The store is most likely *not* liable: business are generally not responsible for the criminal actions of their employees, since criminal acts are, by definition, not part of the employee's responsibilities or job. To hold the business liable, you'd generally have to prove that the business knew that this employee was a risk to do this (e.g. he or she had done it before at this store) but still gave him or her access to the debit card numbers.