Credit card skimming will force changes at the pump
Skimming is reported to be a $16 billion business in the United States.
Credit card skimming at fuel pumps is a big deal – bigger than most people realize. That’s probably because most news stories about it are only reported in local media. Put those local stories together, though, and a bigger picture emerges.
Skimmers are illegal electronic devices that capture your credit card information when you insert it into an ATM or gas pump card reader. Fuel pumps are by far the most common place to find them. Crooks place them surreptitiously and use the information they collect to clone your card. They use that card to buy stuff and get cash advances.
According to local media reports, credit card skimmers have recently been found in such far-flung places as Edmond, Okla.; Mount Sterling, Ky.; Loudoun County, Va.; Prospect Park, Pa.; Lamar, Mo.; and Coso Junction, Calif. Gas pump skimmers found in West Des Moines, Iowa, led police to dozens more in Iowa and Nebraska. In March, The Associated Press reported “skimming operations across the West.” By all accounts, skimming is a $16 billion business in the U.S. and growing.
While skimming rarely makes the news in big-city markets, the Houston Chronicle called Houston, the fourth largest city in the nation with a population of 2.3 million, a “hotbed” of credit card skimming.
Florida may be the epicenter of credit card skimming. The Sunshine State reportedly has among the highest incidence of fraud in the union – credit card skimming included. CSP, a publication for convenience store operators, reported that in the last few years, state authorities found 2,400 skimmers during an inspection of 464,000 gas pumps at 19,000 gas stations, truck stops and marinas.
In fact, Florida lawmakers are considering a bill that would establish the Consumer Fraud, Identity Theft, and Skimmer Working Group. The group would assess the problem and report to the governor – not the strongest action, but better than nothing.
The feds have an eye on the skimming problem. In November, the U.S. Secret Service launched Operation Deep Impact. In a news release, the federal agency said it was a “nationwide initiative to find and remove credit card skimming devices installed on fueling station pumps.”
Initially, according to the release, more than 400 gas stations in 16 states had been searched, and nearly 200 skimmers were recovered from pumps. While skimming isn’t a critical priority for the agency charged with protecting the president and other top national officials, the Secret Service recovers from 20 to 30 skimmers a week. Those skimmers average information from about 80 cards each.
Skimming is considered credit card fraud and is therefore a federal crime carrying fat fines and long prison sentences. If you’re going to get caught skimming, you should hope it’s by the local cops or county sheriff.
You’re more likely to encounter skimming at a gas station than a truck stop, and then at stations where bad guys can avoid being seen, most likely at pumps farthest from the office or store. A thief has to open the front panel, maybe with a portable drill or even a key. Keys can be found on the internet or even bought from an underpaid, criminally-inclined clerk. Crude thieves simply pry panels open. An experienced thief can install the skimmer in as little as two minutes.
In the early days, a skimmer stored credit card information until it was retrieved. These days, skimming devices transmit data via Bluetooth to a receiver within 30 feet. A thief with a receiver can be gassing up at the next pump looking totally innocent while downloading your information.
How do truck stops deal with the skimming challenge? I contacted TA & Petro, Pilot Flying J, Love’s, and Natso (an association for truck stop operators) to find out. Only TA & Petro responded.
“We have mandatory inspections of the exterior and inside of the pumps for signs of tampering,” TA & Petro spokesman Tom Liutkus said in an email.
A program called We Care “teaches operators what to look for in the way of attached foreign devices on wires or circuit boards that indicate someone has attached a device,” he explained.
“It also uses a seal over the card reader box so you can tell if the box has been opened and tampered with. The seal changes color and adds messages that indicate something is wrong if it has been tampered with.”
According to Liutkus, the skimming threat at TA & Petro may be an issue at gas pumps but not for diesel.
“It is not an issue … Our pumps do not accept bank payment cards on the diesel side. If a driver uses a bank card, they must come inside the building and go to the fuel counter,” he said.
“We are currently testing bank payment cards at the diesel island, but thus far this is limited to a handful of sites, and We Care is in place there. If we expand this, the program would be applied to all sites with that payment capability. I have not heard of any instances yet where a diesel fuel card, say Fuel Man or Comdata, has been skimmed. But criminal technology is getting more sophisticated every day.”
The We Care program has been in place since 2011, Liutkus said.
So what should you do to protect yourself?
At the pump, experts say you should look for signs of a skimmer at the pump. The front panel is hinged on one side. Check the other side to see that it is sealed with security tape. They also recommend wiggling the card reader itself. If it’s loose, let the station manager or attendant know when you pay inside.
In fact, if you use a bank credit card or debit card you should always pay inside, at least until gas pumps are brought up to date with the rest of the retail world where card swiping has given way to card dipping.
Dipping refers to chip cards you insert into readers rather than swipe. Swipe readers read your information off the magnetic strip on the back of the card as you would read a newspaper. That data is not encrypted. The exchange of information between a card chip and chip reader is. Imagine trying to read a newspaper printed in code. You can’t do it without the key.
Encryption also applies to wireless mobile payments made from smartphones. Not many stations are equipped for that now, but most will be eventually.
Gas pumps were originally supposed to be ready for chip cards in 2017, but the credit card companies pushed the date back to 2020. Many stations are resisting the change because of the cost. Chip readers cost between $500 and $1,000 each. Upgrading a pump to accept mobile payment costs roughly $50.
It may or may not come in 2020, but change is coming to gas pumps for certain. Skimming is forcing the issue. LL