Criminals steal money from Starbucks app users with weak passwords by loading gift cards using their stored payment methods
Jose Pagliery / CNNMoney :
Context & Ripple Effects
CNNMoney's report lands early in the life cycle of stored-payment consumer apps: Starbucks lets customers keep a card on file and reload gift cards from their phones, which means a guessed or reused password is now enough to spend real money without ever touching a physical card. It is the account-takeover counterpart to the point-of-sale breaches that dominated restaurant coverage around it — Earl Sandwich and Planet Hollywood's PoS breach and the later 5.3M-card Hy-Vee dump tied to compromised gas pumps and coffee shops both stole card numbers at the register, while this attack goes after the app layer on top of them.
First-order effects
- Users whose Starbucks credentials were weak or reused have money charged directly to their stored cards via fraudulent gift-card loads, and Starbucks faces the immediate support burden of refunds, credential resets, and disputed charges.
Second-order effects
- Every loyalty and payments app in food retail is pushed toward stronger authentication than a lone password — the same pressure that later exposed the limits of SMS-based verification when Coinbase lost funds to an SMS multi-factor flaw, pushing vendors past phone-number codes entirely.
Third-order effects
- If the pattern holds, fraud migrates from stealing card numbers to hijacking the accounts where cards are already tokenized — the trajectory visible in thieves shoulder-surfing iPhone passcodes to loot financial apps and in phished card data being minted into new wallets, making identity verification rather than card security the industry's control point.
The trend: Payment fraud is migrating from physical card capture at registers to account takeovers of apps that store payment credentials, forcing the industry to treat authentication itself as the perimeter.