CHICAGO – Michaels Stores says the debit-card fraud stemming from altered checkout-line terminals at its stores is not isolated to the Chicago region, but is spread across 20 states.

Michaels identified 90 key pads that were tampered with in the states of Illinois, Colorado, Delaware, Georgia, Iowa, Massachusetts, Maryland, North Carolina, New Hampshire, New Jersey, New Mexico, Nevada, New York, Ohio, Oregon, Pennsylvania, Rhode Island, Utah, Virginia and Washington.

Debit-card fraud is worse for consumers than credit-card fraud. In the case of Michaels stores, many customers had money stolen directly from their bank accounts via ATM withdrawals.

The company said it has started replacing PIN pads in all U.S. stores and expects the replacement to be completed within the next 15 days.

Michaels’ checkout-line swipe terminals were probably tampered with or swapped out for other machines by thieves who stole account numbers and secret PIN codes, experts say. As a result, Michaels customers have reported having money taken from their bank accounts, often in the amount of $503, and often at cash machines in California.

Many customers reported that banks have replaced most or all of the missing money. Harris Bank, for example, has said that for this particular breach, it will reimburse customers the full amount. And Chase banks are reportedly doing the same.