Skip to main content
Credit card skimmers: Beating them at their game

Posted July 21, 2022


Fueling stations are fertile ground for one of the most difficult-to-detect forms of fraud: credit card skimming. In 2019, in the month of March alone, the Houston Chronicle reported police found skimmers at 13 fueling stations across the city. Investigators in the Houston area say fuel pumps are the preferred medium for thieves who install skimmers. “Typically the [fueling stations] that are more vulnerable are more unattended,” William Smarr, the deputy special agent in charge at the U.S. Secret Service in Houston, told the Chronicle.

Both gas pumps and ATMs have seen increases in skimming. Many experts assert that gas stations are the primary target because of the ease of installing the skimmer device on a gas pump.

Gray Taylor, a security and compliance expert with NACS, told Bank Info Security back in 2011 that many pumps are still tied to master keys that are easily purchased online by hackers. This statement is still largely true today, unfortunately.

"There are 900,000 pay-at-the-pumps out there, and, literally, I have four keys in my desk that will open up every dispenser in the United States that has not been upgraded," Taylor said. "Today, you can buy new dispensers that have unique keys. The problem is doing something with the dispensers that are out there; getting these guys to upgrade."

While many financial institutions are manually focusing on trying to identify gas pump common points of purchase (CPPs), automated solutions can help detect the devices early on, before too many cards are used fraudulently.

How thieves steal your account information as you fuel  

Card skimming at the pump usually looks like this: a thief installs a magnetic strip reader to an existing payment terminal. “Some criminals will place a fake keypad over the existing keypad in order to capture the PIN as it is entered. Others will place a camera near the fake device in order to record the PIN as it is entered.”  

The fraudulent strip readers and keypads are designed to look like the real deal. Victims of card skimming often don’t know they’ve been had until they notice fraudulent charges on their accounts or money withdrawn from their checking account even though their debit card never left their wallet.  

How to detect a credit card skimmer at the fuel pump 

There are four recognized ways to detect a skimming device: 

  1. A credit card reader that sticks out far past the panel
    Skimmers are designed to fit over the existing credit card reader. If you notice a reader that protrudes outside the face of the rest of the machine, it may be a skimmer.
  2. Parts of the credit card reader are loose or move when jiggled
    The credit card reader should be securely in place. Moving parts are a sign the reader has been tampered with or that a skimming device has been affixed to the existing reader.
  3. A security seal that has been voided
    tations often place a security label across the pump that lets you know if the cabinet panel on the fuel dispenser has been tampered with. When intact, the label has a flat red, blue, or black background. However, once the seal has been broken, the words “Void Open” appear in white. If the seal is broken, it’s a sign that someone without authorization has accessed the cabinet. 
  4. A PIN pad that’s thicker than normal
    Thieves may place a fake keypad on top of the real one to capture your keystrokes. This way they can capture your pin or billing zip code in addition to your credit or debit card details. If the keys seem hard to push, eject your card and use another ATM.

File a complaint to prevent future fraud

The Department of Agriculture and Consumer Services (DACS) across most states regularly inspects gas pumps and looks at fuel samples to ensure consumers are being offered quality products at a fair price. The number of skimming devices discovered by Florida DACS inspectors, as an example, more than tripled between 2015 to 656 in 2017 continuing to increase steadily to 1,206 in 2018, 1,555 in 2019, then a decrease to 1,309 in 2020, and another decrease to 401 in 2021.

If you suspect that a gas pump has been tampered with you should contact the gas station manager and file a complaint with your state's DACS. You can file a complaint online or by calling their helpline.

To better avoid skimmers, don’t fuel up at unattended stations. Always report signs of tampering at the pump to station attendants.  

All fleet cards are not the same, and different types of fuel cards suit the needs of different kinds and sizes of businesses. View WEX’s fleet card comparison chart to see which fleet fuel card is right for you. 

Editorial note: This article was originally published on July 24, 2019, and has been updated for this publication.