Are Thieves Hacking the Starbucks App?

» Get Patch’s daily newsletter and real-time news alerts.

By BEA KARNES and CHARLENE ARSENAULT (Patch staff)

If you use a Starbucks app or gift card for payment and it’s linked to your credit card to automatically reload, you could be vulnerable to the latest hack attack.

But Starbucks says don’t blame the coffee chain, blame yourself for using the same password everywhere and for never changing those passwords.

Here’s how the scam works:

A hacker gains access to your gift card or app by simply entering the correct password and draining the balance by transferring the money to another Starbucks gift card. When the balance hits zero, it automatically reloads because it’s attached to your credit card. The thief can then drain the balance again, repeating as many times as they choose.

NBC News tells the story of Maria Nistri who lost the $34.77 balance from her card, and then had another $100 transferred from her credit card and stolen. The whole scam took just minutes.

Also on Patch:

• Your Kid’s in Jail and 9 Other Scams to Watch Out for in 2015
• Don’t Fall for Email Scam; How to Really Find Sexual Predators Living Near You
• Terrifying Phone Scam Reaches Michigan

In an online statement, Starbucks reports that its system was not breached, but individual accounts are being accessed.

“Occasionally, Starbucks receives reports from customers of unauthorized activity on their online account,” the statement read. “This is primarily caused when criminals obtain reused names and passwords from other sites and attempt to apply that information to Starbucks. To protect their security, customers are encouraged to use different user names and passwords for different sites, especially those that keep financial information.”

Remedy

• Change your password
• Disable auto-reload on your card or app

Several victims told CNNMoney they became aware of the fraud when they reived email confirmation that funds were being reloaded to their Starbucks accounts. One customer said the thief drained $115 from her bank account in a matter of a few seconds.

Cybersecurity firms are encouraging Starbucks to add authentication processes that ensure more security.

______________

Photo via Starbucks.com