As gas station skimmer card fraud increases, here's how to cut your risk

Smaller devices, greater security elsewhere make fuel pumps a target

By  |  Updated: October 10, 2017

Gas station skimming on the rise

Skimmers at gas pumps are a growing threat, but some simple checks – and now even your smartphone – can cut the risk that your card data will be stolen when you’re filling up. 

Before you put your card in any gas pump, look for a broken seal, jiggle the card reader, and check your cellphone’s Bluetooth to see if there is an unexpected, suspicious signal, experts say.  

A free Skimmer Scanner Android app released in September 2017 scans for available Bluetooth connections looking for a device with title HC-05. How does it work? A blog post from SparkFun, the app maker, explains:

“If found, the app will attempt to connect using the default password of 1234. Once connected, the letter ‘P’ will be sent. If a response of ‘M’ then there is a very high likelihood there is a skimmer in the Bluetooth range of your phone (5 to 15 feet).”

If your smartphone detects a skimmer, use a different pump or go to a different gas station.

Why skimmers are now part of our everyday lives
Skimmers are popping up across the country, and here’s why:

  • Skimming technology is becoming more sophisticated.
    Skimmers once were large-ish devices installed over the the real card reader and recognizable as out of place by discerning gas station patrons. Now, they’re as small as a thumb drive, hidden inside the pump and nearly impossible to detect.
  • Fueling stations remain vulnerable targets.
    Gas stations received a three-year extension to update pumps with chip-card readers, which accommodates credit cards with fraud-resistant electronic chips. That means card skimmers will be a threat at the pumps until at least October 2020. 

‘Last bastion’ for thieves
Until fueling pumps are outfitted with EMV technology, pumps will read credit card magnetic stripes, “one of the last bastions” for thieves, says Eva Velasquez, president and CEO of the Identity Theft Resource Center, a San Diego-based nonprofit that assists victims of identity theft.

Magnetic-stripe technology, she says, lacks layers of protection. “If thieves know how to compromise that, that’s where they will go,” she says. “It’s lucrative – people wouldn’t do it if it wasn’t.”

“The devices are being found at small merchants, large merchants, urban, rural, new and old convenience stores, so nobody is exempt,” says Kara Gunderson, point-of-sale manager for Citgo Petrolum Corp. 

Gas pumps, especially those in remote locations, are attractive targets, as their remoteness gives thieves time and privacy to install skimming devices.

The pumps most likely to get a skimmer: those off interstate highways, farthest from the cash register, says Gray Taylor, executive director at Connexus, which provides technology advice to NACS – the Association for Convenience and Fuel Retailing, and others in the industry.

Law enforcement officials agree that skimming is an issue at fuel pumps. “Criminals stay up on things just like the rest of us,” says Lt. John Faine, criminal investigations section commander in Warren County Sheriff’s Office, Lebanon, Ohio; one of several Ohio municipalities where skimmers have been found. “They see this as an opportunity.”

GAS STATION SKIMMING: HOW BIG A RISK IS IT?

There are no reliable statistics on the extent of skimming, since it is a local crime and not centrally tracked, but experts say it is on the rise. How big is the risk? According to the National Association for Convenience Stores:

  • 37 million Americans refuel every day.
  • Of them, 29 million pay for fuel with a credit or debit card.
  • When skimming occurs at a gas station, it usually takes place at only one pump.
  • A single compromised pump can capture data from 30 to 100 cards per day.

The not-paying-attention factor
According to Faine, consumers are vulnerable at gas stations because fueling up has become a habit that doesn’t require much attention. “It’s such a matter-of-fact thing,” he says. “People have so many things on their mind – they don’t notice” if the credit card reader seems weird.

Some skimming victims have, in hindsight, remembered that the card reader had “a weird feeling, like the slot had been tampered with,” Faine says. “It wasn’t noticeable when it happened, but after the fact, they said, ‘You know what, it did feel like something was off when I put my card in.’”

skimming devices

Tips for consumers
Given the near-invisibility of the devices, it might not be possible to totally avoid a skimming scam. Still, consumers can take several steps to protect their cards at fueling stations. Among the options:

  • Pay inside, with cash or a credit card, rather than at the pump. Chances are good that thieves have not entered the physical building to tamper with the pump.

  • Be suspicious if the gas pump has a broken security seal, or the word “void” appears on it. These are part of a voluntary program by the industry to thwart gas pump tampering.

  • Choose pumps closest to the physical building, not the ones hidden around the corner.

  • Use a credit card, not debit card, when you pay. If a credit card number is skimmed, you’re playing with the bank’s money and protected by the card’s zero-liability policy. A stolen debit card number could yield far worse damage. “If a debit card gets compromised, and they have your PIN, you’ve just given someone access to your cash,” says Velasquez of the Identity Theft Resource Center.

  • Pay attention when fueling and if it feels weird, don’t do it. Sometimes, thieves also swap out the card readers attached to the skimmers. In those cases, they can deliver an unusual feeling to the inserted card – it may stick or otherwise feel not quite right. If that happens, cancel the transaction and pay inside.

  • Check your smartphone. If the Skimmer Scanner app detects a skimmer, move on. Find another fuel pump or gas station to fill your tank.

See related: 8 ways to protect against ATM skimming, “Shimming” is the latest fraud wrinkle


Join the discussion
We encourage an active and insightful conversation among our users. Please help us keep our community civil and respectful. For your safety, do not disclose confidential or personal information such as bank account numbers or social security numbers. Anything you post may be disclosed, published, transmitted or reused.

If you are commenting using a Facebook account, your profile information may be displayed with your comment depending on your privacy settings. By leaving the 'Post to Facebook' box selected, your comment will be published to your Facebook profile in addition to the space below.

The editorial content on CreditCards.com is not sponsored by any bank or credit card issuer. The journalists in the editorial department are separate from the company's business operations. The comments posted below are not provided, reviewed or approved by any company mentioned in our editorial content. Additionally, any companies mentioned in the content do not assume responsibility to ensure that all posts and/or questions are answered.




Updated: 10-23-2017

Weekly newsletter
Get the latest news, advice, articles and tips delivered to your inbox. It's FREE.


ADVERTISEMENT