Back around 2003 a coworker thought she left her credit card at a store (I think Target). She called them, they asked her to read the number off of the receipt, pulled up the video of her transaction, and told her she had put the card back in her wallet/purse.
I was surprised they had that level of integration and can't imagine what they've got these days.
On the one hand, I'm not surprised at all that there are security people in the company that can instantly pull up security cam footage of a register from the receipt number. That makes total sense.
But on the other hand, I never would have guessed that a customer service rep would have access to the system -- or even that if they had to transfer it to the security department, that the security department would be allowed to use the footage for anything customer-facing like that.
Still, that's kinda cool and helpful! Assuming it can't be used for any kind of nefarious invasion-of-privacy uses...
Although someone could probably watch your fingers at the checkout lane put in your pin. Camera script to correlate fingers to access pins automatedly. Machine vision is so much more advanced. Four finger movements, four numbers, tada, debit card access. I could probably write that with ML Kit.
Correlated to your exact receipt, purchases, and time of purchase (with enough fidelity to say "you put your card in your pocket at ##:##"). Track your card through the system, and what bank/clearing house is passing the transaction. When did this exact number amount of money go through and where did the lines send the data? What account was the final transaction processed through?
Maybe I'll mess up on the PIN, too, to throw people off (although that's probably caused by not being able to see the numbers).
They could also use sound to detect the keypress, but I'm hoping any legit retailer hasn't gone that far, yet.
I'd guess your friend was forwarded to an asset protection person at the store or similar.
Also, in this case, there's not much sensitive about "we saw you put it in your purse."
It'd be a different story if your friend had asked "Did you see what 4-number code I entered on the PIN pad?"
https://www.washingtonpost.com/archive/politics/2006/01/29/r...
https://www.theatlantic.com/technology/archive/2017/04/csi-w...
It's hard to keep competency from developing when you have (frequent, sophisticated attacker) + (financial motive to fund countermeasures and resourcing).
(Albeit some retail still seems to find a way)
I think the real answer is that Kroger simply does not take operations seriously. Theres evidence for this in their app, their self checkout experience, how often sales are not applied, the quality of their produce, how dirty the stores are, the way their merger and acquisition stores are all 1/3 integrated, and more im sure