINs and card numbers in the Midwest to make unauthorized ATM withdrawals in other states, especially California.

Batavia, Ill.-based Aldi’s case is different from most retail card fraud because the chain, owned by Germany-based Aldi Süd, accepts only cash and PIN-debit cards, including public-benefits cards, though it has tested credit cards (Digital Transactions News, Sept. 14, 2009). Aldi says the fraud is the result of “tampering” with debit card terminals. That suggests fraudsters placed skimmers on point-of-sale terminals to capture card data, though the company refuses to provide details.

Local press reports about fraud at Aldi appeared earlier this month in Chicago’s northwest suburbs. About 210 customers who had shopped at Aldi stores in Wheeling and nearby Buffalo Grove reported to police that fraudulent ATM withdrawals were being made on their bank accounts, according to the Daily Herald, Arlington Heights, Ill. The Pioneer Press community newspaper reported that some of the withdrawals occurred in Chicago and its suburbs, and a few came from Ohio, but the majority happened in the Los Angeles area, typically for about $500.

On Sept. 17, Aldi, which has about 1,000 U.S. stores, issued a statement saying the company “was recently notified that the security of a limited number of debit card terminals at some stores may have been compromised through tampering designed to steal customers’ payment card information. Aldi has conducted a thorough review of all stores nationwide and removed terminals that may have been affected.” Aldi did not disclose the number or locations of the terminals. The company did say it was working with law-enforcement officials but “in order to protect the integrity of the investigation” would not release further details.

Last weekend, however, more press reports emerged about similar fraud involving Aldi shoppers. At least 30 residents of St. Charles, Ill., a suburb about 35 miles west of Chicago, reported to local police since Sept. 16 that their debit card information had been used to make fraudulent ATM withdrawals in California, according to the Daily Herald. Sheriff’s investigators in surrounding Kane County, Ill., also said they had received complaints of about 20 similar incidents from shoppers living in rural areas, and other reports came in from the nearby small town of Elburn. Meanwhile, WRTV Channel 6 in Indianapolis reported that city police received at least six reports from shoppers who had visited an Aldi store in one part of town stating that their card numbers were being used for ATM fraud, mostly in California and usually for about $500. A couple that had shopped at a different Aldi store also told the station that they were victims of card fraud.

While related fraud in two separate metropolitan areas suggests the possibility of the breach of a centralized database, an Aldi spokesperson tells Digital Transactions News by e-mail that that is not the case. “This involves tampering of a limited number of debit card terminals,” the spokesperson says. “Other than that, we’re still working closely with law-enforcement officials to assist in their investigation, and in order to protect the integrity of the investigation, we’ve been asked not to provide additional information at this time.”

The U.S. Secret Service is involved in the probe, according to the Daily Herald.