As gas station skimmer card fraud increases, here's how to cut your risk
Smaller devices, greater security elsewhere make fuel pumps a target
By Lisa Bertagnoli | Updated: October 10, 2017
Skimmers at gas pumps are a growing threat, but some simple checks – and now even your smartphone – can cut the risk that your card data will be stolen when you’re filling up.
Before you put your card in any gas pump, look for a broken seal, jiggle the card reader, and check your cellphone’s Bluetooth to see if there is an unexpected, suspicious signal, experts say.
A free Skimmer Scanner Android app released in September 2017 scans for available Bluetooth connections looking for a device with title HC-05. How does it work? A blog post from SparkFun, the app maker, explains:
“If found, the app will attempt to connect using the default password of 1234. Once connected, the letter ‘P’ will be sent. If a response of ‘M’ then there is a very high likelihood there is a skimmer in the Bluetooth range of your phone (5 to 15 feet).”
If your smartphone detects a skimmer, use a different pump or go to a different gas station.
Why skimmers are now part of our everyday lives
Skimmers are popping up across the country, and here’s why:
technology is becoming more sophisticated.
Skimmers once were large-ish devices installed over the the real card reader and recognizable as out of place by discerning gas station patrons. Now, they’re as small as a thumb drive, hidden inside the pump and nearly impossible to detect.
- Fueling stations remain vulnerable targets.
Gas stations received a three-year extension to update pumps with chip-card readers, which accommodates credit cards with fraud-resistant electronic chips. That means card skimmers will be a threat at the pumps until at least October 2020.
‘Last bastion’ for thieves
Until fueling pumps are outfitted with EMV technology, pumps will read credit card magnetic stripes, “one of the last bastions” for thieves, says Eva Velasquez, president and CEO of the Identity Theft Resource Center, a San Diego-based nonprofit that assists victims of identity theft.
Magnetic-stripe technology, she says, lacks layers of protection. “If thieves know how to compromise that, that’s where they will go,” she says. “It’s lucrative – people wouldn’t do it if it wasn’t.”
“The devices are being found at small merchants, large merchants, urban, rural, new and old convenience stores, so nobody is exempt,” says Kara Gunderson, point-of-sale manager for Citgo Petrolum Corp.
Gas pumps, especially those in remote locations, are attractive targets, as their remoteness gives thieves time and privacy to install skimming devices.
The pumps most likely to get a skimmer: those off interstate highways, farthest from the cash register, says Gray Taylor, executive director at Connexus, which provides technology advice to NACS – the Association for Convenience and Fuel Retailing, and others in the industry.
Law enforcement officials agree that skimming is an issue at fuel pumps. “Criminals stay up on things just like the rest of us,” says Lt. John Faine, criminal investigations section commander in Warren County Sheriff’s Office, Lebanon, Ohio; one of several Ohio municipalities where skimmers have been found. “They see this as an opportunity.”
|GAS STATION SKIMMING: HOW BIG A RISK IS IT?|
There are no reliable statistics on the extent of skimming, since it is a local crime and not centrally tracked, but experts say it is on the rise. How big is the risk? According to the National Association for Convenience Stores:
The not-paying-attention factor
According to Faine, consumers are vulnerable at gas stations because fueling up has become a habit that doesn’t require much attention. “It’s such a matter-of-fact thing,” he says. “People have so many things on their mind – they don’t notice” if the credit card reader seems weird.
Some skimming victims have, in hindsight, remembered that the card reader had “a weird feeling, like the slot had been tampered with,” Faine says. “It wasn’t noticeable when it happened, but after the fact, they said, ‘You know what, it did feel like something was off when I put my card in.’”
Tips for consumers
Given the near-invisibility of the devices, it might not be possible to totally avoid a skimming scam. Still, consumers can take several steps to protect their cards at fueling stations. Among the options:
- Pay inside, with cash or a credit card,
rather than at the pump. Chances are good that thieves have not entered the
physical building to tamper with the pump.
- Be suspicious if the gas pump has a broken security seal, or the
word “void” appears on it. These are part of a voluntary program by the
industry to thwart gas pump tampering.
- Choose pumps closest to the physical
building, not the ones hidden around the corner.
- Use a credit card, not debit card, when you
pay. If a credit card number is skimmed, you’re playing with the bank’s money and protected by the card’s zero-liability policy. A stolen debit card number could yield far worse damage. “If a debit card gets compromised, and they have your PIN, you’ve just given
someone access to your cash,” says Velasquez of the Identity Theft
- Pay attention when fueling and if it feels
weird, don’t do it. Sometimes, thieves also swap out the card readers
attached to the skimmers. In those cases, they can deliver
an unusual feeling to the inserted card – it may stick or otherwise
not quite right. If that happens, cancel the transaction and pay
- Check your smartphone. If the Skimmer Scanner app detects a skimmer, move on. Find another fuel pump or gas station to fill your tank.
- Debt relief firm that claimed ties to US government sued by CFPB – The Consumer Financial Protection Bureau sued two companies both known as FDAA for an allegedly illegal debt relief scheme targeting credit card debtors ...
- In the wake of Equifax hack, Congress proposes credit bureau reform – Lawmakers call for changes in credit report system to protect people's data, or at least give them more control over it ...
- Poll: 1 in 4 Americans checked their credit after Equifax breach – The flood of post-breach consumer action is encouraging, but many still didn't check their credit ...