Customers question delay in reporting supermarket credit-card scam

As the credit-card fraud case involving scanners at self-checkout stands in Lucky supermarkets continued to grow Wednesday, some were questioning whether the store chain should have acted sooner to warn the public.

Company officials said the tampered payment card readers at a Santa Clara Lucky store along with 23 others in the Bay Area have all been replaced. 

But more people are coming forward claiming to have discrepancies in the balances of their bank accounts.

"Monday when I checked my bank account like I normally do online and I noticed that $300 was withdrawn," said scam victim Stephanie Romero.

Romero said the withdrawal was made shortly after she swiped her debit card at a self-checkout at a Lucky store in San Jose.

Then she learned others in her family also had unauthorized withdrawals from their bank accounts.

"I actually contacted my father in law because he also goes to Luckys a few times a week too and he had money withdrawn from his account too," said Romero. "500 dollars."

Save-Mart, the parent company of Lucky Supermarkets, said it has received more than 500 calls from customers worried or upset that their credit or debit card accounts have been breached by using self-checkout machines at 24 Lucky stores.

Lucky said someone put sniffer devices in its card readers to grab account information and personal identification numbers. Computer boards were placed inside the machines.

KTVU talked to an expert at a computer security company about the technology used.

"A sniffer is fundamentally concerned with pulling information off a network or a wire in some form as opposed to just the skimmer, which just bolts on the front and you're trying to get that magnetic stripe," explained Wade Williamson of Palo Alto Networks.

Lucky admitted finding the problem on November 11^th but not disclosing it until November 23rd. That delay has some customers upset.

"Now I don't feel safe using my debit card anywhere now really," said Romero.

The scope of this fraud is yet to be determined. A few years ago, there was a similar breach at Lunardi Supermarkets where the losses were put at $300,000.