Protecting Yourself at the (Gas) Pump

While much of the focus on increased security for plastic cards has been at point-of-sale terminals and ATMs with their respective EMV liability shifts, vulnerabilities with gas pumps will be a reality until October 2017.

In the last few years, gas pumps have been a favorite target for fraudsters to place skimming devices. In fact, more than 260 skimming devices have been detected in the last year at gas pumps in the state of Florida alone.

Aside from not having a liability shift on gas pumps to make them EMV compliant, many gas pumps also have a universal key lock making them extremely vulnerable to tampering. Once the skimming device is installed, it is often well-disguised and not noticeable to patrons.

After the data is captured, fraudsters return to harvest the information from the skimming device or, in some cases, access and retrieve the data remotely. The harvested data is then used to manufacture counterfeit cards or the data is fraudulently distributed online.

Risk Mitigation and Best Practices

  • Look for security tape over gas pump cabinets to ensure it hasn’t been tampered with by unauthorized parties (image below). If the security tape is removed, cut or the gas pump appears tampered with, do not use it and report it to the gas station’s manager.
  • It is encouraged to use gas pumps located closer to the front of the gas station as fraudsters will typically place skimming devices at gas pumps away from the store to go unnoticed.
  • Use a credit cards instead of debit cards. While there is member liability protection for both, most find dealing with a credit card compromise less intrusive.
  • Run debit cards as credit (signature based) instead of entering a PIN. This can prevent PIN compromises when members use a debit card at the pump.
  • Check checking account transaction histories regularly to spot any unauthorized charges.
  • Immediately report any suspected compromised debit or credit card numbers to authorities and to the credit card company.