Pump Skimmers Strike Florida
Pay-at-the-Pump Incidents Swell, But ATMs Still Top Target
Combined with recent attacks in neighboring Polk County, Highlands investigators estimate total losses associated with recent card-skimming attacks will come closer to $200,000. "Due to the amount of the loss and the span of the crimes, we will be attempting to seek federal prosecution," said Highlands Police Sgt. Brian Kramer in a news release.
Officials in Highlands and Polk counties are now working with the Florida Department of Law Enforcement and the Secret Service to investigate the rash of attacks.
Police did not cite locations being targeted for skimming; but local news reports claim an area gas station, RaceTrac Petroleum, on U.S. 27, has been identified as one compromised site.
Just days earlier, similar yet isolated skimming incidents were reported in Bullhead City, Ark., where skimming devices were discovered on gas pumps at two Circle K convenience stores, and Fort Smith, Ark., where a local bank traced compromised cards back to an unnamed retail site.
Pay-at-the-Pump: Epidemic or Overblown?
Incidents of pay-at-the-pump skimming flourish during summer months, when travelers fill up more often. [See Pay-at-the-Pump Fraud Grows, More Pay-at-the-Pump Skimming and Pay-at-the-Pump Skimming on Trial.]The problem has received attention from the National Association of Convenience Stores, which recently launched an awareness campaign to educate merchants about pay-at-the-pump skimming. And in March, NACS released its WeCare Decals, tamper-evident labels that aim to help retailers quickly identify potential security breaches. [See Skimming Concerns? Here's What You Need to Know.]
Gray Taylor, a security and compliance expert with NACS, says pay-at-pump skimming incidents account for a relatively low percentage of card compromises. But public awareness and media attention have fueled concerns about a problem the retail and financial industries have been trying to battle for years.
"Most convenience stores are concerned about pay-at-the-pump skimming," Taylor says. "But they can only focus on so much."
"There are 900,000 pay-at-the-pumps out there, and, literally, I have four keys in my desk that will open up every dispenser in the United States that has not been upgraded," Taylor adds. "Today, you can buy new dispensers that have unique keys. The problem is doing something with the dispensers that are out there; getting these guys to upgrade."
NACS also has issued several reports about cardholder data security:
- Guide to Remote Access Management;
- Guide to Simple Network Design;
- PCI Convenience Store Employee Data Security Training Manual;
- Protecting Payment Card Data at Your Dispensers;
But John Buzzard of FICO's Card Alert Service says POS skimming attacks, whether launched against attended terminals, as was the case with the Michaels breach, or unattended terminals like pay-at-the-pump, still pale when compared with the number of skimming attacks waged against ATMs. [See Skimmers Target Bank Branches.]
Despite widespread media coverage, Buzzard says pay-at-pump skimming is not that prevalent.
"Fraud is just so cyclical in nature that each year we see a different entry point, and, for the most part, the criminals just switch back and forth between what's highly publicized and what isn't," he says. "The criminals essentially dust off an old fraud scam, like pump skimming, when other card and PIN capture schemes are too hot. Gas pumps are not big right now at all, but we have had a few this year, and expect to see more before the year closes."
