Hackers are stealing money from Starbucks mobile customers using linked credit cards, putting nearly 16 million customers using the company's Starbucks app at risk.
Starbucks is the latest victim of scammers, cybercriminals who steal money from the credit or debit card linked to Starbucks customers' accounts.
The attack is fairly simple for the crooks, the criminal just needs the user credentials for the Starbucks account, which can of course be easily stolen with a phishing campaign. Criminals could also steal the credentials through keylogging, using credentials leaked from other data breaches, or through password bruteforcing.
According to journalist Sullivan, hackers siphoned Starbucks customers through the Starbucks app and exploited the auto-reload feature.
Victims received an email pretending to be from Starbucks informing them that their username and password had been changed. Once the scammers managed to gain access to the victim's Starbucks account, they could transfer the funds on the victim's gift card from the Starbucks app to another gift card they controlled in order to withdraw the funds later.
The worst-case scenario for the victim occurs when the auto-load feature is enabled on the Starbucks account, because in this case additional funds are automatically loaded onto the Starbucks card whenever the credit runs low.
According to a source within the company, the scams have been going on since at least January. Starbucks explained that it is already taking steps to protect its customers and urged users to report any suspicious activity on their accounts.
Of course, it is recommended that all Starbucks consumers immediately disable the auto-reload feature on Starbucks mobile payments and gift cards.
