Drivers are keeping a close eye on gas prices, which are at an all-time high. But a lack of cheap gas isn’t the only issue you might face when filling your tank. A gas pump skimmer can do a real number on your bank account.
Gas-station fraud commonly occurs with the use of skimmers, small devices that thieves place on or above the card readers at gas pumps (and ATMs) to copy and steal your credit card information. They used to be found primarily in cities, but the scam has spread into rural areas, and everyone should be on alert for these devices.
One of the best ways to avoid being a victim of a gas pump card skimmer is to take the extra few minutes to pay inside. But time is valuable, and while most people are willing to download the best gas apps and gas credit cards to save money on gas, they’re less thrilled about jetting inside each time they fill up. So learning how to protect yourself while paying at the pump is the best way to avoid getting scammed.
What are credit card skimmers?
Credit card–skimming devices are installed on point-of-sale terminals, allowing thieves to take information off your card when you swipe it. “A credit card skimmer is a device that transfers data from your credit card’s stripe,” says Chris Hauk, consumer privacy champion at online privacy and security site Pixel Privacy. “Skimmers are usually found on gas pumps or other point-of-sale devices, in areas that aren’t being monitored every minute of the day, as this allows the bad guys time to install a skimmer on a pump without being observed.”
How does a gas skimmer work?
As the name indicates, this device skims data off your credit card when you use it to pay. “A credit card skimmer is a magnetic stripe reader placed on an existing, legitimate card reader,” says Paul Bischoff, a privacy advocate with cybersecurity website Comparitech. “Whenever a customer pays with their card, their card is read by both the skimmer and the original reader.”
Because customers see their sales go through, they don’t have any reason to suspect anything has gone awry with their purchase. “Skimmers are designed to be discreet so that the victim doesn’t notice them,” he says. “The skimmer stores scanned credit card info until the person who put it there retrieves it.”
From there, the thief can perpetuate online scams, using your credit card information to buy things online.
Do card skimmers work on chip cards?
Credit card skimmers do work on chip-enabled cards; however, they read the magnetic strip on your card, not the chip, so avoid the strip reader when possible.
Think of this as one aspect of what should be a multipronged approach to avoiding gas-station scams: “Use a chip reader on the pump, if it is available,” Hauk says, “and always use a pump that is in a visible part of the gas station, such as the pump right in front of the cashier’s window. High-visibility pumps are tougher to attach skimmers to.”
What does a credit card skimmer look like?
To an untrained eye, gas pump card skimmers are designed to look like part of the point-of-sale hardware. They are usually bulky and plastic, stick out further than the machine, and have arrows that don’t line up. The device may also wiggle because it’s not a permanently affixed piece of the machine. “Because they are attached to existing card readers, they tend to bulge out a bit,” Bischoff says. “If I’m suspicious, I’ll often give the card reader a tug and prod to make sure.”
But external skimmers aren’t the only way your credit card can be skimmed, and even people trained in surveillance techniques can fall prey to gas-station scams.
One Secret Service agent who was involved in an investigation about gas pump skimmers was the victim of gas-pump fraud himself—twice. So even a government official who’s trained on this topic often can’t tell if skimmers are there. Robert Siciliano, CEO of cybersecurity training company ProtectNow, adds that it’s becoming increasingly common for gas pumps to be skimmed internally: “This means there is a device attached in the communication lines that intercepts the card number as it travels over the Internet.”
How do I know if my gas pump has a skimmer?
Usually when you hit the gas station, you’re concerned with things like getting better gas mileage and making sure you don’t accidentally put diesel in a gas car. But you really ought to spend the time it takes to fill your tank inspecting the gas pump. There are a few telltale signs that a pump has been tampered with and may have a gas pump skimmer attached to it. Before you pay at the pump, inspect the point-of-sale terminal by following the guidance below.
- Look at the machines around you and compare the card-reading slots and keypads. If they don’t look the same, some might be equipped with credit card skimmers.
- Inspect the lockable door on the pump (it’s where the attendant loads paper for receipts) to make sure it’s firmly closed. There shouldn’t be any uneven gaps in the casing—that indicates tampering. Some gas stations place tamper-resistant seals over the door, which is something to look for, though not all stations take this extra step.
- Ensure that nothing on the point-of-sale machine wiggles. Take a few seconds to verify that everything is firmly attached.
- Be aware of hidden cameras that thieves may have installed to capture your PIN when you enter it.
How can I protect myself at the gas pump?
Educating yourself on how to spot a credit card skimmer and what card skimmers do is a good first step in protecting yourself from gas-pump fraud. As a rule of thumb, exercise awareness anytime you’re using a public pay station or when your card leaves your sight. A shop employee who takes your card into another room to run the transaction could be dipping the card into a skimmer, for instance. And pumps that aren’t in the gas station attendant’s line of sight give thieves an opportunity to attach a skimming device.
Stay safe when filling your tank by following the experts’ tips below.
- Whenever possible, choose the pump closest to the building. They’re closest to employees and the least likely to have been tampered with.
- Avoid using a debit card, if possible. Should you be forced to use debit, run it as a credit card so you don’t have to enter your PIN. Debit purchases take the money right out of your account, while credit purchases have a lag time for payment and often offer zero fraud liability.
- Because scammers may use cards that have been skimmed to pay for online orders without the merchant seeing the physical card, identity theft protection company LifeLock suggests setting up alerts to let you know if your debit or credit cards are used for a “card not present” transaction of $100 or more. In addition, Siciliano recommends regularly checking your statements, especially if you’re often in crowded areas like subways and airports.
- Avoid the PIN pad. “If at all possible, always use the chip or the Apple Pay–type payment system,” Bischoff advises. A chip-enabled card is safer than swiping your credit card, and Apple Pay creates a unique code for each transaction, which offers some built-in protection.
- If you visit the same gas stations frequently, buy gas-station gift cards. They don’t have any of your personal information connected to them, and since they have a limited value, your potential losses—should a scammer somehow get the numbers—would be relatively minimal.
- Use gas apps, which offer a safer way to pay at the pump.
What should I do if I think my card has been skimmed?
If you think your card has been skimmed, you should report it to the Federal Trade Commission (FTC), both to protect others from being scammed and to help the FTC break up skimming rings.
Installing the mobile apps for your various accounts is a convenient way to stay on top of your transactions, but regardless of how you do it, regularly checking your statements is critical, and timing can make the difference between you incurring out-of-pocket costs or not.
Not all credit card companies offer fraud protection, so you should also report the crime to your financial institution as soon as possible. How much you’re responsible for depends on how quickly you report the compromised card.
