Research and Statistics

Chip card delay at gas pumps extends skimming fraud


Lack of EMV technology means pumps easily compromised by crooks

The editorial content below is based solely on the objective assessment of our writers and is not driven by advertising dollars. However, we may receive compensation when you click on links to products from our partners. Learn more about our advertising policy.

The content on this page is accurate as of the posting date; however, some of the offers mentioned may have expired. Please see the bank’s website for the most current version of card offers; and please review our list of best credit cards, or use our CardMatch™ tool to find cards matched to your needs.

Skimming: the sequel

Skimming, the practice of stealing credit-card information at gas pumps, is going for a repeat. It was a top scam trend for 2016, and shows no sign of letting up this year. Or next year. Or the year after that.

Why? Gas stations are getting more time to equip automated fuel pumps with EMV technology. EMV, short for Europay, MasterCard and Visa, the companies that created the standard, accepts chip cards, which the industry says are more secure than cards using magnetic-strip technology.

Visa and Mastercard have given fuel-station retailers an additional three years, until Oct. 1, 2020, to install EMV technology on gas pumps. Visa cited “the complicated infrastructure and specialized technology required for fuel pumps” as the reason for the deadline extension.

In addition to being complicated and specialized, gas pumps are highly regulated. After new technology is installed, authorities must inspect and recertify every pump. The fuel-station industry expects to spend nearly $4 billion retooling the country’s 800,000 pumps, according to Alexandria, Virginia-based Conexxus. Conexxus is the technology-and-standards arm of the National Association of Convenience Stores, a trade association for convenience stores and fueling stations.

[Thieves] have gotten so good at it that they don’t draw attention to themselves.

\u2014 Eva Velasquez
Identity Theft Resource Center

 \u2018A known scam’
“It’s a known scam,” says Eva Velasquez, president and CEO of the Identity Theft Resource Center, a San Diego nonprofit that assists victims of identity theft. Thieves, she says, know how to leverage magnetic-strip technology. “As long as it’s available for use and lucrative, they will continue to use it,” she says.

Consumer behavior is also part of the problem, Velasquez says. Paying at the pump has become so part of the fueling-up ritual that it feels inconvenient to walk to the cashier to pay, a move that is safer in this age of rampant skimming.

Another reason why skimming might just continue unabated for the next three years: Thieves aren’t getting caught. Newfangled skimmers are small and nearly impossible to see, and thieves extract the data remotely, via Bluetooth or other technology. By the time the public realize a pump has been skimmer-outfitted, the thieves are on to the next pump and the next batch of victims. Thieves “have gotten so good at it that they don’t draw attention to themselves,” Velasquez says.

Will EMV end skimming?
EMV technology was designed to curtail fraud at brick-and-mortar locations. It’s more difficult for thieves to extract information from the chip technology than the magnetic strip, so it’s more difficult to create counterfeit cards. EMV technology does little, though, to prevent fraud when a physical card is not used, for instance during mobile or online transactions.

Its creators say EMV technology will deter skimmers because it will make stolen data nearly useless. With EMV technology, the chip in the card communicates with the chip in payment terminals, creating a unique code for each transaction, explains a Mastercard spokeswoman. By using a chip-and-pin card to fuel up, a customer fueling up at a gas station creates a unique code. That code would be part of the data package transmitted to a thief via a skimmer. When the thief used the stolen data, the unique code would appear again, instantly alerting a retailer to possible fraud.

Safe from skimming
In the meantime, skimmer scammers are nabbing even crime fighters.

In January, Indiana State Police discovered it had been the victim of skimming. Information on eight department-issued credit cards, used by troopers to fill up, had been stolen in December. The thieves rang up about $1,000 in charges before the fraud became evident. The department canceled all eight credit cards, says Sgt. John Perrine, public information officer for the department’s District 52 in Indianapolis.

As a result of its own situation, and reports of skimming incidences all over the state, Indiana State Police issued a tips guide for consumers. Here’s the advice:

Use a pump close to the building or one that is in view of the cashier. Thieves are more likely to install skimming devices on pumps out of the way or out of view.
Look at a pump before you use it. Be wary of wires hanging out of panels, or damaged or broken locks. All might be signs that the pump was tampered with.
Look at the surrounding pumps to make sure the one you’re about to use looks the same. If the pump looks odd, don’t use it, and report it to the attendant.
Check for a tamper-resistant seal on the pump’s access panel.
When fueling up, use a card that doesn’t require a PIN, and avoid using a debit cardZero-liability policies will most likely cover credit-card losses. With a debit card and a PIN, a thief can clean out your checking account in no time flat.
If you have any doubts, go inside the station and pay in person.
Review your credit-card statements each month for fraudulent charges, and report those charges, no matter how small. Criminals will often ring up a small charge, say, on iTunes, before using stolen data to make major purchases.
Source: Indiana State Police


Anti-skimming advice for retailers
The National Association of Convenience Stores advises its retailers to take precautions to prevent skimming, and protect what it says are the 39 million Americans who gas up their cars every day:

  • Change the locks on gas pumps.
  • Use and track pump security seals. These large labels are adhered to the pump, near the credit card reader. If the pump is opened, the label will read “void,” which means the machine has been tampered with.
  • Shut down and bag suspect pumps, then have the machines checked for skimmers.
  • Make pump inspection part of the daily routine for employees. Employees should make sure serial numbers on security stickers match the station’s master list, as thieves have developed counterfeit stickers.

In the meantime, retailers and consumers can expect that skimming will continue to occur at a brisk pace for the next three years. “Technology has its advances,” says Perrine of the Indiana State Police. “As soon as we think we can prevent this, thieves come up with new technology.”

See related: The big chip card switch: a year of living with EMVWhat ID thieves do with the financial data they stealGas station skimmer theft rising

What’s up next?

In Research and Statistics

CFPB reports credit reporting industry doing better

The CFPB has made strides to protect consumers from credit report mix-ups, but it may not live to finish the job

Published: March 3, 2017

See more stories
Credit Card Rate Report Updated: December 4th, 2019
Cash Back

Questions or comments?

Contact us

Editorial corrections policies

Learn more

Join the Discussion

We encourage an active and insightful conversation among our users. Please help us keep our community civil and respectful. For your safety, do not disclose confidential or personal information such as bank account numbers or social security numbers. Anything you post may be disclosed, published, transmitted or reused.

The editorial content on is not sponsored by any bank or credit card issuer. The journalists in the editorial department are separate from the company’s business operations. The comments posted below are not provided, reviewed or approved by any company mentioned in our editorial content. Additionally, any companies mentioned in the content do not assume responsibility to ensure that all posts and/or questions are answered.