Cindy Grewal, owner of the Food Stop 24 Hours convenience store on Commercial Drive in Vancouver, says a woman recently came in and refunded $900 to herself using the debit pad while the clerk was distracted.
"She came in and did it so professionally, and we want to put a stop to it because $900 is a lot of money and, as the police stated to staff, five other stores were hit the same way," she said.
Grewal replayed the security camera footage for CBC News, and it showed a woman and her friend entering the convenience store.
The woman wanders around for a bit, and then comes to the clerk's counter to purchase cigarettes. She has her hands full with a bouquet and, while the debit transaction is pending, she asks the clerk to take the flowers and give them to her friend.
The clerk, distracted, doesn't notice that the woman then cancels the debit transaction and then quickly makes a series of pin pad pushes.
What she's actually doing is using the debit terminal's default administrative code to make an override. She then enters a refund for $900, which gets credited to a debit account. The woman then clears the transaction, rips out the printout, and tells the clerk the cigarette purchase didn't go through.
The clerk rings up the cigarettes again and the woman pays for them with the debit card, and then leaves.
Grewal said it wasn't until later in the day when balancing the register that she realized anything was amiss.
Grewal said she didn't know that the debit terminals came shipped with a default common administrative code. She now wants to warn other store owners to change their codes.
The police would not speak about this case nor comment on whether any other stores were hit this same way, but confirmed that there is an active investigation.
No one has been arrested and police aren't confirming the couple seen in the security footage Grewal showed CBC News is involved.
Grewal says the company that provided the store's pin pad has told her there is nothing it can do.
Grewal also said it appears the bank card being used was somehow faked.
Also on HuffPost