Chip card delay at gas pumps extends skimming fraud
By Lisa Bertagnoli | Published: March 7, 2017
Skimming, the practice of stealing credit-card information at gas pumps, is going for a repeat. It was a top scam trend for 2016, and shows no sign of letting up this year. Or next year. Or the year after that.
Why? Gas stations are getting more time to equip automated fuel pumps with EMV technology. EMV, short for Europay, MasterCard and Visa, the companies that created the standard, accepts chip cards, which the industry says are more secure than cards using magnetic-strip technology.
Visa and Mastercard have given fuel-station retailers an additional three years, until Oct. 1, 2020, to install EMV technology on gas pumps. Visa cited “the complicated infrastructure and specialized technology required for fuel pumps” as the reason for the deadline extension.
In addition to being complicated and specialized, gas pumps are highly regulated. After new technology is installed, authorities must inspect and recertify every pump. The fuel-station industry expects to spend nearly $4 billion retooling the country’s 800,000 pumps, according to Alexandria, Virginia-based Conexxus. Conexxus is the technology-and-standards arm of the National Association of Convenience Stores, a trade association for convenience stores and fueling stations.
[Thieves] have gotten so good at it that they don't draw attention to themselves.
|— Eva Velasquez
Identity Theft Resource Center
‘A known scam’
“It’s a known scam,” says Eva Velasquez, president and CEO of the Identity Theft Resource Center, a San Diego nonprofit that assists victims of identity theft. Thieves, she says, know how to leverage magnetic-strip technology. “As long as it’s available for use and lucrative, they will continue to use it,” she says.
Consumer behavior is also part of the problem, Velasquez says. Paying at the pump has become so part of the fueling-up ritual that it feels inconvenient to walk to the cashier to pay, a move that is safer in this age of rampant skimming.
Another reason why skimming might just continue unabated for the next three years: Thieves aren’t getting caught. Newfangled skimmers are small and nearly impossible to see, and thieves extract the data remotely, via Bluetooth or other technology. By the time the public realize a pump has been skimmer-outfitted, the thieves are on to the next pump and the next batch of victims. Thieves “have gotten so good at it that they don’t draw attention to themselves,” Velasquez says.
Will EMV end skimming?
EMV technology was designed to curtail fraud at brick-and-mortar locations. It’s more difficult for thieves to extract information from the chip technology than the magnetic strip, so it’s more difficult to create counterfeit cards. EMV technology does little, though, to prevent fraud when a physical card is not used, for instance during mobile or online transactions.
Its creators say EMV technology will deter skimmers because it will make stolen data nearly useless. With EMV technology, the chip in the card communicates with the chip in payment terminals, creating a unique code for each transaction, explains a Mastercard spokeswoman. By using a chip-and-pin card to fuel up, a customer fueling up at a gas station creates a unique code. That code would be part of the data package transmitted to a thief via a skimmer. When the thief used the stolen data, the unique code would appear again, instantly alerting a retailer to possible fraud.
Safe from skimming
In the meantime, skimmer scammers are nabbing even crime fighters.
In January, Indiana State Police discovered it had been the victim of skimming. Information on eight department-issued credit cards, used by troopers to fill up, had been stolen in December. The thieves rang up about $1,000 in charges before the fraud became evident. The department canceled all eight credit cards, says Sgt. John Perrine, public information officer for the department’s District 52 in Indianapolis.
As a result of its own situation, and reports of skimming incidences all over the state, Indiana State Police issued a tips guide for consumers. Here’s the advice:
|HOW DO I AVOID CARD SKIMMING AT THE GAS PUMP?|
|Use a pump close to the building or one that is in view of the cashier. Thieves are more likely to install skimming devices on pumps out of the way or out of view.|
Look at a pump before you use it. Be wary of wires hanging out of panels, or damaged or broken locks. All might be signs that the pump was tampered with.
Look at the surrounding pumps to make sure the one you’re about to use looks the same. If the pump looks odd, don’t use it, and report it to the attendant.
Check for a tamper-resistant seal on the pump's access panel.
When fueling up, use a card that doesn’t require a PIN, and avoid using a debit card. Zero-liability policies will most likely cover credit-card losses. With a debit card and a PIN, a thief can clean out your checking account in no time flat.
|If you have any doubts, go inside the station and pay in person.|
Review your credit-card statements each month for fraudulent charges, and report those charges, no matter how small. Criminals will often ring up a small charge, say, on iTunes, before using stolen data to make major purchases.
|Source: Indiana State Police|
Anti-skimming advice for retailers
The National Association of Convenience Stores advises its retailers to take precautions to prevent skimming, and protect what it says are the 39 million Americans who gas up their cars every day:
- Change the locks on gas pumps.
- Use and track pump security seals. These large labels are adhered to the pump, near the credit card reader. If the pump is opened, the label will read “void,” which means the machine has been tampered with.
- Shut down and bag suspect pumps, then have the machines checked for skimmers.
- Make pump inspection part of the daily routine for employees. Employees should make sure serial numbers on security stickers match the station’s master list, as thieves have developed counterfeit stickers.
In the meantime, retailers and consumers can expect that skimming will continue to occur at a brisk pace for the next three years. “Technology has its advances,” says Perrine of the Indiana State Police. “As soon as we think we can prevent this, thieves come up with new technology.”
- Will banks raise APRs if stripped of legal shield provided by arbitration? – Top regulators are feuding about the costs banks might pass on to customers if they're have to drop a shield from class-action lawsuits ...
- Debt relief firm that claimed ties to US government sued by CFPB – The Consumer Financial Protection Bureau sued two companies both known as FDAA for an allegedly illegal debt relief scheme targeting credit card debtors ...
- In the wake of Equifax hack, Congress proposes credit bureau reform – Lawmakers call for changes in credit report system to protect people's data, or at least give them more control over it ...