With more than 30 million Americans refueling their cars every day, there’s a good chance they’re paying with a debit or credit card.
In early 2020, 77% of drivers paid by plastic (44% by credit and 33% by debit card) but by May 2020, when coronavirus-related concerns emerged and consumers sought to minimize personal contact, a whopping 86% of fuel customers paid by plastic.
An average fill-up takes 3 to 5 minutes and is relatively simple. But there is a lot of complexity behind the scenes related to payments and how paying by cash, credit or debit affects the refueling experience. Here’s some common topics related to payment cards and fueling.
Skimming is when a third-party card-reading device is installed either outside or inside a fuel dispenser, which allows a thief to illegally capture a customer’s credit and debit card information.
Skimming is not a data breach or hacks, which involves massive amounts of stolen consumer data. During a skimming attack, skimmers are used to replicate the payment information on a card and often leads to a criminal using that information to make fraudulent purchases, as opposed to creating fraudulent identities.
There are two types of skimmers:
External skimmers, which can be quickly installed by criminals who don’t need to gain access to the inside of a dispenser. The most common technique is a keypad overlay that records the information entered. This type of skimmer has become less common because most single DES (Data Encryption Standard) keypads have been upgraded to triple DES. The difference is a single DES keypad is a flat membrane and the triple DES keypad is “full travel,” which means the keys are distinct like on a computer keyboard.
Here’s what to look for:
- Is the keypad raised to an unusually high level? While thin, the overlays should be obvious.
- Is the keypad secure? Overlays may feel loose compared to a proper keypad. Run your finger around the keypad to see if it is secure.
- Look for telltale visuals. If a keypad appears new yet the rest of the dispenser is weather beaten, that could be a signal an external skimmer has been recently installed.
Internal skimmers are attached inside a fuel dispenser and are more difficult to install. For one, a criminal has to use a universal key to open the dispenser door. They often leave signs of forced entry: A panel door may appear misaligned or there are other telltale signs like scratches and marks.
To guard against this type of skimmer, retailers regularly inspect their dispensers to detect signs of entry. Many use tamper-evident labels to help identify whether a skimming device is inserted into a fuel dispenser. If a dispenser door is opened, a “void” message appears on the label, providing a visual cue for store employees. Because the labels indicate that they prevent tampering, they also show the community that the retailer is doing its part to protect customer data and discourage criminals targeting the store.
If a customer believes a dispenser may have been comprised, the first course of action is to treat the area as a crime scene. First, do not touch anything and alert the store staff so that they can immediately take the affected dispenser offline and contact law enforcement.
EMV chip cards can be skimmed if the card also has magnetic strip. Data from the chip also can be skimmed but it is less valuable because the chip performs cryptographic functions on the card’s dynamic data, which is near impossible to duplicate.
Skimming is a time-intensive crime for criminals seeking payment information. That said, skimming is a problem that exists in all 50 states. It generally tends to be a bigger problem off highly trafficked roads and highways. The problem is particularly concentrated in the Sunbelt (Florida to Arizona), partly because the milder weather allows fraudsters to install skimmers year-round.
Visit Skimming and Payments Security for additional information and resources.
EMV stands for Europay, MasterCard and Visa, the three payment companies that created rules for chip-enabled cards. Over the past few years, brick-and-mortar retailers have been upgrading their payment terminals to accept EMV chip cards.
The deadline for virtually all retailers to upgrade has rolled out the past few years, with one exception: gas pumps, which had a deadline of mid-April 2021.
For retailers, the deadline is more of a liability shift, meaning retailers who do not upgrade will be liable for covering all fraudulent payments or disputed charges, something that was previously covered by the card companies through the 2% to 3% swipe fees paid by retailers on each card transaction. There is no indication that swipe fees will be reduced.
Fuel retailers faced significant challenges during the coronavirus pandemic that affected their ability to meet the 2020 EMV deadline. Technician availability, parts availability, overseas manufacturing of necessary equipment and certified solution availability created persistent issues and delays; however, more sites are becoming EMV enabled.
With the overwhelming percentage of payments at the pump by plastic, there are incentives for offering discounts to customers who pay by cash. Processing payments by plastic carry significantly higher costs than cash payments and the discounts are a way for retailers to reward customers who help reduce operating costs.
Here are the typical fees assessed to retailers for a 10-gallon fill-up, assuming the price is $3 per gallon.
- Cash: No fees
- Debit: Roughly 2.4 cents per gallon* in additional expenses. Debit fees are 21 cents per transaction plus other costs, with a maximum charge of 24 cents for the transaction. (*This is only true for the 60% of debit cards that are regulated. The other 40% of debit cards carry fees that are closer to those for credit cards: around 2%.)
- Credit: 7.5 cents per gallon in additional expenses. Credit card swipe fees include both fixed and variable costs. Combined, they average about 2.5% at the pump, or about 7.5 cents per gallon.
