Protecting Your Gas Dispensers From Skimmers

Over the past decade, identification thieves have been taking advantage of the widely available and easily copied universal keys that lock up most gasoline dispensers. They open the access door to the reader and attach a skimmer, which transmits credit and debit card data to their team. Usually, the theft is detected long after it can be traced to a compromised reader in a pump.

Skimmer teams used to hijack data by attaching readers to ATMs. But now, as one security consultant puts it, "Gas station pumps are far easier to tamper with than ATMs and [the attack is] more difficult to detect."

In response, some major gas dispenser manufacturers have developed new technological security measures that defend against skimming at the source. For instance, encrypted card readers can now be retrofitted into old dispensers and are available in new dispensers. Encryption of data at the reader makes the data unusable for skimming devices.

Additional high-level security devices are also built into newer pumps, including automatic shutdown and alarms that sound when doors are opened. As an added level of security, European-style EMV (Europay, MasterCard and Visa) card readers are available as well.

But, as we know, the battle goes on and there will likely be more technological challenges -- and defenses -- to come.

Security Locks
For those operators who may find replacing dispensers and adding encryption a bit pricey, manufacturers can provide retrofit kits that replace the low-security universal locks that were shipped with most dispensers until recently. Replacing gas dispensers with new models that have tamper-proof doors and electronically secure card readers is the optimum response, and also the most costly. As a more cost-effective response, a number of security lock companies have introduced easy-to-install retrofit kits that replace easily compromised universal locks.

A high-security lock system should have a non-duplicatable key blank, millions of usable key combinations and a virtually pick- and drill-proof mechanism, with its key code registered exclusively to a customer.

When James Naill, purchasing manager for R&R Petroleum of Fargo, N.D., heard of the first incidents of data skimming from gas dispensers in his area, he was determined to be proactive and retrofitted his dispensers with security locks. In his area, the crooks -- posing as "technicians" -- went to stores and petroleum outlets and used a universal shipper key to access the dispensers. Imposing key control and retrofitting dispensers with security locks with registered keys unique to R&R Petroleum provided the protection he and his customers required.

“I did some research and found security locks that were cost-effective and easy to install. I considered security stickers, but decided that they were easy to copy," Naill said.

Security Stickers
Even though this type of data theft goes back at least 10 years or more, the industry has been slow to respond. A typical response from law enforcement in television or newspaper reports is that "somehow" a thief gained access to the card reader. Security stickers, which are attached to a dispenser door to indicate that the door or a device has been compromised, were an initial low-cost response from the industry. Even then, careless managers attached the stickers improperly and now, in the days of laser printers, stickers are easy for criminals to copy and attach to cover their tracks.

Even if it’s just one day before a manager notices the tampering, one day’s worth of stolen data can be quite a haul. Stickers, cameras and alarms provide a deterrent, but they only can record and document unauthorized access, usually after the fact. They do not prevent it.

If you have any doubt about the persistence and scope of the skimmer challenge, and the potential for skimmer teams to strike anywhere without warning, just perform an Internet search on “gas dispenser skimming.” After you catch your breath, search “gas dispenser locks” to take the first step to keep your name out of the news and protect your customers’ data.

There is ample information about the threat, and there are ample options ranging from the low-cost sticker to mid-level retrofit security locks, to higher-level embedded electronic barriers. Each level carries an increased cost with its increased security level. You can choose to replace your gas dispensers, replace your universal locks with high-security locks, or attach security stickers to indicate tampering. Whatever your choice, it’s time to make one because skimmer teams continue to rove the country.

Rich Morahan is a consultant for Lock America. He frequently writes and conducts seminars about security issues for the information destruction, propane and self-storage industries. Morahan can be reached at [email protected] or www.rmorahan.com.

Editor's Note: The opinions expressed in this column are the author's and do not necessarily reflect the views of Convenience Store News.