Thieves are increasingly placing credit card “skimming’’ devices that collect personal information with every swipe at a gas pump, posing an ever-evolving threat to consumers’ bank accounts.
And they’re getting better at it.
The newest devices found on gas pumps in the Tampa Bay area show thieves are now more tech-savvy than ever.
On April 5, Lakeland Police pulled a new, more advanced skimmer off a pump at the Mobil Gas Station at 3437 Hwy 98 North, said Sgt. Gary Gross, spokesman for the Lakeland Police Department. A similar skimmer was found on a pump in Miramar on Thursday, and two more were found on gas pumps in Hernando County on Wednesday.
Because skimmers are such a new problem, law enforcement agencies don’t have a specific way of classifying them from other burglaries. But the Florida Department of Agriculture and Consumer Services has found 57 skimmers already this year during routine gas pump checks across the state and sweeps with law enforcement — five in Hillsborough County and one each in Pinellas and Pasco.
The device found in Lakeland is cause for concern, Gross said. He said that since card skimming devices began circulating several years ago, they have been fairly easy to spot. Devices were placed on the outside of gas pump card readers and could be detected by tugging on the card reader to see if anything was loose.
The Lakeland skimmer, though, was found retrofitted inside the pump’s casing. The clerk at the store didn’t notice anything was amiss until he went to change the receipt paper roll, Gross said. The rolls are changed out about every five days.
“With these devices it’s just like plugging in a USB; they roll up in a big truck that blocks security cameras and install it in a matter of minutes,” Gross said. “There was no way a customer would notice anything suspicious.”
Using wireless technology, these new battery-operated devices can send credit card numbers and PIN information to the thieves’ personal computers or phones in real time, said Hillsborough County Sheriff’s Office spokesman Larry McKinnon. That means thieves only have to risk leaving fingerprints behind once when the devices are installed and never have to return to retrieve them.
Though most gas stations only have one key to unlock the gas pump doors at each fueling station, many of the keys and locks across the state are identical, said Dwayne Denny, owner of Valrico-based security firm Data Specialist Group.
Data Specialist group has created an alarm that gas station attendants can place on the doors to each pump that will snap photos and cause strobes and sirens to sound whenever a pump is opened surreptitiously. The alarms cost about $499 each and have been a tough sell to the small business owners that run local gas stations, Denny said.
Yet the alarms are cheaper than the new “anti-tampering” terminals some gas stations have elected to buy, he said. Those run anywhere from $4,000 to $12,000 a piece.
“What makes this such a difficult issue is the victim is the consumer and the bank or credit card company,” Denny said. “Gas stations don’t really feel the effects of skimmers, and right now they’re not liable for the charges so its hard to convince store owners to update their technology.”
Authorities hope a new federal regulation that comes into effect later this year, as well as changes to credit card design, will help the growing number of consumers hit by the information-stealing devices.
By Oct. 1, the new “Payment Networks’ Liability Shift” will come into effect across the U.S., requiring all retailers, including gas stations, to replace their card-reading machines with the “anti-tampering” terminals that can accept credit and debit cards embedded with a computer chip. If they don’t, the individual retailer will be held liable for paying back any fraudulent charges, not the card companies and credit unions.
Europay, Mastercard and Visa cards all will contain the computer chip, said Aisha Khawaja, GTE Financial’s vice president of member payment systems. GTE finished re-issuing all 45,000 credit cards in the Tampa Bay area with new computer chip cards last month, she said. This summer, the bank will re-issue its 200,000 debit cards.
Since the 1970’s, credit cards have used a black magnetic strip on the back to hold all of its user’s information, from their address and name to personal identification numbers. When hackers collect all of this information from a card skimmer, it’s easy to create a fake card that can be used repeatedly, Khawaja said. The information also stays in a store’s computer system for up to three days, making it even easier to collect. The new computer-chip cards encrypt all personal information and create unique computer codes for each transaction, which means personal information doesn’t sit in a computer.
The change will serve consumers but comes at a price to both retailers and banks, Khawaja said. Traditional, magnetic-strip cards cost $2 to $3 to make while the computer chip cards cost $5 to $7, she said.
Though the new cards will protect credit unions and reduce fraud, many smaller banks and businesses are waiting to make any big changes until they see how it works, Khawaja said.
In Florida, the third-largest gas market in the U.S., the pressure to eradicate concerns about skimmers is huge, said Ned Bowman, Executive Director of the Florida Petroleum Marketers and Convenience Store Association.
“It’s going to come at a cost to the individual store owners unless their big gas company decides to foot the bill,” Bowman said. “With more than 7,000 convenience stores in Florida, it’s going to get really expensive and take a lot of time.”
Until then, some gas stations like Circle K require employees to check pumps for skimming devices up to three times a day, and state agencies struggle to prosecute the few cases that fraud victims actually report, McKinnon said. Investigations into skimmers can involve agencies like the FBI, Homeland Security, the Department of Agriculture and Consumer Services and the office of the Attorney General. Sometimes a card-holder’s information will end up in another state, sometimes it ends up in Russia, he said.
“The reality is we’ve gotten cases now where people have opened up new credit cards they’ve gotten in the mail and they’re already maxed out,” McKinnon said. “Information like that spreads like a wildfire; the only method that will ever be 100 percent fool-proof is using cash.”