With many merchants upgrading their point-of-sale (POS) terminals to accept EMV embedded-chip payment cards, more consumers than ever before are better protected against payment card fraud. But gas pumps have yet to upgrade their card readers to accept chip cards; because of this, they are being targeted by fraudsters at an increasing rate. Law enforcement officials say they’ve seen a spike in the use of credit card skimmers at both fuel pumps and ATMs, which are also not optimized for EMV as of yet. Skimmers, which are devices that fit over existing card readers and copy credit or debit card information from the magnetic strip when a card is swiped, are used by identity thieves to gather consumer data to run up fraudulent charges.
When the EMV liability shift happened last October, the card payment networks – Visa, MasterCard, American Express and Discover – did not require banks and gas stations to install EMV technology on ATMs and fuel pumps at the same time as other merchants, giving them a deadline of October 2017 to comply. The only exception is MasterCard, which included ATMs in its October 2015 liability shift. The reason for the deadline extension on fuel pumps and ATMs is that they are far more expensive to upgrade than in-store POS systems. Unfortunately, without the EMV technology, the new chip cards are just as susceptible to fraud as traditional magnetic stripe cards, leaving the nine out of 10 Americans who use self-serve fuel pumps and ATMs wide open for fraud. Even more concerning is that the chip cards may actually be more vulnerable, as identity thieves are now targeting fuel pumps and ATMs more than ever due to the lack of EMV adoption.
So, what can merchants to protect their customers from fraud? And what can customers do to protect themselves?
First of all, gas station owners, bank managers and employees can help by frequently checking the pumps and ATMs for any signs of tampering or abuse, and to see if the equipment has been altered in any way. Skimmers typically fit over the card reader on a fuel pump or ATM machine – and often include a tiny camera installed over the keypad, for recording PIN number entries – and while they may not be easily recognized by a customer, they should look different to an employee. Also, you can keep an eye out for suspicious-looking activity around the pumps, and report any tampering to police immediately.
There are several things customers can do to avoid becoming a victim of card skimming:
Pay with cash. This is the most obvious way to reduce your chances of becoming a victim, although it’s not always the most convenient. Swiping the card at the pump is a lot faster, especially when rushing to work, a doctor’s appointment, etc. However, paying with cash is the one sure way to guarantee you won’t be a skimming victim.
Pay the attendant instead of paying at the pump. As when you use cash, this will require a trip inside the store, so if you are pressed for time you may not want to take the extra couple of minutes. However, if you don’t want to pay with cash, this is probably the safest way to use a credit card at a gas pump.
Don’t use a debit card. Using a debit card at a gas station is like going on vacation and leaving your house unlocked with the doors wide open – you are asking for trouble. If you absolutely must use a debit card at a fuel pump, always choose the “credit” option when prompted to choose “credit or debit.” Most debit cards are tied to a credit network these days and by calling your debit card a credit card, not only will you save the debit card processing fee, you will also instill all the protections of a credit card on to your debit card. Plus, if there is a tiny camera installed above the keypad, by using the credit option you don’t have to enter your PIN number, so fraudsters can’t get it.
Inspect the pump. If you can’t – or don’t want to – pay with cash, physically check the pump before you swipe your card. Is there anything that looks unusual? Does the door by the card reader look like someone has attempted to pry it open? Some pumps have tamper-evident stickers that will show the word “void” when the seal has been broken. If you see this, move on to the next pump. Also, skimming devices will often come with a small camera to record PIN numbers being entered by customer. Feel under the lip above the keypad area – if you find a camera or see any other evidence of tampering, do not use the pump and report it to the manager or attendant.
Inspect the ATM. If you go to an ATM to withdraw money or conduct any banking business, make sure you choose one in a well-lighted area on a main road that gets a lot of traffic. As with the above point, inspect the ATM for any signs of tampering or physical anomalies before using it. Bank ATMs generally don’t have tamper-evident stickers on them like gas pumps do, but if anything looks out of the ordinary, go inside the bank to do your business or if that is not possible, go to a different ATM. And again, if you notice anything unusual, notify the bank.
Use the pump closest to the store. Most fraudsters will choose pumps that are the furthest from the store, thinking they can’t be seen as well by employees and probably aren’t watched as much as the others. They also happen to be the ones closest to the road and get the most traffic, so they can be a fraudster’s goldmine. Choose another pump, if possible.
The October 2015 EMV mandate ushered in a new era of security for credit card transactions, and while fraud is coming down in most areas, it is increasing at fuel pumps and ATMs, because of the extended 2017 deadline. Merchants and customers must be extra vigilant when using these devices, and do all they can to protect their customers and themselves from falling victim to credit card fraud.
