Gas station skimmer theft rising
Smaller devices, greater security elsewhere make fuel pumps a target
By Lisa Bertagnoli | Updated: September 2, 2016
Gas prices are low, but consumers are finding a different kind of pain at the pump: Having credit card information stolen via skimmers installed in gas pumps. It's happening more and more, and experts say skimming is continuing to rise in 2016 due to two factors.
One is skimming technology, which is becoming more sophisticated. Skimmers once were large-ish devices installed over the the real card reader and recognizable as out of place by discerning gas station patrons. Nowadays, they're as small as a thumb drive, hidden inside the pump and nearly impossible to detect.
Second, along with most ATMs, fueling stations have until October 2017 to update pumps with EMV technology, which accommodates credit cards with electronic chips. Why? Time and money. Gas pumps are highly regulated objects. After the new technology is installed, local authorities must inspect and re-certify every pump. The industry will spend $3.9 billion retooling the country's 800,000 fuel pumps, according to Gray Taylor, executive director of Alexandria, Virginia-based Conexxus. Conexxus is the technology-and-standards arm of the National Association of Convenience Stores, a trade association for convenience stores and fueling stations.
(Update: Since the publication of this story, gas stations' deadline to switch to EMV cards was extended to 2020.)
'Last bastion' for thieves
Until fueling pumps are outfitted with EMV technology, they will read credit card magnetic stripes, "one of the last bastions" for thieves, says Eva Velasquez, president and CEO of the Identity Theft Resource Center, a San Diego-based nonprofit that assists victims of identity theft. Magnetic-stripe technology, she says, lacks layers of protection. "If thieves know how to compromise that, that's where they will go," she says. "It's lucrative -- people wouldn't do it if it wasn't."
"The devices are being found at small merchants, large merchants, urban, rural, new and old convenience stores, so nobody is exempt," says Kara Gunderson, point-of-sale manager for Citgo Petrolum Corp. She moderated a Conexxus webinar on skimming in December 2015. Its title: "Defending the Island." Gas pumps, especially those in remote locations, are attractive targets, as their remoteness gives thieves time and privacy to install skimming devices. The pumps most likely to get a skimmer: those off interstate highways, farthest from the cash register, says Taylor of Conexxus.
Law enforcement officials agree that skimming is an issue at fuel pumps. "Criminals stay up on things just like the rest of us," says Lt. John Faine, criminal investigations section commander in Warren County Sheriff's Office, Lebanon, Ohio; one of several Ohio municipalities where skimmers have been found. "They see this as an opportunity."
The devices are being found at small merchants, large merchants, urban, rural, new and old convenience stores, so nobody is exempt.
|-- Kara Gunderson
Citgo Petroleum Corp.
According to Faine, consumers are vulnerable at gas stations because fueling up has become a habit that doesn't require much attention. "It's such a matter-of-fact thing," he says. "People have so many things on their mind -- they don't notice" if the credit card reader seems weird. Some skimming victims have, in hindsight, remembered that the card reader had "a weird feeling, like the slot had been tampered with," Faine says. "It wasn't noticeable when it happened, but after the fact, they said, 'You know what, it did feel like something was off when I put my card in.'"
While there are no national statistics about the crime, it's clearly ratcheted higher. For example:
- State officials in Arizona warned its consumers to be on the lookout over the Labor Day weekend after a spike in the devices. Inspectors found 24 in August 2016 alone.
- County auditors in Ohio announced they will conduct a skimmer sweep over the Labor Day weekend after 30 devices were found installed in a dozen counties.
- Florida also warned consumers to beware after finding nine skimmers in August 2016.
- After 70 devices were found, the Michigan Department of Agriculture and Rural Development warned about gas station skimming devices.
Tips for consumers
Given the near-invisibility of the devices, it might not be possible to totally avoid a skimming scam. Still, consumers can take several steps to protect their cards at fueling stations. Among the options:
- Pay inside, with cash or a credit card, rather than at the pump. Chances are good that thieves have not entered the physical building to tamper with the pump.
- Be suspicious if the gas pump has a broken security seal, or the word "void" appears on it. These are part of a voluntary program by the industry to thwart gas pump tampering.
- Choose pumps closest to the physical building, not the ones hidden around the corner.
- Use a credit card, not debit card, when you pay. If a credit card number is skimmed, you're playing with the bank's money and protected by the card's zero-liability policy. A stolen debit card number could yield far worse damage. "If a debit card gets compromised, and they have your PIN, you've just given someone access to your cash," says Velasquez of the Identity Theft Resource Center.
- Pay attention when fueling and if it feels weird, don't do it. Sometimes, thieves also swap out the card readers attached to the skimmers. In those cases, they can deliver an unusual feeling to the inserted card -- it may stick or otherwise feel not quite right. If that happens, cancel the transaction and pay inside.
- Change the locks on gas pumps.
- Use and track pump security seals. These large labels are adhered to the pump, near the credit card reader. If the pump is opened, the label will read "void," which means the machine has been tampered with.
- Shut down and bag suspect pumps, and have the machine checked for skimmers.
- Make pump inspection part of the daily routine for employees. "You'll see stories out there where the employee found the skimmer because they were doing exactly what we said," says Taylor. He adds that thieves can have counterfeited security stickers, which is why, during daily inspection, employees should make sure serial numbers on the stickers match the station's master list.
Tips for retailers
The National Association of Convenience Stores and Conexxus are also issuing precautions for retailers. NACS's website contains a skimming resource guide. In 2012, Conexxus set up a database available to members for retailers to report and track skimming incidents.
Last year, Conexxus updated its skimmer-resource package for gas station operators, advising them to take the following precautions:
Following those precautions should stop thieves from installing skimmers, and protect the innocent roadster who's just trying to gas up. "There's no excuse for a merchant to get skimmed," says Taylor. "Our theory is, if we have one skimmer in the industry, it's too much."
- DIY credit card arbitration: You may be able to opt out – Consumers can preserve their right to go to court instead of private arbitration in many cases by going through and opt-out process ...
- CFPB rule: Consumers should be able to band together and sue – Banks, GOP oppose measure that would end "mandatory arbitration" clauses that prevented class-action suits ...
- Bluesnarfing is newest card fraud at gas pumps and ATMs – With a skimmer and Bluetooth technology, fraudsters can sit nearby and intercept your payment transaction details ...