Slashdot Mirror
Criminals Hide Payment-Card Skimmers In Gas Pumps
tugfoigel writes "A wave of recent bank-card skimming incidents demonstrate how sophisticated the scam has become. Criminals hid bank card-skimming devices inside gas pumps — in at least one case, even completely replacing the front panel of a pump — in a recent wave of attacks that demonstrate a more sophisticated, insidious method of stealing money from unsuspecting victims filling up their gas tanks. Some 180 gas stations in Utah, from Salt Lake City to Provo, were reportedly found with these skimming devices sitting inside the gas pumps. The scam was first discovered when a California bank's fraud department discovered that multiple bank card victims reporting problems had all used the same gas pump at a 7-Eleven store in Utah."
I remember running into something like this a long time ago when I was in New York City. There was this small piece of metal in the card slot. Needless to say I didn't insert my debit card in to find out what it was.
How do I protect myself from a skimmer inside a gas pump?
I remember atleast 10 years ago at an Arco station had a sticker on the machine that said don't enter in your card if the reader looks wierd. I have also seen that warning on swipe ATMs.
The new part is that the reader does NOT look weird.
It looks physically identical to the standard reader.
Didja even read the summary?
When information is power, privacy is freedom.
And yeah maybe it is an inside job. Paying clerks $6.00 an hour to work from midnight to 8:00AM does not buy a lot of loyalty. Where do you think most of the pilfered credit card numbers really come from? Try paying people a living wage and this won't happen. Employees who have to live with their mother are not adverse to listening to some ones criminal scheme, which to them sounds like justice rendered.
Why do "Al Qaeda" bulletins allegedly authored by Osama Bin Laden sound as if they were authored by Oliver North?
This got my credit card over a year ago in Saskatchewan, Canada. However, my card was skimmed at a do-it-yourself ticket-terminal at the local movie theatre.
It turned out it was a very large network of people who came together and organized the attack and paid people all over the country to do this and sent the info back to 'headquarters' in Ontario Canada.
They racked up over $600 in charges and it all appeared to have been used at Gas stations in Toronto / Missisaga in Ontario.
They put these things on any 'do-it-yourself' terminal they could find. This included pay-at-the-pump gas stations, ATM's, and any kiosk that could read a debit/credit card.
Luckily Mastercard covers things like this so it was much easier to report and reverse than a few friends of mine who had their debit cards skimmed. They had a much harder process to deal with.
The move to "Chip" cards ([url]http://en.wikipedia.org/wiki/Chip_card[/url]) are rapidly increasing these days. I know my local credit union is fully switched over, although maybe half of the retailers in town actually support them.
Let's define this scenario clearly. You put your money in a bank. The bank then gives you access to the bank's services. It's not access to "your" money so much as it is access to a money exchange service. (Think of an ATM and similar services as a vending machine that serves up cash and other things in exchange for the money in your bank account.)
Now there are the criminal parties. These parties are the ones who come in and exploit weaknesses in the system to get cash and other things. In the course of exploiting these weaknesses, they use the credentials of other people to extract the cash and other things from the actual victims.
Who are the actual victims? They are the banks themselves and they are the sellers of other things.
When the people whose credentials were used in the commission of a crime against the banks and merchants are charged with responsibility for the criminal acts, it is the banks and merchants who are victimizing the people... their customers! The criminal performed their crimes against the banks and merchants. It is the banks and merchants who are passing the burden along to the innocent individuals who quite literally have no way to protect or control the situation. It is the banks and merchants who have the means to control and protect.
Every time I hear "identity theft" and other referrals of uninvolved parties as victims of a crime, the lie bothers me. These banks and merchants have created a system that is weak and exploitable that uses its customers as a buffer and even a shield against those weaknesses. You cannot protect your "secret information" so long as it must be shared in order to use it. And once that information is out there and used, the banks and merchants take money from your account instead of theirs. The original victims are, in turn, victimizing the innocent by declaring that the innocents are victims of the original crime.
I am sure there are plenty of people who disagree with my sentiments on the matter. But if you do, point out the flaw in the logic I presented.
If you have a pair of sunglasses and a jacket, you should be good to go.
1: Get a $10-$25 cash card from your credit card company
2: Slide it through the card reader
3: Light up a cigarette
4: Spray gas all over the pump
5: Slowly walk away, flicking the smouldering cigarette behind you, onto the pump. Speak a one-liner about gas, pumps, explosions, fire, smoking, or credit card fraud. It is very important NOT to laugh at your own joke.
6: No matter how hot your back suddenly gets, keep walking slowly and DON'T turn around, (glass or shrapnel is going to hit you, it's better to take it in the back than in the face.)
7: Never worry about gas pump skimmers for the rest of your life.
I am the richest astronaut ever to win the superbowl.
After waiting patiently for the US Government to implement a carbon tax, the ever-altruistic Utah mafia has decided to take matters into their own hands.
We oldsters in the 1970's used to skim gas out of the gas tank. Some of the more ballsier-types would steal whole gas tankers. The fact that you can skim debit cards at the gas pump without spilling gas on yourself is a great technological improvement since you don't have to resell the gas.
