An electronic device planted inside a gas pump in an effort to steal a customer’s credit card numbers could be the beginning of more widespread identity theft, an Indiana State Police spokesman said.
“These type of thefts will become more widespread until the industry takes action,” State Police spokesman Sgt. Stephen Wheeles said.
One skimming device, which collects information from magnetic strips of credit and debit cards that include PIN numbers, was found April 8 during a routine inspection at the Circle K convenience store at 1644 Central Ave. in Columbus.
Since the device did not have remote-access capacity, no customer who used the gas pump near the corner of 17th Street and Central Avenue needs to worry about becoming a victim of theft as a result, said Scott Scharfenberg, director of human resources for Circle K’s Midwest Division based in Columbus.
Story continues below gallery
Data from skimmers, which can be installed in seconds once a gas pump is opened up, is often copied onto blank debit cards to purchase items or to take money out of bank accounts.
Gas pumps are opened when convenience-store employees install paper rolls for receipts, said Ryan Linneweber, a detective with the Columbus Police Department.
When the pumps are opened, it’s easy for an untrained worker to wrongly assume that the electronic ribbon feeding data from the card reader to the skimmer belongs there, the detective said.
Since the first credit card skimmer was discovered in Columbus, additional devices have been detected in the region, according to the Bartholomew County Sheriff’s Department.
Local authorities are withholding the number of incidents and their locations, however, because of two concerns, Sheriff’s Department spokesperson Judy Jackson said:
Customers may stop patronizing retailers where devices have been found.
Customers may wrongly assume that other gasoline outlets are safe.
But the culprits aren’t likely to stop with gas pumps, Linneweber said.
Their crimes could easily expand their circle of victims to those using ATMs, online shopping services and retail outlets, he said.
“Anywhere you have card access, you will have the criminal element trying to access that data,” Linneweber said.
Columbus resident Gary Vreeland said that’s why he always takes extra steps to ensure no one is watching whenever he punches in his Personal Identification Number while using a credit or debit card.
“Criminals have got quite a business going on,” Vreeland said. “It always pays to be vigilant.”
The skimming devices began turning up at gas pumps in and around Marion County late last year.
By the first week of March, Indianapolis police were investigating nearly a dozen cases of credit card skimmers installed on gas pumps at Ricker’s convenience stores.
That prompted the 37-year-old Anderson-based corporation to announce it would invest $150,000 to install security software on pumps at all of the company’s 56 stores.
At about the same time, similar reports of card skimming began to pop up at other convenience stores in small- to medium-sized communities such as Bloomington and Bedford.
“They seem to be moving to more rural areas,” Wheeles said.
Retailers have responded in an effort to try to keep one step ahead of identity thieves, said Scott Imus, executive director of the Indiana Petroleum Marketers and Convenience Store Association.
For example, microchips in new credit cards will thwart most skimmers, although all U.S. retailers have not yet adopted the new systems.
Even when an identity thief successfully creates a phony debit or credit card, they can only make a handful of transactions before the bank cuts them off, according to various news accounts.
At the Speedway convenience store on Jonathan Moore Pike, two out-of-town customers who travel extensively in their jobs said they feel more comfortable using specific cards that offer identity-theft safeguards.
“I’ve got protection from the credit card company,” said Bill Holtzclaw of Georgia. “That’s how they attracted me as a customer.”
Bloomington resident Ryan Robinson said he suspects most people are too preoccupied with their daily lives to worry about becoming victims of identity theft.
“But it is very concerning,” he said.
Imus’ organization conducted a recent seminar in Indianapolis designed to give convenience store owners an overview at the latest card skimming detection technology, he said.
While some companies are following the Ricker’s lead by deploying sophisticated devices at their pumps, they are not releasing details out of concern of tipping off identity thieves, Imus said.
However, other convenience store operators are holding off on installing such devices in anticipation of the release of more effective security software, Imus said.
“When we find a technological solution that is most beneficial, we will leverage it,” Scharfenberg said. “But currently, it’s all in a study phase.”
In the interim, stores are experimenting with new locks, training employees on what to look for during inspections and providing incentives to workers to conduct inspections frequently, Imus said.
Steps that may reduce the chances of falling victim to such thefts include using pumps clearly visible to the inside cashier, and checking the access panel for pry marks, he said.
If someone sees a pump with a tampered or broken security sticker, which is placed over a nut that must be removed in order to open a pump, it should be reported to the cashier immediately, Scharfenberg said.
But the biggest problem is creative and tech-savvy thieves, who often seem quite capable of finding ways to bypass new security measures, Scharfenberg said.
“The only foolproof way to avoid becoming a victim is to pay inside with cash,” Linneweber said.
After discussing the matter with a number of local gasoline retailers, Vreeland said he believes they have taken reasonable steps to protect their customers.
“Once they secure the pumps, the thieves will probably move on to something else,” he said.
- Inspect the area near the PIN pad. If something looks out of place, it might be a skimmer.
- Look at other nearby gas pumps to see if they match the one you are using.
- Trust your instincts. If in doubt, use another pump or ATM somewhere else.
- Choose the credit option. When you use your debit card as a credit card, you usually only have to enter your billing ZIP code as verification – which is safer than putting in your PIN.
- Keep an eye on your account balance and report any suspicious activity immediately.
Source: Security expert Andy O’Donnell for About.com
Here are four of the most likely ways that your credit or debit card can be skimmed:
- ATMs – An ATM skimming device is used and fits over the real ATM card reader slot. ATM users do not know their information is being intercepted as their card is inserted into the false reader.
- Gasoline pumps – This skimming device is installed inside a gas pump in minutes and is not visible to users. A gas pump key can fit pump housings in multiple stations, allowing for quick and easy access.
- Handheld devices – Someone can take your credit card and quickly record the information with a swipe on these small devices often used by restaurants or outside vendors.
- Keystroke loggers – This device can be attached to public-use computers, like those found at the library, or credit card point-of-sale devices to record passwords and other personal data. They can also be downloaded onto your computer as malicious spyware.
Source: Eric Folgate for MoneyCrashers.com