Secure Your Pump
By Sarah Hamaker
It has all the makings of a ratings bonanza—wily thieves, hidden devices, unsuspecting customers and potential losses in the thousands of dollars. No wonder the media has latched on to skimming as a popular news story these days. Unfortunately, reporters don’t have to look very far to find examples.
A quick Google search turns up more than 30 news stories from March 2016 about skimming devices discovered at gasoline pumps in at least a dozen states. A November 2015 NBC “Nightly News” segment reported that skimming devices bilked consumers to the tune of $2 billion in 2014.
“News reports of skimming incidents at gas stations seem to come out on a weekly, if not daily, basis,” said Luke Grant, director of payment and marketing applications for Gilbarco Veeder-Root North America. “This is an indication that thieves are looking to take advantage of gaps in security at older dispensers before retailers upgrade their payment systems for EMV prior to October 2017.”
Traditionally, skimmers have been found at high volume sites located off interstates on the West and East Coasts. While those locations continue to be popular, more localized gangs are now targeting smaller stations in the upper Midwest as well.
“As skimmers found at gasoline stations keep making headlines, law enforcement officials are becoming more frustrated with retailers, especially those who have had more than one incident at a site,” said Gray Taylor, executive director at Conexxus and NACS consultant on card payment security. “If we don’t correct this problem, law enforcement—and the public—will stop looking at us as victims and start to treat us as complicit.”
Basically, there are two primary types of skimming devices used at gas pumps to siphon off customer card data: internal and external skimmers. “The more prevalent are internal skimmers, which are small devices that illegally capture card data when connected to legacy payment components inside the dispenser,” Grant said.
Thieves have become craftier when it comes to implanting skimming devices, and some of these internal skimmers are Bluetooth-enabled, thus allowing the data to be captured remotely. The external skimming devices are overlaid on the card reader or keypad to keep the appearance of the original components.
Jay Ricker, owner of Ricker’s, a 50-store chain in Indianapolis, has seen firsthand how devious skimmer thieves are. “From the surveillance video, we saw how the thieves sent someone inside the store to keep the clerk busy and used their vehicle placement to shield the pump,” he said of a recent skimming incident at a Ricker’s near metro Indianapolis.
“These criminals are well-educated and are taking advantage of new technology, such as smaller devices with more memory and wireless capabilities,” said Tim Weston, manager of technology solutions for North America at Wayne Fueling Systems. “As skimmers get more creative and the device technology shrinks, it will be harder to detect when skimmers have been implanted.”
One of the simplest ways to prevent fraudulent tampering at the pump is by placing a NACS WeCare decal across the span between the terminal body and the access doors. The stickers show a VOID message if someone tampers with the placement.
However, for the decals to work most effectively, employees need to check on them regularly and keep detailed records of each visual inspection. The new SkimDefend app (powered by the Pinnacle Corporation) aims to enhance the WeCare process by making it easier and more streamlined.
“The app will replace a paper system for tracking the decals with an electronic log book that provides real-time data,” said Doug Spencer, director of products and services for NACS. Basically the app, now in beta-testing before a national rollout, will scan and log the unique characteristics and serial numbers of each WeCare decal and locally store the site, time, pump number and decal ID information. The app will be available for download on any Android or Apple smartphone or tablet.
“The beauty of the app is that it will quickly scan the decal and alert the employee if the number is counterfeit or voided, making the process of checking a decal much more user-friendly and accurate,” Spencer said.
NACS will have the app available for widespread use soon, and will provide the app free to NACS members. Later add-ons will include cloud-based storage and the ability to share information across multiple devices. For more information on the SkimDefend App, visit www.nacsonline.com/wecare.
Retailers can’t afford to ignore skimming—even in areas that haven’t previously been targeted. “Two or three years ago, thieves hit the big name chains with high volume gas sales, but now skimmers are showing up at secondary stations,” Taylor said. “They’re going after non-branded, small operators and taking advantage of the fact that those retailers often have no pump security program in place to stop them.”
The biggest challenge for retailers isn’t only the loss of customer data—it’s the damage to their brand. “When retailers get on the news because of a skimming incident at their location, they need to be able to reassure the public that they are doing all they can to combat skimming,” Weston said.
When a device was discovered at a Ricker’s store, Ricker immediately got in front of the camera to let customers know how seriously his company approached security. “We did news interviews as well as a segment for our pump TV loop,” he said. “We also put signs at the pump as to what we were doing to keep customer card data safe.” That quick action brought public opinion over to his side.
Skimming has also become an issue at the state level, with a couple of states specifically targeting skimming at gasoline stations with recent laws or other changes. In late March, Florida enacted a law, supported by the Florida Petroleum Marketers and Convenience Store Association, that requires fuel retailers to increase security measures to combat skimming. Meanwhile, the Minnesota Department of Commerce tasked its enforcement and weights and measures divisions to conduct sweeps of gasoline dispensers across the state searching for skimmers.
Fortunately, retailers can hinder the installation of skimmers at their pumps, with protective options ranging from low cost to high cost. “There are three simple steps retailers can take that will cost them [less than] $500 and will make their pumps secure,” Taylor said.
- Change the locks on the dispensers.
- Use NACS WeCare stickers properly, on both pumps and indoor terminals and ATMs.
- Monitor the stickers and pumps frequently to check for tampering.
Another low-cost item involves educating employees. “Training store personnel to be on the lookout for signs that skimming devices are being installed or have been installed is the simplest way to combat skimmers,” Grant said. Signs of tampering include indications of forced entry inside the dispenser, abnormal-looking components on the dispenser’s exterior, and suspicious vehicles parked at the pump for extended periods of time.
Weston also pointed out that thieves like to target gas pumps farthest from the store entrance. “Employees need to actively monitor the gas pumps with routine, visual inspections looking for scratches, loose panels or other physical tampering evidence on the dispensers,” he advised.
Some retailers have gone even further, such as Ricker’s, which recently announced that it was investing $150,000 to protect customer data at the pump. The company had already begun to upgrade its energy management system, and added a component to check for skimming devices. The electronic system will alert company officials within 11 seconds of the dispenser being tampered with, then place the pump out of order until someone physically checks the dispenser.
“Customers don’t want their data stolen, and we’ve got to be proactive in protecting the security of our transactions,” Ricker said. “Customer reaction has been extremely positive, with many telling us that they use Ricker’s to buy gas because of the measures we’re taking—even after news reports of finding skimmers at some of our locations.”
Like it or not, skimming is here to stay, at least until all gasoline retailers upgrade to EMV chip readers at the pump. But retailers can take proactive steps to protect the security of customer card data and their own reputation.
“If you have a skimmer device installed at your pumps, it’s a huge attack on your brand, no matter how big or small you are,” Taylor said. “You don’t want to become the poster child for the public’s outrage about skimming.”
Sarah Hamaker is a freelance writer and NACS Daily and NACS Magazine contributor based in Fairfax, Virginia. Visit her online at www.sarahhamaker.com.