Amounts for the discount vary, but most retailers offer approximately 5 cents off per gallon to customers paying by cash. Some retailers offer significantly higher discounts for cash, particularly if the gas purchase is tied to another purchase, such as a car wash.
Nearly one in four (23%) of consumers surveyed by NACS in 2019 said they had paid by cash to receive cents off per gallon. Some retailers prefer not to offer these discounts, as the discounts could be misconstrued by customers paying by debit or credit as “surcharges.”
Requirements for how retailers offer cash discounts are set by the state department of Weights and Measures. Typically, retailers must most prominently post the higher (credit) price. Some retailers also have dispenser pumptoppers and advertising billboards that rotate between the cash and credit price.
Holds are standard practice for any business that accepts plastic as a form of payment in a situation where the final dollar amount that will be assessed is unknown in advance. Holds placed on gas purchases are like credit card pre-authorizations at hotels at check-in or at car rental counters.
Although most car rental agencies and hotels discourage or don’t allow customers to use debit cards because the hold would be large, debit cards are permitted at the pump and can cause problems—especially for those who carry low balances in their checking accounts. An unexpected debit hold can begin a cascade of overdraft fees or cause a customer to be locked out of making other purchases.
While online banking statements look like the hold has been placed by the retailer, the retailer is only responsible for setting the amount of the hold—a decision highly influenced by credit card rules that could later deny payments for some transactions.
Both Visa and MasterCard require that retailers place holds, or pre-authorizations, on debit and credit card gas purchases. Most consumers don’t notice holds on their credit cards because they have enough credit that they don’t exceed, even with holds.
One more point of clarification. There are two charges that hit a customer’s account when they purchase gas. One is an “authorization” charge, typically for $1. This charge isn’t permanent and is later removed. Its purpose is to make sure that the card being used is a valid card. The second charge is the “hold,” which is required by card network rules. The bank issuing the debit/credit card is responsible for the length of the hold.
The amount of a hold varies. A retailer can set the limit based on a variety of factors. Most commonly, holds are between $75 and $125 and designed to cover the maximum cost of a fill-up. Retailers with higher hold amounts may have more traffic from larger vehicles, such as trucks.
The retailer is not responsible for continuing the hold, since credit/debit card network rules make it impossible to extend the hold. Also, retailers have nothing to gain from holding onto their customers’ money. Ultimately, the banks can reap added benefits from holds, such as assessing overdraft fees that happen as a result of unanticipated holds.
The amount of the hold and the time of a hold may vary, but the length of a hold is significantly affected by how the card is used. PIN-debit transactions are real-time transactions and holds should be released within minutes, as opposed to hours or days. However, so-called signature-based debit transactions—those where customers do not use a PIN—are processed like a credit card transaction and have longer hold times that could take several days to clear.
Signature-based debit transactions holds, like the holds on credit cards that can affect a customer’s spending limit, can remain for 48 to72 hours, since the processing times are slower.
Consumers should ask their bank about its policy regarding the length of debit holds. If the hold lasts longer than a few minutes for PIN-based transactions, or longer than three days for signature-based debit transactions, consumers should discuss the matter with their bank to learn why the holds are lasting so long. Most banks print their phone numbers on the backs of their cards.
In some areas, retailers may ask customers to enter a 5-digit ZIP code associated with their credit card before fueling. The idea is that someone trying to use a stolen card won’t know the ZIP associated with the card.
If customers do not enter their ZIP code or enter an incorrect one, the card will be declined and, as a result, the pump will not dispense fuel.
Unfortunately, this adds a level of inconvenience for law-abiding customers. And it can be even more inconvenient for visitors travelling from other countries, especially Canada, which has a 6-digit postal code that is a combination of letters and numbers. But there are some workarounds besides going inside to get the pump authorized. One other option suggested by some experts is for Canadians to enter the numbers in their Postal Code, plus an additional two zeroes. So, if a Canadian billing address is H2W 1L2, the customer would enter 21200.
Many retailers give consumers the option to pay for fuel via mobile device, whether from a loyalty app or options like Apple Pay or Google Pay. From the retailer’s perspective, these payments work just like a credit or debit card and essentially carry similar expenses as card payments at the pump.
From a consumer perspective, app payments are faster and more convenient. They also can be more secure, since they avoid contact with the dispenser and the likelihood of skimming. However, it’s important to note that no single technology is bulletproof or perfect.
Paying by phone also is safe, even though signs at the pump had discouraged being on the phone while fueling. These signs were related to ensuring that customers paid attention and weren’t distracted. It’s almost certain that anyone who drives away after fueling with the gas nozzle still attached to the car was using his or her phone while fueling. Snopes debunked the myth that cell phones cause fires at the pump.