Theft of shoppers' PC Plus points prompts Loblaw warning

An Ottawa man is allegedly one of the fraudsters behind a much larger scam that involves stealing shoppers PC Plus points used to redeem money off their grocery bill.

Ottawa police arrested and charged the 21-year-old with theft under $5,000 after security at the Loblaws store on Isabella street caught him trying to buy hundreds of dollars worth of gift cards using a PC Plus points number that wasn't his.

The theft was reported a month ago, before the supermarket chain started alerting its 10-million members that the PC Plus system has been the target of fraud.

"In recent weeks, we have observed some unusual activity on select PC Plus accounts," said a PC Plus email sent to members on Feb. 20. "Our investigation indicates that the PC Plus system has been the target of fraud, resulting in some members having their points stolen." 

Gift cards 'popular purchases' with stolen points

Across Canada, Loblaw has temporarily suspended all customers from using their PC points to buy gift cards, pre-paid cards or phone cards. These are "popular purchases" with stolen points, according to a statement to CBC News from Loblaw Companies Ltd.

The supermarket chain, with more than 2,000 stores across Canada, believes shoppers' passwords are being exposed through "third party websites or weak passwords."

"Right now, we understand it has affected a small percentage of our more than 10 million members, and we continue to reach out directly to individual members when we observe unusual activity or missing points," the company said.

Ottawa shopper Carmen-Louise Lepin knows first hand what it's like to have her identity stolen.

More than a year ago, someone set up five credit cards in her name, then racked up $18,000 in charges in one day alone. Now there's news her PC Plus card could be compromised too. Her credit card is attached to her points card.

"They should be more proactive and [have] people dedicated for cyber security, for cyber attacks for the hacking," said Lepin. 

Loblaw has reset all of its members passwords and is asking customers via email to change it to a "new, unique one."

But Debbie-Lynn Cantin, another Ottawa member, thought the email was spam and pressed delete. She still hasn't changed her password and has had a PC Plus points card since day one.

"It's scary," said Cantin. "It's a sad society that we've come to this point. That people feel they need to scam other people to get ahead in life. That's not how it should be."

Change your credit card pin too, warn police

Ottawa police are warning shoppers to change their credit card pin number right away.

Staff-Sgt.Stephanie Burns, who oversees organized fraud investigations, worries shoppers' credit card information could also be compromised. 

"My concern is if there is credit card information attached, is it possible that credit card information is breached?" Burns said. 

Burns personally, doesn't have a PC Plus account because she felt the company's application asked for too much personal information. 

"For me, on that day when I was filling it out, I just didn't feel right about the information," said Burns. "If you're going to give me points why do you need to know the day I was born? What difference does it make?"

"If something in your back of your mind tells you it's not a good idea, then maybe it's not?" she said, adding that she's not against points cards but wants people to be wary if they feel uncomfortable.

Loblaw is also asking anyone who thinks their PC points have been stolen to contact them. The company says it is reimbursing members who had their points stolen.