The National Association of Convenience Stores reported last week that credit card skimming has become epidemic. To fight back, the organization issued a release saying that it will be working to educate retailers about master-key vulnerability as part of its WeCare [1] campaign to educate retailers on best practices and provide new tools to detect ATM and gas pump tampering. Current practices gas stations use to protect pumps from having skimmers that can steal credit card information installed still leave them vulnerable by design, Gary Taylor, an expert at NACS told BankInfoSecurity.com.

“There are 900,000 pay-at-the-pumps out there, and, literally, I have four keys in my desk that will open up every dispenser in the United States that has not been upgraded,” he told the Web site. The keys can be used to open pay-at-the-pump stations to install internal skimmers.

Newer pumps are made with individual keys, but many existing pumps are still vulnerable. Some gas station operators are reluctant to upgrade their pumps because local fire departments have to keep copies of these master keys to shut off pumps in case of emergencies, the NACS release states.

The WeCare initiative offers tamper-evident labels that can help retailers notice altering of ATMs and gas pumps. If lifted or broken, a “void” message appears on the label.

In a NACS video interview, Zac Stoner, a manager at oil technology company Gilbarco Veeder-Root, explains ways for retailers to spot skimming devices [2]on their equipment. One way to spot a skimmer is the condition of the card reader. Card readers are always outside and exposed to the elements. A brand new, glossy-looking card reader could mean the reader was replaced with a skimmer. The wear on all readers should be similar.

Skimmers are slightly bigger than a normal card reader; however, the difference is so subtle that an everyday customer most likely won't notice. Still, a store manger should, Stoner said.

Stoner also said keypads on gas pumps and ATMs should be flush with the rest of the pump. If a keypad is raised or a card reader isn’t flush or seems to fit in the pump differently, there’s a good chance it could be an overlay skimmer. Overlays are housings that fit over existing keypads and card readers to record information.

Another type of skimmer is a small video camera placed above ATM card readers that records people entering their PIN numbers. A blog post from The Consumerist provides pictures [3]of some of the most common types. They’re almost impossible to spot by a person who usually stops by an ATM for less than a minute.

The data can be transmitted to someone nearby via Bluetooth, but most of the time, thieves have to come back to the site to retrieve the information from the device. If a retailer finds a skimmer on one of the pumps, Stoner said, they shouldn’t remove it and should call law enforcement.

Skimming in the News:

August 15 – Law enforcement in New South Wales, Australia intercepted 1,280 phone calls from 10 different mobile phones to catch a four-man skimming operation. The men were arrested Sunday for running a skimming scheme that targeted customers of retail stores. They offered $25,000 to shop owners to let them modify store credit card machines [4].

August 11 – A Prince George's County T.G.I. Friday’s employee was indicted after skimming the credit cards of two Secret Service agents [5]who were out to lunch. He had already made $42,000 in unauthorized purchases on 73 credit cards in a four-month period.

August 9 – In Tampa, local law enforcement confiscated four skimmers from RaceTrac gas stations [6]where thieves had unlocked the gas pumps and attached a devices inside that recorded credit card numbers.

August 5 – A Mugs N Jugs waitress in Florida used a skimmer the size of a quarter [7]get back at nine customers she felt gave her a hard time. She'd skim the cards, and then her cousin would make fake credit cards with the information for his ex-girlfriend to use to buy things.

July 6 – Four Houston men were indicted and charged with one count of conspiracy to commit bank fraud [8]and two counts of access device fraud after spray painting over surveillance cameras and placing overlay skimmers on ATMs. The stolen information was re-encoded onto fake cards and used to withdraw more than $400,000.

May 30 - Skimming was so bad in West Covina [9], California in June that the city asked residents to pay for gas with cash.

photo by _Fidelio_ [10] from flickr

Thumbnail: