New Michigan law intended to curb ‘skimming’ at fuel pumps

A new law in Michigan requires fuel stations to put in place protections intended to prevent payment card “skimming” at fuel pumps.

The devices are attached to external fuel pump payment card readers. The small devices, or “skimmers,” are designed to steal and store debit and credit card data. The data can then be retrieved and used for fraudulent purchases or activities.

An analysis for the legislation reports that the state of Michigan has found more than 80 skimmers in use since 2015.

Advocates, including Sen. Wayne Schmidt, R-Traverse City, say action is necessary in Michigan to protect consumers. They say scammers can easily gain access to a pump’s scanning mechanisms. A skimming device can be installed within seconds and are relatively easy to hide inside of fuel pumps. The criminal returns later to retrieve the stolen information, which can be used to make fake credit cards and fraudulent purchases.

Previously SB415, the new law establishes specific security measures that fuel stations must employ to restrict unauthorized access of customer payment card information.

Fuel pumps in the state must have one or more of the following:

• Tamper-proof security tape over the panel opening leading to the scanning device;
• Encryption of payment card information;
• A device or system to make the pump or scanning device inoperable if the panel is opened without proper authorization; and
• A device to replace a manufacturer-supplied standard lock or any other measure approved by the Department of Agriculture and Rural Development.

“This bill helps better protect customers’ credit or debit cards by increasing security requirements for technology that collects and processes this sensitive information,” Gov. Rick Snyder said in prepared remarks.

Schmidt, the bill sponsor, points out that police also recommend consumers give card readers a firm pull before inserting their card. He adds that many in the industry consider this to be the best way to determine if a pump has been tampered with because if a pump has been hacked, consumers will likely be able to pull the whole unit out.

The new law takes effect on Feb. 19.