Gas prices are low, but consumers are finding a different kind
of pain at the pump: Having credit card information stolen via
skimmers installed in gas pumps. It's happening more and more, and
experts say skimming is likely to continue to rise in 2016 due to
One is skimming technology, which is becoming more
sophisticated. Skimmers once were large-ish devices set atop
machines and recognizable as out of place to the discerning
machine-user. Nowadays, they're as small as a thumb drive and much
more difficult to detect.
Second, along with most ATMs, fueling stations have until
October 2017 to update pumps with EMV technology, which
accommodates credit cards with electronic chips. Why? Time and
money. Gas pumps are highly regulated objects. After the new
technology is installed, local authorities must inspect and
re-certify every single pump. The industry will spend $3.9 billion
retooling the country's 800,000 fuel pumps, according to Gray
Taylor, executive director of Alexandria, Virginia-based Conexxus.
Conexxus is the technology-and-standards arm of the National
Association of Convenience Stores, a trade association for
convenience stores and fueling stations.
'Last bastion' for thieves
Until fueling pumps are outfitted with EMV technology, they will
read credit card magnetic stripes, "one of the last bastions" for
thieves, says Eva Velasquez, president and CEO of the Identity
Theft Resource Center, a San Diego-based nonprofit that assists
victims of identity theft. Magnetic-stripe technology, she says,
lacks layers of protection. "If thieves know how to compromise
that, that's where they will go," she says. "It's lucrative --
people wouldn't do it if it wasn't."
It's a serious enough problem that Conexxus held a webinar on
the topic in December 2015. Its title: "Defending the Island."
"The devices are being found at small merchants, large
merchants, urban, rural, new and old convenience stores, so nobody
is exempt," says Kara Gunderson, point-of-sale manager for Citgo
Petrolum Corp., who moderated the webinar.
Gas pumps, especially those in remote locations, are attractive
targets, as their remoteness gives thieves time and privacy to
install skimming devices. The pumps most likely to get a skimmer:
those off interstate highways, farthest from the cash register,
says Taylor of Conexxus.
Law enforcement officials agree that skimming is an issue at
fuel pumps. "Criminals stay up on things just like the rest of us,"
says Lt. John Faine, criminal investigations section commander in
Warren County Sheriff's Office, Lebanon, Ohio; one of several Ohio
municipalities where skimmers have been found. "They see this as an
According to Faine, consumers are vulnerable at gas stations
because fueling up has become a habit that doesn't require much
attention. "It's such a matter-of-fact thing," he says. "People
have so many things on their mind -- they don't notice" if the
credit card reader seems weird. Some skimming victims have, in
hindsight, remembered that the card reader had "a weird feeling,
like the slot had been tampered with," Faine says. "It wasn't
noticeable when it happened, but after the fact, they said, 'You
know what, it did feel like something was off when I put my card
While there are no national statistics about the crime, it's
clearly ratcheted higher. For example:
- Warren County has called the Federal Bureau of Investigation
to help find the forces behind a recent rash of skimming. To
date, Faine's office has seized skimming devices, but no thieves.
Elsewhere in Ohio, officials are asking gas station owners to
improve locks on pumps to deter skimmer installers.
- In Florida, after a 2015 sweep by Department of Agriculture
officials turned up 150 gas station skimmers,
was proposed in November stiffening requirements placed on gas
station owners and penalties for skimming. The bill passed its
first legislative hurdle in January.
- In California, the Ventura County Sherrif's Office launched "
Operation Take Back the Pumps
" to inspect all 1,500 gas pumps in the county in August. Three
devices were found.
- New York's Gov. Andrew Cuomo in November
a statewide crackdown that includes new training for inspectors
to spot skimmers. An initial sweep of gas pumps uncovered six
Tips for consumers
Given the near-invisibility of the devices, it might not be
possible to totally avoid a skimming scam. Still, consumers can
take several steps to protect their cards at fueling stations.
Among the options:
- Pay inside, with cash or a credit card, rather than at the
pump. Chances are good that thieves have not entered the physical
building to tamper with the pump.
- Be suspicious if the gas pump has a broken security seal, or
the word "void" appears on it. These are part of a voluntary
program by the industry to thwart gas pump tampering.
- Choose pumps closest to the physical building, not the ones
hidden around the corner.
- Use a credit card, not debit card, when you pay. If a credit
card number is skimmed, you're playing with the bank's money and
the card's zero-liability policy
. A stolen debit card number could yield far worse damage. "If a
debit card gets compromised, and they have your PIN, you've just
given someone access to your cash," says Velasquez of the
Identity Theft Resource Center.
- Pay attention when fueling and if it feels weird, don't do
it. Sometimes, thieves also swap out the card readers attached to
the skimmers. In those cases, they can deliver an unusual feeling
to the inserted card -- it may stick or otherwise feel not quite
right. If that happens, cancel the transaction and pay
Tips for retailers
The National Association of Convenience Stores and Conexxus are
also issuing precautions for retailers. NACS's website contains a
skimming resource guide
. In 2012, Conexxus set up a database available to members for
retailers to report and track skimming incidents.
- Change the locks on gas pumps.
- Use and track pump security seals. These large labels are
adhered to the pump, near the credit card reader. If the pump is
opened, the label will read "void," which means the machine has
been tampered with.
- Shut down and bag suspect pumps, and have the machine checked
- Make pump inspection part of the daily routine for employees.
"You'll see stories out there where the employee found the
skimmer because they were doing exactly what we said," says
Taylor. He adds that thieves can have counterfeited security
stickers, which is why, during daily inspection, employees should
make sure serial numbers on the stickers match the station's
Following those precautions should stop thieves from installing
skimmers, and protect the innocent roadster who's just trying to
gas up. "There's no excuse for a merchant to get skimmed," says
Taylor. "Our theory is, if we have one skimmer in the industry,
it's too much."
Video: Card skimming
8 ways to protect against ATM skimming
Gas card survey finds pedestrian rewards