Skimming, Shimming and Payments Security

Fuel dispensers and ATMs are a few of many targets for thieves looking to steal credit and debit card information for fraudulent purposes. 
 
Skimmers are card readers placed in front of or on top of legitimate card readers that harvest card data from card swipes. Skimmers are often overlays on point-of-sale keypads and card readers that capture sensitive information when customers use an ATM or fuel dispenser. 
 
Another tactic is shimmers, which are more difficult to spot. Shimmers are card readers that are inserted inside the payment device that can harvest the data contained on a credit card's EMV chip.
 
Fuel pump manipulation can result in a significant loss in fuel sales. One method is pulser tampering. A pulser is an electrical sensor inside the dispenser unit that converts rotations into data while dispensing fuel, allowing the unit to calculate gallons/price. Under normal operating conditions, this could be about 7-10 gallons per minute. 
 
With pulser tampering, the fuel flow input shaft has been disconnected and a homemade motorized device with a speed controller is reconnected. This results in a deceptive flow rate being measured, although the actual flow rate will not change. 
 
This crime happens when a dispenser is activated with a gift card or other payment device, like a stolen credit card, which starts the pump. The point of sale/fuel controller fails to properly record the sale. If 200 or more gallons of fuel is dispensed, the criminal would drive away without paying anywhere close to what that fill up costs.
 
Another fuel pump manipulation method is proportional valve tampering. This is the deliberate manipulation of a proportional valve, which regulates the flow of fuel through the dispenser unit’s internal electrical. The crime occurs when a criminal clamps wires to the proportional valve coil wires that are then attached an external battery, which signals the proportional valve to open and dispense fuel without the sale being recorded on the POS unit. 

Since 2008, NACS and Conexxus have provided resources and tools for retailers to proactively initiate and maintain effective payment security procedures that help reduce skimming and shimming.

Podcast: Skimming, Shimming, Shamming, Etcetera
Feb 2019
Find out how skimmers, shimmers, and shammers target fuel pumps and how retailers can protect themselves and their customers. ​

Protecting Payment Card Data at Your Dispensers (PDF)
This PDF guide provides informed suggestions on enhancing the payment card security of unattended payment terminals at fuel dispensers.​

WeCare Data Security Program
Developed by NACS and Conexxus, the WeCare Data Security Program provides simple guidelines designed to reduce the risk of card breaches at convenience store operations.

Products

Skimming Prevention and Detection E-Learning Training
Ready Training Online’s (RTO) Skimming Prevention and Detection online training module for store employees and managers covers the definition of skimming, as well as the impact skimming attacks have on businesses. Through real-world scenarios, employees are shown the important role they play in preventing skimming occurrences.​

The online Skimming Prevention and Detection training is available to current RTO subscription customers at no additional cost, as well as being offered through the NACS eLearning Store. Additionally, consumers can seek more information, including a preview of the skimming training, by visiting the Ready Training Online website.

WeCare Tamper-Evident Decals
Tamper-evident labels can help retailers identify potential security breaches, such as skimming devices illegally inserted at fuel dispensers or other unattended PIN-entry devices. Use NACS Member Coupon Code (at checkout): NACS0001.

Order Now