Obviously you have to use debit at an ATM, but at gas stations i use credit, even with my debit card, because once they have your pin they can get cash out of your account and not just do a credit card charge. The crooks would much rather have the greenbacks than having to buy crap with your stolen card and fence it.
Buy a commercial van, outfit it with signage "Bobs fuel pump repair services" or some such. Carry the right tools. Make the attendant sign a receipt for the work. Turn up, install your stuff and go. Fake plates obviously.
http://michaelsmith.id.au
I've been the victim of skimming twice. I love paying at the pump but it's getting out of hand. Even with a credit card it's the inconvenience of filing a dispute, canceling the card, etc. This time they laundered the money by buying five $200 wal mart gift cards with a cloned card.
Here locally they say it's been the Fast Trip and AM PM stations that have been hit. The two with the lowest prices of course.
Hosers!
Never thought i'd get ripped off by a gas pump.
I just assume that half of all the comments on here are the result of millions of monkeys in front of million of keyboards, with some sort of quick check to filter out most of the comments without real words in them.
I'm a gas pump mechanic, and I'm shocked it's not way more prevalent. A handful of keys anyone can buy from a petroleum maintenance supply store without any questions, will open every gas pump on the continent. And most employees at gas stations don't watch their videos continuously, some don't even have video surveillance. The parts inside are easy to swap, as they are very similar to the way a PC is set up, with ribbon cables, USB, etc. I found myself staring at the card reading gear and be amazed at how simple the gear really is, and how easy to swap.
Heck, the security is so poor on most pumps, that I could just crack a panel open a little, and with just a small pair of pliers and 15 seconds, make the pump give me a major discount on gas.
Gas pumps are almost entirely built on security by obscurity. I've only ever seen a handful of gas stations in my travels that have any kind of security system in place to detect if the panels have been opened.
That being said, I don't sweat about being ripped off at the pump, and I just go about my life worrying about much more important things.
Equip all cards with a simple chip. This chip contains an encryption algorithim (something strong enough to not be easily cracked by running brute force on data packets). It would also contain a secret key unique to your account. And it should not give the key itself out.
Then the reader sends a formatted packet containing the PIN (if entered), the options (credit vs debit etc) and the amount of the purchase. The card encrypts this data and hands the reader a data packet saying "this is a chip-and-pin transaction" and containing the encrypted data. The reader sends this through the bank networks to the issuing bank.
The issuing bank has another copy of the secret key which it uses to decrypt the data packet and validate that the transaction is possible (i.e. enough money there etc) and returns a "yes, proceed" result to the card reader. The bank would ONLY record the transaction as a chip-and-pin if it was sent through this process (thus preventing dodgy or compromised swipe-only terminals reading the mag stripe and running up the transaction like a mag stripe transaction but telling the bank its chip-and-pin)
As a gas pump mechanic, I can say that most of those security features are just security theatre. Anyone with even 1 weeks apprentice knowledge of gas pumps can probably get into most pumps without notice, after hours or not.
Also, a safety vest, hard hat, clip board, fancy business card, and an attitude will get you everywhere. Hell you could probably get them to turn off all their security cameras for "testing" purposes too LOL.
My grandfather stole horses...
My father smuggled cigarettes...
My brother stole gas...
I, meanwhile, read Slashdot...
Jeesh, you're an embarrassment to your family's 3 generations of nefarious activities! Get your butt in gear and write some malware or something. :-)
You nearly got carded.
http://en.wikipedia.org/wiki/Lebanese_loop
How can you protect yourself? It's not easy anymore. You now see that a compromised machine doesn't necessarily have semi-obvious modifications you can see from outside. I think people will have to start using temporary credit cards with low limits more often.
I don't know if it was intentional but this seems to have been predicted in Batman of the Future - the characters carry around a large number of "creds" and each one seems to have a limited value. They also used portable devices to trade them - totally possible these days with short-range RFID and readers which could be built into smartphones.
They don't seem to have any authentication (and are sometimes traded like cash). A system like this could work - instead of mints printing money, they'd recycle "creds" which you can then get from the bank and assign to your account. I mean we're already using fiat currencies anyways.
Or maybe I'm getting ahead of myself - if the credit card system were to be overhauled, it would be easier to give the credit card some computational power rather than being basically a glorified barcode sticker (which you can now copy at range, thanks to RFID-enabled credit cards). Put some buttons and a screen (or a touchscreen) right on the credit card and have the card itself initiate an SSL (or similar) connection to the server, using the ATM only to act as a network access point (using some kind of very short range wireless or optical networking) and propose a transaction to the card (send $18.99 to SHIRTCO (Seller verified!) for T-SHIRT, Accept/Deny?). A MITM wouldn't be possible with no way to intercept keypresses or any legible network traffic. With the card running from a ROM, and with no way to access any onboard storage, data couldn't be stolen from there either. Carding someone in a system like this would have to start by physically stealing the card, and with the possibility of deactivating its account on the server side you'd also have to kidnap the owner.
"When information is power, privacy is freedom" - Jah-Wren Ryel