She was a crime victim, but she didn’t find out about it until her credit card statement arrived in the mail a month later.

Connie Florez would eventually learn that her credit card information was stolen by a Maryland man and used to buy hundreds of dollars worth of items, first from Walmart based in Arkansas and $1,400 worth of merchandise from the Wayfair online retailer based in Massachusetts.

The evidence for how this happened, Florez says, points to a pay station at the Honolulu Zoo parking lot on Kapahulu Avenue, where a skimmer apparently was used to capture her credit card information. The vendor that operates the pay station disputes her conclusion.

But Florez says the mainland purchases were each made right after she used her card at the zoo parking lot two months in a row.

“I feel totally vulnerable,” said Florez, a filmmaker and producer who runs Hula Girl Productions in Honolulu. “It makes me feel like we should go back to quarters and that we’d be better off not going with the credit card to buy things.”

Florez appears to be the latest victim of a crime that costs consumers and financial institutions more than $1 billion a year and has been occurring around Honolulu of late.

A credit card skimmer is a device that is attached to an actual card reader. The skimmer scans or “skims” credit or debit card information anywhere the cards can be swiped. Criminals use the data to create fake debit or credit cards and then steal from victims’ accounts.

Honolulu police last week were warning the public about credit card skimmers after they were discovered at self-checkout registers at grocery stores across the island.

QSI Inc., the company doing business as Times Supermarket Inc., came forward to warn of a “data breach” and the possibility that unknown actors may have obtained access to the personal information of some of its customers.

A spokesperson for the company declined to be interviewed Monday, saying an investigation into the incident is continuing. But the company did issue a news release saying that on July 27 credit card skimmers were discovered on certain self-checkout pin pads at the Times Supermarket in Kahala.

QSI President Kazuhiro Matsumoto said the company took immediate steps to secure the self-checkout registers there and launched a chainwide investigation that found skimmers at five more Times Supermarket locations: Beretania, Kaimuki, Aiea, Mililani and Kunia.

Credit card numbers, security codes (if typed in), card expiration dates, names and addresses were all vulnerable, he said.

But “we have no evidence that any information has been subject to actual or attempted misuse,” Matsumoto said.

There was no mention of how long the skimmers were stealing customers’ information.

“QSI takes the confidentiality, privacy, and security of information in our care seriously. Upon discovery, we immediately commenced an investigation to confirm the nature and scope of the incident. We are taking steps to implement additional safeguards and review policies and procedures relating to data privacy and security,” he said.

Matsumoto added that, “We offer our sincerest apology that this unfortunate incident occurred.”

According to FICO, a data analytics company, card skimming is surging in the United States. In 2022, total compromised cards were up 368% from 2021, with more than 161,000 impacted cards identified. Nearly 3,000 unique financial institutions were affected in 2022, representing a 79% increase.

To help avoid being a victim, authorities recommend always inspecting automated teller machines and point-of-sale terminals and other card readers before using. Look for anything loose, crooked, damaged or scratched, and don’t use any card reader if you notice anything out of the usual.

The Honolulu Police Department recommends checking for alignment issues between the card reader and the panel underneath it. Skimmers often sit on top of the actual card reader, making it stick out at an odd angle or cover arrows in a panel. Compare the card reader to a neighboring terminal, ATM or gas pump. They should all look the same.

If you suspect that a terminal has been tampered with, notify an employee immediately, police said. If you suspect that your card may have been skimmed, contact your credit card company. It is also a good practice to routinely monitor your account to detect fraudulent activities, experts say.

The Federal Bureau of Investigation said fuel pump and similar kinds of skimmers are often attached in the internal wiring of the machine and aren’t visible to the customer. The devices store data to be downloaded or wirelessly transferred later.

Florez wasn’t thinking about skimming when she used the pay station at the zoo parking lot May 28. She was meeting friends for breakfast at Queen’s Surf Beach.

A month later she found mysterious Walmart charges on her credit card statement for $230 on May 30 and $120.73 on May 31. She decided to check her credit card company’s app to see if there were any more recent charges, and that’s when she found a June 23 charge for $1,400 from Wayfair. She had returned to the zoo parking lot the day before, on June 22.

Florez said she’s made three phone calls to the credit card company, Citibank, and the largest charge still remains outstanding pending an investigation.

“I’m still waiting to resolve this so I can close (the account),” she said.

Meanwhile, an official with parking lot vendor ProPark Inc. said no one has ever complained about having their credit card information stolen in the five-plus years the company has overseen parking at the zoo.

Kel Kanbe, ProPark assistant operations manager, said there are 10 pay stations covering a lot with more than 200 stalls. The 10 industry-standard pay stations, he said, are checked at least once a day.

“If somebody is skimming there, wouldn’t we have more people saying their information was being stolen there?” he said. “Let’s just say I’m a little skeptical (of the skimming charge).”

Florez said Citibank suggested that skimming was the culprit and that it likely occurred at the zoo parking lot. It also makes sense, she said, considering the timing of the charges.

Florez said she wouldn’t mind throwing her credit cards away but she can’t because of her business.

“Always check your credit card statements,” she advised. “And if you have the app, use it.”