Michaels customers are at a potential risk of identity theft after debit card terminals at dozens of locations were breached.
The popular craft store confirmed finding 90 compromised pin pads in 80 of its stores. Authorities say the scam may have covered as many as 20 states. Click here for a list of the stores impacted.
Some customers had money stolen directly from their bank accounts via ATM withdrawals, according to The Chicago Tribune.
Chicago-area residents Jennifer Gatz and Brandi Ramundo helped unravel the case. The women didn't know each other but had told mutual friends about missing money from their accounts.
Their friends then introduced the two on Facebook and they soon discovered they both had recently shopped at Michaels.
"I couldn't believe it. It's such a well-known store. It's a huge chain," Gatz said.
"There had to be some type of skimming device that was capturing it and assuming our pin numbers," Ramundo added.
Crooks used the women's debit card information from the check-out line to withdraw money from their accounts.
"They were from ATMs that were from nowhere that I've ever been to," Gatz recalled.
Experts say numerous crime rings know how to replace or reprogram the pin pads used by retailers across the nation, and capture customers' card and pin numbers.
"When we're using a technology as old as a magnetic strip on a card that can easily be duplicated, it makes it extremely easy for the criminals to clone our cards and steal our identities," explained security consultant Chris O'Ferrell.
Criminals can also buy card cloning machines on the Internet, which was likely done by the Michaels thieves.
Michaels customers are urged to check their bank accounts and keep monitoring them for any suspicious activity.
Unfortunately, there are fewer consumer protections for debit transactions, so those who feel their account has been accessed should report the activity to their bank as soon as possible.