Notice on Skimmers and Fraud
A few weeks ago, our staff was in communication with officials from the NJ Department of Weights & Measures (W&M) concerning numerous issues they were finding in the field. If you didn’t read that Road Warrior, be sure to go back and review it to stay informed on what their staffers are seeing throughout the state.
Some anecdotal news we heard this week made us revisit that W&M discussion; and pass along a few additional reminder notes to members.
While the focus of that previous W&M update touched on violations and maintenance, this edition centers on theft and prevention.
What we have learned is that there’s been an increase in credit card skimmer discoveries locally in New Jersey, but also around the country. In fact, one report a few months ago indicates that card skimmer scams are on the rise; and increased by 40% from 2022 to 2023, alone.
However, unlike previous fraud attempts which often used somewhat-noticeable overlay equipment or needed access to the inside of a dispenser to effectuate a theft, the new wave of skimming has become decidedly slimmer and more technological. Fraudsters are now using a “deep-seated skimmer” (also known as a “deep insert skimmer”) to rip off cardholders. This new method utilizes tiny, razor-thin devices that are hidden inside of the existing reader itself. And unlike older, “bulkier” skimmers that would “attach” themselves to the outside of the existing skimmer, these new variants are much harder to detect and remove.
Take a look to see how thin and compact these devices are, below:
Thieves will take these ultra small devices and fit them inside of the card acceptance slot on a terminal. They will then read the magnetic stripe information from a customer’s credit card, and use a separate tiny camera or keypad overlay to steal the security PIN number. Usually the information will then be wirelessly transmitted to the thief, who collects the data nearby using a transfer protocol. In other instances, the thief will return to the device and physically retrieve the actual skimmer device inside the card slot.
Keep in mind, this isn’t only happening at your pumps, but ordinary ATMs, point of sale credit card machines, and similarly situated devices are all susceptible to tampering.
How can you prevent this from happening?
Firstly, customers and attendants can avoid exposing their card information through greater use of “tap-to-pay” technology. Unlike a magnetic stripe swiping or chip-insert readers, “tap-to-pay” is highly resistant to card skimming. Newer credit and debit cards have EMV chips, and use Near Field Communication (NFC) for short-range, encrypted data communication. The range is so short, it can be measured in centimeters; meaning that even if someone hacked your dispenser, it’s unlikely that any nearby skimmers could read the output. When using tap-to-pay, the card is not physically touching any portion of the card reader and is not being inserted into a device. Instead, the NFC medium uses a single-use, encrypted code to complete a transaction. That means that even if the data is captured by an outside device, the encryption will make it virtually useless to any fraudsters stealing information.
Do your dispensers and inside-store POS terminals use tap-to-pay?
Secondly, make sure you and your employees know to regularly check to see if someone has slipped one of these devices in your terminals. Though “deep-seated skimmers”/“deep insert skimmers” are harder to detect, a bad actor may have been rushed for fear of getting caught when attaching one to your card readers. You or an employee might get lucky and spot something out of place. You should also consider asking an outside contractor that specializes in pump equipment to check out your dispensers periodically to make sure you’re not at risk.
The above in mind, be aware that even with tap-to-pay in place, there is always a risk of fraud. Even if a terminal or pump is equipped with tap-to-pay, thieves will even use a “low tech” sleight of hand to encourage consumers to swipe or insert their cards. How do they entice such behavior? Simply by putting special stickers over the tap-to-pay terminal. The stickers are embedded with radio frequency interference wires, which blocks the terminal from recognizing the EMV-enabled card and cancel out the NFC signal. Indirectly this compels the consumer (or attendant) to use the card reader to complete the transaction, and indirectly facilitates the fraud.
Ultimately those bad actors who are intent on stealing from you or your customers will always find a way to harm you. Even large outfits like Wawa and big-box supermarkets have fallen prey to fraudsters earlier this year. The only way to prevent the harm and any negative impact your business, is to stay vigilant and reach out to professionals that can help you.
.jpeg)
.jpg)
