CINCINNATI — Credit card skimmers have hit local gas stations hard — and thieves don't even have to break into the pumps to do it.
Some pumps use a master key which can be purchased online, allowing crooks to unlock pumps and install skimmers with ease.
Hamilton County Auditor Dusty Rhodes said 17 credit card skimmers have been identified in Ohio since October 2015, and some county auditors believe thieves are targeting gas pumps because they’re so easy to get into.
Investigators found this skimming device at a Mason gas station in December.
No larger than a thumb drive, these tiny devices pose a major threat to consumers and their credit card information. Rigged and wired to fit the inside of gas pumps, credit card skimmers are completely invisible to consumers and retailers.
“Typically, what they’ve done in the past, is they’ll pull a U-Haul alongside the pump, maybe even two of them, so that kind of blocks the pump,” Rhodes said. “They’ll get that thing in there in two minutes, just pop it right in.”
Rhodes said some companies like Kroger and United Dairy Farmers have increased security at their pumps by doing away with the universal lock, but older gas stations are a major target, according to Montgomery County Auditor Karl Keith.
“The older pumps that are out there, many of those have a universal lock on them that you can get a key — I mean we got one off of eBay — but they’re readily available and there’s nothing illegal about it,” Keith said.
Since the first credit card skimmer was found in Montgomery County, Keith has taken the lead in trying to combat the problem — educating retailers, law enforcement officials and the public on how to identify the fraudulent card readers.
RELATED: Hamilton County auditor convenes 'skimmer summit' to protect consumers
He said the only way to completely protect pumps from being opened is to change the universal locks.
“There would be some expense involved in that, but certainly from our viewpoint, that’s one of the most proactive, meaningful things to be done to secure those pumps,” Keith said.
Identifying a Skimmer
Locks aren’t the only issue with dated gas pumps. Some may have old hinges, making it easy for thieves to pry the door open, even if they don’t have a master key.
Jeff Lenard, spokesperson for the National Association of Convenience Stores, said consumers should look for signs that a door has been tampered with before swiping their cards.
“If somebody doesn’t have a key, they will pry the door open, and you can tell when the door has been pried open,” Lenard said. “It may not line up properly, and there may be an indication that it has been damaged and opened in installing the skimmer.”
Eight gas stations in Butler County are known to have been hit with skimmers, according to Deputy Auditor David Brown. He said thieves tend to target pumps off the interstate in high-traffic areas.
Brown said in addition to the devices inside of pumps, there are also plastic faces that criminals stick on top of card readers at self-checkouts and gas pumps. The overlay looks identical to the real machine, sometimes even down to the brand name.
“When you scan your card, it’s going through their piece before it goes through the store’s piece,” Brown said. “It’s just a little application that they apply over the outside to hide their skimmer, their readers, which are on the inside of that piece.
"So, you think you’re going through a regular scanning, and you’ve actually put your card through their device first.”
Brown offered tips to consumers to spot these overlay applications. He said it’s a good idea to wiggle the face of the card reader if it looks like there's been tampering.
“What we’ve found at a Wal-Mart was the skimmer was applied with double-sided tape. So it’s not always on there all that securely,” Brown said. “This application over the top of it, if you give it a little movement, you’re going to feel movement back.”
He also said the overlays are larger in size since they have to go over the store’s card reader, so consumers should compare the size of the reader they are using to others in the store.
An overlay application on a gas pump might look unusually new in comparison to the other readers that have been faded by weather.
Brown suggested consumers monitor their bank accounts regularly in case there is suspicious activity. He said people wrongly assume their credit card number was stolen at the last place they swiped it.
“A lot of times this information is gathered by one group of criminals, sold through what they call the black web, where they sell that information to a third party, criminal organization,” Brown said. “Then that group clones a card and then utilizes the information to take the money.”
Brown said it can take up to a month for criminals to use the information they have stolen.
“Just because somebody just used it does not mean they just stole the information,” Brown said.
Protecting Pumps, Consumers
Butler County has two individuals on its weights and measures staff, and the office trained three others to inspect for skimmers in May.
Brown said it has already paid off to have the extra eyes searching for skimmers.
“One of those additional inspectors actually found the last skimmer in the area on June 7,” Brown said. “We’re just trying to be as proactive as we can be to let the bad guys know, in Butler County we’re looking quite regularly."
In addition to regular inspections, the National Association of Convenience Stores sells stickers to many retailers so they can seal the doors of their gas pumps. The stickers are made of a durable, plastic-like material that shreds when tampered with, leaving behind a clear indication of the door being opened.
Keith explained that the seals can be problematic, though. Some retailers have placed them incorrectly on their pumps, which has created a false sense of security for the consumer and no prevention.
About 80 percent of gas stations in Franklin County, Ohio are putting tamper-proof stickers on pumps, according to Justin Rogers, supervisor of the Franklin County Weights and Measures Department. Retailers in Butler and Hamilton counties are also sealing their pumps.
Rogers said skimmers have not yet been found in Franklin County, but they're still taking precautionary measures.
“We’re putting stickers on the pumps just to let residents know that we are checking them,” Rogers said.
Rogers also discussed the possibility of gas stations installing chip readers at the pump, an initiative that could cost roughly $1 billion nationwide.
Chip readers at pumps would provide additional security, but until then Brown suggested that consumers never pay with a debit card at the pump.
He said personal identification numbers can be stolen in addition to a debit card number, giving the scammers direct access to accounts.
In addition to spreading awareness to the public, the National Association of Convenience Stores educates retailers on how to protect their business from credit card skimmers.
“The challenge with skimming is if your store gets skimmed, whether or not you took the best precautions, consumers will remember your store as a store that was hit and it can affect your business,” Lenard said. “You want to do whatever you can so you’re not that store.”
He suggested that gas station owners encourage their staff to check for skimmers as a part of day-to-day maintenance.
After a surge of skimming in Florida, lawmakers passed legislation in March requiring gas station owners and retailers to maintain a standard of security for their pumps. SB 912 also increases penalties for those who steal credit card information.
Keith said similar legislation may be on the horizon here.
“We’re exploring some legal avenues… We’re looking at that, and we’re talking with some legislators about that particular bill and seeing if that’s something we can push through here in Ohio,” Keith said.
