Kristen Wright
As of press time, the Florida Department of Agriculture and Consumer Services (FDACS) has recovered 179 “skimmers” from fuel pumps and averted some $19.7 million in economic loss to consumers. As a result, the crime rings responsible are hightailing it out of Florida and relocating their activities to other states.
“Florida’s more than 20 million residents and more than 100 million visitors a year shouldn’t have to worry about having their identity stolen every time they fuel up,” said Adam H. Putnam, Florida’s agriculture commissioner.
CRACKING DOWN
Putnam’s agency is responsible for, among other things, petroleum inspection and weights and measures across Florida. In spring 2015, the FDACS Bureau of Standards began receiving reports from law enforcement and industry personnel of a spike in stolen debit and credit card information. The bureau’s initial investigation revealed a common denominator: illegally installed card-reading devices called skimmers at pay-at-the-pump filling stations, said Matthew Curran, chief of the bureau.
The numbers show why Florida would be a draw for skimming operations. The state is home to more than 8,000 retail gas stations and some 65,000 pay-at-the-pump card readers. What’s more, Florida drivers are among the top three in fuel consumption, behind only Texas and California, according to the FDACS.
Do the math, and roughly 10 billion gallons of motor fuel consumed annually equal a lot of transactions.
Curran said that criminals install several kinds of fuel pump skimmers, but the most common type uses a hidden memory storage device inserted into the ribbon wiring that facilitates the legitimate transmission of debit and credit card information for the authorization and purchase of fuel. This kind of skimmer must be physically removed from a gas pump to retrieve the information.
Another skimmer variety, Curran said, allows criminals to access card information remotely via Bluetooth.
Regardless of type, skimmers intercept and record the information being transmitted without disrupting transactions, so neither consumers nor gas station attendants are aware as the identity theft takes place.
“We have never encountered a situation where the skimmer altered the function of the device,” Curran said. “The crook obviously doesn’t want to bring attention to their illegal activities, so they work hard to ensure the (pump’s) function is not altered.”
After the FDACS uncovered the skimming surge in Florida, Putnam called for a statewide sweep of Florida’s retail gas stations for the equipment.
“We’ve taken an all-hands-on-deck approach to protecting consumers from skimmers, and with strong partners in law enforcement and the Florida Legislature, we’re cracking down on skimmers and the criminals responsible,” Putnam said.
From March through May 2015, Florida Agriculture Department inspectors found 103 skimmers at 96 gas stations throughout the state, all undetectable to the naked eye, Curran said.
“There were three skimmers discovered at one location, but that was the highest total at any individual station,” he said.
Nationally, each victim of account takeover fraud experiences an average of $1,103 in losses, according to estimates of the National Crime Victimization Survey (NCVS). Industry estimates suggest roughly 100 card numbers exist on each skimmer, but the number varies, depending on the time and consumer activity at a given location. An estimate of the direct and indirect economic loss to the public is $110,300 per skimmer.
As for the skimmers found in Florida during the three-month sweep, Curran said that “most if not all” are believed to be the non-Bluetooth variety.
“Both are out there, but Bluetooth devices in credit card readers appear to be the transitioning trend,” Curran said. “Up until recently, the only ones found were the memory stick variety that were inserted into the ribbon between the card reader and the payment processing boards.”
Regardless which device they use, thieves who obtain the card information either sell it (often as a block of numbers) or download and then transfer the information to blank debit or credit cards to make illegal purchases. That’s where the plot thickens, Curran said.
“From information provided by law enforcement,” Curran said, “once the numbers are skimmed from gas pumps, they are transferred to blank cards. And individuals take stacks of those to gas stations and purchase fuel with the stolen cards. They put the fuel into ‘bladders,’ or large, sometimes hidden tanks, and then once they have several hundred gallons, they take the fuel and sell it at rates well below current market rates that you and I can purchase fuel from legitimate
retail stations.”
During fiscal year 2014-2015, another branch of the FDACS, the Office of Agricultural Law Enforcement-Bureau of Investigative Services, initiated more than 300 investigations relating to the inspection of gas stations for skimmers. During that time, there were nine felony arrests for “unlawful conveyance/credit card crimes.”
For fiscal year 2015-2016, the number of arrests (as of December) was five, according to the bureau. That brings the number of arrests in Florida associated with counterfeit credit cards and diesel fuel theft to 51 since 2008.
The FDACS Division of Agricultural Law Enforcement issued a statement about its involvement since 2008:
In 2008, the Office of Agricultural Law Enforcement-Bureau of Investigative Services was asked to provide assistance to Murphy USA, a nationwide petroleum retailer.
According to their internal investigative unit, their stores in the Tampa Bay area were losing thousands of dollars a day in the theft of diesel fuel by use of counterfeit/compromised credit cards.
Their investigators had conducted surveillance operations at their stations in the Tampa Bay area and discovered that the criminals look as if they are pumping gas like any other customer, but their vehicles, vans, trucks and SUVs were fitted with hidden tanks that can hold several hundred gallons.
The hidden tanks range from sophisticated contraptions to a simple plastic or metal container inside the vehicle.
