In September 2010, some customers of the popular NoDa restaurant Cabo Fish Taco started noticing some strange charges on their credit cards.
Tiffany Moore, a frequent visitor to the the restaurant and fiancee of Creative Loafing's music editor Jeff Hahne, said she went to the restaurant back in September shortly before leaving Charlotte for a vacation.
"We came back home, and Jeff and I had used our check cards at the same place, one place in Charleston and together at Cabo," she said. "A week and a half after that, those two transactions went through and then there was attempted fraudulent charges with both of our card numbers. We, of course, assumed that it was the place in Charleston since it was out of town, and we didn't want to think that about Cabo."
According to Moore, someone in Conway, S.C., a town near Myrtle Beach and about three hours from Charlotte, tried to purchase more than $200 worth of groceries using her card number. The bank was able to pick up on the fraud because Moore had made a purchase in Charlotte an hour earlier.
When she and Hahne mentioned the incident to friends, they found at least five other people who were also the victims of credit card theft after recent visits to Cabo. This led them to put two and two together, and they contacted the restaurant.
Gary Walker, one of the restaurant's owners, said that in September, Cabo was getting calls from customers telling a story similar to Moore's.
"We have no idea what happened; it's hard to pinpoint where a card gets stolen, but what happened was we started getting calls from our customers and we called Visa Fraud the second that we noticed it happening," he said. "We also contacted our third party processor [the company that processes credit card payments] and they launched an investigation. We also contacted the Secret Service because they are the ones who investigate credit card fraud. They came in to investigate."
Walker said Cabo moved quickly because they wanted to make sure that it was not an employee responsible for the fraud. It wasn't, Walker points out.
Instead, Cabo and customers like Moore were victims of a 21st century era robbery where the thief uses the Internet and hacking skills rather than a gun.
According to Walker, Cabo had done what it was supposed to do to keep the credit card information safe. The restaurant was and still is following the Payment Card Industry Data Security Standard, which applies to all organizations or merchants, regardless of size or number of transactions, that accepts, transmits or stores any cardholder data. These security standards are supposed to keep customers safe when using their credit cards.
The Secret Service doesn't comment on ongoing investigations, according to a spokesman in the Charlotte office. But last November, the Secret Service uncovered similar cases on Capitol Hill in Seattle, Wash.
The Secret Service has so far refused to name any businesses involved in the Capitol Hill investigation but has made it clear that any business targeted in this breach is also a victim. Investigators believe that the Capitol Hill situation stems from a software or network breach, perhaps occurring over several months, that collected card information before that stolen information was passed onto a distribution network putting valid account information into the hands of thieves around the globe.
Here in Charlotte, Walker said thousands of dollars have gone into making the Cabo's credit card software more secure. The restaurant has made significant upgrades to its firewall and gotten a new server to process the credit card payments. And despite the fact that none of the staff were involved in the fraud attempts, Walker said once a card is swiped, no one in the restaurant has access to the numbers or the expiration date.
"We want everyone to know how seriously we take this," said Walker, who was a victim of credit card fraud at a restaurant himself. Maeghan Crenshaw, another owner of Cabo, has been reaching out to patrons who were victims of the hacking. According to Moore, she was very apologetic about the situation.
"This has been an eye-opener, actually," Moore said. "You have to be careful where you use your card and to check your account every two days to make sure that there isn't stuff on there that shouldn't be. I will definitely eat at Cabo again. But any restaurant I go to in the future, I will be much more likely to use cash."