New tech fuels more credit-card skimming

After Orlando gas station owner Christy Chang got a call from a customer in July about suspicious charges on a credit card, she found an illegal creditcard skimmer inside one of the fuel dispensers at her Mobil gas station on East Colonial Drive.

“I called the police and they told me not to touch it,” said Chang, owner of two area stations. “They needed to check it for fingerprints.”

Across Florida the number of credit-card skimmers found at gas stations is exploding as criminals are emboldened by new technology that makes it even easier to steal credit-card information from unsuspecting motorists. New devices found on the streets include wireless Bluetooth technology that allows data to be collected without accessing skimmers, or

skimmers inserted right into the credit card slot.

Gas stations have been also slow to adopt highersecurity chip credit cards because of the high cost of installing the hardware. Often, entire gas dispensers need to be replaced or expensive retrofits are required. Earlier this year Visa extended its deadline from 2017 to 2020 for gas stations to use chip credit cards without bearing liability.

The current skimmer technology would not work with chips, but that’s not a guarantee that scammers won’t develop tech for that.

The evolving technology is one of the reasons the number of credit-card skimmers found at Florida gas stations tripled in 2017 compared with the year before, according to data from the Florida Department of Agriculture and Consumer Services. The 613 skimmers recovered were the most in the state’s history, seven years after the fraud-aiding devices first emerged.

In September, EunisesLlorca Menses of Naples was convicted of using Bluetooth-enabled skimmers at gas stations in Florida, Alabama, Tennessee and Virginia. Menses, along with a Houston man, are awaiting sentencing on federal charges that carry up to 30 years in prison. When the two were arrested in Alabama, police also found dozens of fake credit cards loaded with real credit-card numbers.

Industry officials said the data collecting devices are so easy to acquire and the payout so big that the problem is growing fast.

“In the last few years there has been a heightened number of incidents,” said Jeff Lenard, a spokesman for the National Association of Convenience Stores. “It’s a serious issue because no one wants to be associated with a creditcard skimmer found at their business.”

The pumps at Chang’s two gas stations get a thorough inspection, inside and out, about once a week to check for skimming devices, she said.

“I just checked this gas dispenser out two days before,” she said.

Data breaches and credit-card numbers continue to be a problem even with increased card security. Equifax, Uber, Arby’s, Kmart and dozens of other companies reported data breaches in 2017 that impacted millions of customers.

But smaller breaches continue to be a problem, and gas pumps have become a popular target for data thieves because the skimmers can be installed away from the prying eyes of employees.

Credit-card skimmers are small devices illegally installed on gas dispensers, ATMs and kiosks that pull credit-card numbers or other data. They can be installed on the exterior of machines over existing card slots. Along with fake pin pads, some skimmers are capable of getting both credit- or debit-card numbers and PINs. Data thieves also break into gasoline dispensing machines and install skimmers inside to collect data as it’s passed between the credit card reader and data terminal.

In the past, perpetrators would return and remove the devices or collect the data in person. But the newer devices are making it easier to collect the hardware without drawing much attention or even without approaching the gas dispenser.

“These deep insert skimming devices are unlikely to be affected by most active anti-skimming jamming solutions,” said an alert from kiosk and ATM maker NCR Corp. “They are also unlikely to be detected by most fraudulent device detection solutions.”

The biggest problem area in the state is South Florida, where about 260 stations have been found with skimmers in 2017.

In Central Florida this year, skimmers were found at stations with banners from major brands such as Citgo, 7-Eleven, Mobil and Valero. Law-enforcement agencies have reported 19 skimmers found so far this year in Orange, Seminole, Lake and Osceola Counties.

There were also 19 skimmers found so far this year in Volusia County and 26 in Brevard.

Skimming operations are almost always tied to organized criminal activities, Lenard said, and often associated with foreign groups.

But there are only a handful of convictions. The Florida Attorney General’s office is currently pursuing three cases against 13 individuals in card-skimming related cases.

Florida may be a bigger target for card skimmers because of year-round warm weather, Lenard said.

“People that skim at the pump tend to work seasonally,” Lenard said. “It will peak in the warmer states in winter months and then they will move back north.”