Midstream & Downstream Petroleum News


Ascend Retail News


Credit card skimming is a problem for gas stations, but can be prevented


As mentioned in a previous report detailing thieves stealing diesel and gasoline to sell on the black market, the way these criminals typically obtain the fuel is through copying customer credit cards at point-of-sale terminals at pumps, and using the stolen information to purchase fuel.

Skimming technology has grown increasingly advanced in recent years, with devices evolving from large and obvious machines placed over actual card readers, to small and inconspicuous gadgets the size of flash drives that are installed internally, according to a report by CreditCards.com.

Fueling stations are particularly vulnerable to these activities, and criminals choose them for a variety of reasons.

Many gas stations are still using magnetic strip technology rather than the more secure EMV systems that use electronic chips. Eva Velasquez, president and CEO of Identity Theft Resource Center, a nonprofit that assists victims of identity theft, told CreditCards.com that EMV technology has more layers of protection than magnetic strip-based card readers, and criminals target pumps with strip scanners because they are easier to exploit.

"If thieves know how to compromise that [magnetic scanners], that's where they will go," she says. "It's lucrative — people wouldn't do it if it wasn't," said Velasquez.

The deadline for mandatory EMV use at fueling stations was recently pushed back from Oct. 1, 2017 to the year 2020 so more fuel vendors have time to comply with the regulation. But this also gives thieves more time to take advantage of those businesses that have yet to make the transition.

Card readers at fuel pumps are used frequently by customers throughout the course of a day, especially in high-traffic stations just off interstate highways.

Lieutenant John Faine, commander of the criminal investigations unit at the Warren County Sheriff's Office in Lebanon, OH, has experienced skimmers is in his municipality, among others in the state. He told CreditCards.com that for most consumers, filling up at the pump has become so second nature that most people may not pay close attention to any oddities in the card reader they use. Customers could be having their cards copied at the pump and be none the wiser because there are other things on their minds.

A high-tech criminal enterprise

According to a report by Kebron Security, many skimming devices use Bluetooth technology to wirelessly transmit customer card data to a remote mobile device controlled by the criminals. However, as is the case with Bluetooth connections, their links can be detected by anyone using a Bluetooth-enabled device.

But there are now reports of investigators in New York finding internally installed skimming devices that use SMS text messaging technology to send stolen card information to a criminal's mobile device.

These text-based skimmers are constructed from rebuilt cell phones with active SIM cards from service providers. Messages can be delivered in real time to any location in the world so that criminals don't ever have to return to the pumps they installed skimmers on.

This method of transmission has been used to steal card information at ATMs for years, but it is a new development in the world of skimming at fuel pumps. Skimming devices are often purchased on the dark web, but they can be homemade if a criminal is especially tech savvy.

According to investigators, installing a skimming device is usually a multiperson operation that involves the use of a master key. Many pumps around the country can be opened using the same key, and if criminals obtain it they can access a pump's internal components in seconds.

In a typical scheme, one crew member distracts the gas station attendant while one or multiple vehicles pull up alongside a pump, blocking the attendant's view. A crew member then opens the pump and installs the skimmer device between the components connecting the card reader to the pump's computer.

Skimmers target gas stations that lack security cameras and pick pumps furthest away from the gas station clerk.

"The devices are being found at small merchants, large merchants, urban, rural, new and old convenience stores, so nobody is exempt," said Kara Gunderson, point-of-sale manager for Citgo Petrolum Corp., to CreditCards.com.

According to NPR, once a card's information is copied, customer data can be placed on any number of blank cards that have magnetic strips on them. Hotel key cards, gift cards and naked credit cards can all be uploaded with stolen customer data and used at any magnetic card reader.

Things gas stations can do to prevent card skimming

The problem of card skimming is starting to affect more parts of the country outside the areas along Interstate 10 on the nation's southern border, where the crimes are committed most often between Los Angeles, CA, and Miami, FL, according to an Associated Press article.

Local sources The Bellefonte Examiner and WJBK Fox2Detroit stated investigators in Ohio and Michigan searched tens of thousands of pumps in 2016 after both reported numerous cases of criminals installing skimming devices at gas stations during the previous year.

But in addition to active intervention by professional investigators, gas station owners can employ a few tactics to prevent criminal card copying at their businesses.

  • Change locks on pumps to prevent access with a master key and ensure they are complex enough to prevent entry via lock pick.
  • Check each pump for skimming devices on a daily basis.
  • Apply security seal stickers to pump access points and post a sign notifying customers that if the seal is broken, they should contact staff immediately and use another pump.
  • Shut down functionality in pumps suspected of being tampered with and put bags over them.
  • Highlight the fact that pumps are inspected daily to make customers aware they are safe using your devices.

The National Association of Convenience Stores set up a resource guide for preventing skimming on their website, and members of Conexxus, the NACS's technology and standards advisor, have access to a database where retailers can report incidents of skimming.

Downstream Petroleum News provided by FireStream WorldWide, intuitively automated software solutions for the downstream petroleum industry. Go see a one-minute video to see how Ascend Retail can give a competitive edge to your C-Store operation.