The Office of Agricultural Law Enforcement in conjunction with Murphy USA investigators began a surveillance operation at several of their stores in the Tampa area. In the several-week operation, investigators arrested 10 individuals for unlawful conveyance of fuel and identity theft crimes with the associational use of 132 counterfeit re-encoded cards recovered.
Since this initial criminal investigation, investigators have worked numerous other investigations involving counterfeit credit cards and the unlawful conveyance and purchase of diesel fuel throughout the state of Florida. Investigators have determined through proffer interviews with defendants arrested for the unlawful conveyance of fuel and credit card crimes that the diesel gas theft rings in the Florida area are typically reselling the stolen diesel on the black market to independent dump truck and semitruck drivers at a fraction of the usual cost.
The Office of Agricultural Law Enforcement has been in contact with local, state and federal law enforcement officials whom (sic) have been investigating the large-scale credit card and debit card fraud organized by Cuban nationals who have several “cells” operating in the state of Florida.
The people involved obtained stolen credit card and debit card data by skimming devices installed in gas pumps to buy it from online black market sources. They then re-encode the data onto the magnetic strip of blank cards such as gift cards to create cloned credit and/or debit cards.
LEGISLATION
Anyone convicted before 2016 in Florida for illegal skimming could be slapped with a third-degree felony and a five-year maximum prison sentence. But times are changing.
One problem with skimming equipment is that its components are perfectly legal. Small businesses, for example, use card readers to accept credit and debit payment, and nearly everyone who owns a computer uses memory sticks to copy and transfer files to other computers, Curran said. So Florida is cracking down on skimmers through legislation that calls for stiffer penalties and tighter security at gas pumps.
As a result of the FDACS skimmer investigation, Putnam championed Senate Bill 912 and House Bill 761 with support from the Florida Sheriffs Association, Florida Police Chiefs Association, and the Florida Petroleum Marketers and Convenience Store Association.
Passed by both the Senate and the House in March with only a single “no” vote, the bill now needs Florida Gov. Rick Scott’s signature to become law (as of press time). The law will mean several changes:
• Illegal skimming will be elevated to a second-degree felony, punishable by up to 15 years in prison.
• The signed law will mandate that Florida gas station owners tape the openings of their gas pump cabinets with pressure-sensitive tape. Customers and owners who notice broken or lifted tape will know that a cabinet has been opened and possibly compromised.
• The signed law will change felony requirements to include “possession” of counterfeit cards; not just trafficking them.
• The signed law also will reduce the threshold for the minimum number of counterfeit cards from 10 to five.
COMBATING SKIMMERS
Curran said fuel retailers and equipment manufacturers may combat skimmers several ways.
• Use chip and PIN technology. Chip and PIN credit cards, also called EMV cards, are more technologically advanced than traditional credit cards with magnetic strips that contain credit card numbers and card holder information. In chip and PIN credit cards, all the information is stored on a computer chip in the card. The chip uses cryptography to protect secure data when communicating with a card reader, so skimmers can’t access the information.
• Use pressure-sensitive security tape. Customers and owners who notice broken or lifted tape know at a glance that a fuel cabinet has been opened and possibly compromised.
• Improve security locks on dispenser housing. “Currently, generic locks are found on dispensers, meaning that common keys can open locks at many stations,” Curran said. “Site-specific locks would be more secure in that only keys at that individual location would open the locks, thus a criminal with a handful of keys would not have one that fits a site-specific lock.”
• Use electronic measures that shut down pumps upon unauthorized entry. “One vendor makes a device that if unauthorized access occurs (e.g., a criminal opens the dispenser face, gaining access to the payment system), the dispenser shuts down automatically,” Curran said. “The dispenser cannot be brought back online without calling the dispenser manufacturer’s technical support desk and receiving a unique PIN to enter into the dispenser’s computer. The manufacturer’s technical support unit would ask for proper authorization codes and/or identification before
releasing any reactivation information.”
• Require an approval code to reactivate pumps. This code, referenced above, comes from the pump manufacturer, not the store owner.
THE LATEST
“Our petroleum inspectors have increased the emphasis on checking for skimmers in every gas pump they inspect,” Curran said. “They normally inspect the overall operations of every gas pump during a routine full inspection, but they have been instructed to always open the dispensers for each level of inspection they perform.”
In addition, numerous states and organizations across the nation have asked the FDACS for information and strategies to develop their own plans to fight skimming. The FDACS is working with the National Conference on Weights and Measures, as well.
The result of the FDACS investigation and knowledge share has been fewer skimmers found recently in Florida, but skimming has increased in other states, Curran said.
“Some have speculated it is due to our aggressive approach in Florida, flushing them into other states where they may believe they have less of a chance to get caught or lose their skimming equipment,” he said.
Curran said fuel retailers need to be aware of two recent changes: skimmer designs and the duration and frequency of skimming patterns.
“As we understand it,” Curran said, “many skimmers are homemade, but we’ve heard that skimming devices are being manufactured directly into credit card readers and manufactured in other countries. The crooks are then replacing existing credit card readers with these altered readers.”
And the criminals have adjusted their working hours, for example, placing skimmers into pumps on Friday evenings and taking them out early on Monday mornings.
“It appears as though the crooks are targeting days and times when they feel we and law enforcement agents are less likely to discover the devices,” he said.
Extracted in full from the PEI Journal.
