How Retailers Can Strike Back at Skimming

NATIONAL REPORT — It's vital for convenience store operators, especially those that offer fuel sales, to learn as much as they can about skimming and how to prevent it — because it isn't an issue of "if" but rather an issue of "when" they'll have to deal with it, according to a recent webinar "Skimming," presented by Conexxus.

What is skimming? The layman's definition is any unauthorized collection of data during the payment process. This most commonly occurs at the fuel pump, but it can also occur at ATMs and payment terminals. Anywhere that cardholder data can be transmitted is an opportunity for someone to install a skimming device.

This impacts retailers on multiple levels, because not only does skimming cost them actual money, it can result in future lost sales as consumers learn about skimming incidents.

Consumers don't always talk about positive experiences, but negative ones are "blasted out there," said Caleb Burke, payment card operations manager at CITGO Petroleum Corp., who urged webinar attendees to take it to heart any time a customer reports a suspected skimmer. "How you address the situation will be addressed to an audience bigger than that one customer."

Common types of skimmers include inline, plug in with the card reader device and can relay consumer information in nearly real time through Bluetooth or cellular connections; shimmers, which are placed deep into the card reader beyond the point of user detection; pinpad overlays, which fit over and resemble the legitimate device; and card reader overlays, which tend to be slightly easier to identify as they are not totally flush with the device.

All achieve the same goal: getting a hold of cardholder information and relaying it to criminals, who are often part of organized, sophisticated operations, according to Burke.

The CITGO Petroleum Corp. manager warned that any location with card data interaction could be a skimmer, and authorities are even starting to see online skimming via mobile apps and other means.

Is skimming on the rise? Yes, said Burke, who believes that those behind the skimming devices are trying to get as much information and money as they can before the EMV deadline arrives in October 2020, which is likely to significantly downgrade how they operate. However, EMV is not a full defense.

"EMV is not going to stop skimming," Burke said. "[It will] force it to change."

Retailers need to defend themselves against skimming. Important actions include:

• Checking the seal at the pump card reader. Is it damaged or broken in any way? This is the easiest identifier.
• Using seals with serial numbers that let employees compare what is currently on the pump to what was previously installed there.
• Creating a manual written log or apps such as the Conexxus-created SkimDefend.
• Making sure the pump lock actually fits the store's key and has not been replaced.
• Keep an eye on customers and potential suspicious behavior, such as blocking sight lines to the pump. A skimmer can be installed in as little as 45 seconds.

Employees can't have their eyes everywhere at once, but this makes it even more important to examine the pumps at least once a day. Burke recommends doing so at each shift change. Surveillance equipment can help, but the video quality needs to be high enough to identify potential perpetrators.

Retailers can get ahead of skimming by working with their state associations and getting local law enforcement engaged with the problem.

"It's not a nuisance, it's an actual crime," Burke said.

He pointed to Florida as a model. As skimming fraud has spread in the state, police are working with c-stores and recognizing them as co-victims, rather than pointing an accusatory finger at them for failing to safeguard their customers' data. This should be the goal for all markets, as hampering the partnership between retailers and the police will likely make the problem harder to deal with.

Alexandria, Va.-based Conexxus is a non-profit, member-driven technology organization dedicated to the development and implementation of standards, technologies innovation and advocacy for the convenience store and petroleum market.