Credit Card Skimmers

Protect Your Station from Credit Card Skimmers

The Minnesota Department of Commerce wants to help service station operators protect their customers from credit card skimmers.

Skimmers are electronic devices which steal credit card information from card readers on gas pumps and ATMs. Criminals have been breaking into dispenser cabinets across the country to install these devices and secretly record credit card information. Often, a criminal can use wireless technology to download the stolen information to a laptop.

The best way to protect your customers is to implement a program that deters criminals from installing skimmers, detects skimmers if they have been installed and trains your employees how to respond when they find suspicious devices.

Would you like to receive our email updates?
Click to subscribe

Deter Installation of Skimmers

The best way to deter criminals from installing skimmers on your pumps is to make it hard to get into the dispenser cabinets – and to let them know that there is a good chance they will get caught if they try.

Respond to Skimmers
- Notify the Minnesota Department of Commerce as soon as you detect a skimmer.
- Shut down the affected dispenser immediately. Do not let customers continue to use it.
- Treat the entire dispenser and the suspicious device as evidence. Avoid touching the device and the dispenser.
- Leave the device in the dispenser until law enforcement can remove and take custody of it.
- Preserve copies of any video footage you have up to the time the device was discovered. It may be needed for the investigation.
Change the locks and keys on your pumps

Universal keys for the cabinets of all major dispenser brands are easily obtainable from service companies and other sources. Standard dispenser locks are meant to keep curious customers from opening gas pumps, but they weren’t designed to deter crime. Criminals can pry open most cabinets in just seconds even if they don’t have keys. Protect your equipment by beefing up the locks and customizing the keys. Also consider placing security tape over the key holes. Use anti-tamper tape that shows "VOID" when removed from the applied surface.
Customize security tape and place it effectively

Security tape is widely available from many sources. If you use security tape, customize it so that it is not easy for criminals to replace it with their own identical tape after they have installed a skimmer. Use anti-tamper tape that shows "VOID" when removed from the applied surface. Use the tape on the outside (not the hinge side) of any cabinet door that accesses the card reader. In most cases, that is the upper compartment of the dispenser. It may also be the small compartment where the printer paper is installed. You can also place the tape over the key holes.

Security tape alone cannot actually stop criminals, but it will let them know you are looking for skimmers – and it will alert you if a dispenser has been opened.
Install security cameras to capture activity on all dispensers.

Criminals may target remote dispensers because they are less visible to the cashier, but they may also risk installing skimmers on the heavily-used dispensers close to the building because they get a bigger payoff in less time. Often they work in pairs or groups. Some distract the cashier while their partners install the skimmers. Review security film regularly, especially after unusual encounters which took employees’ attention away from the pumps.
Advertise on your dispensers that you are checking for skimmers.

Detect the Installation of Skimmers

Know how to recognize skimmers

Train your employees to know what the insides of your dispensers are supposed to look like.
All credit card readers have a small computer board at the back with a 7-pin connector. A communication cable connects from that 7-pin connector to a larger computer board inside the dispenser. The cable is the only thing that should connect to the 7-pin connectors on each board.
Criminals rarely install more than one or two skimmers at any location, so any dispenser with inside equipment that looks different from the others might be compromised.
Skimmers don’t all look alike. Some can look like home-made bundles of duct tape, electrical tape, watch batteries and computer wire. Others can be so sophisticated they look like real components of the dispenser. Regardless of how they look, they all must copy the credit card signal at one of four places near the reader. Make sure to check all four places every day.

Check for skimmers on every dispenser every day.

It takes an average of 10 seconds for a criminal to break into a dispenser and install a skimmer. Just because you found no skimmers yesterday doesn’t mean they weren’t installed overnight. Make checking for skimmers a regular daily duty. Design your internal inspection program in a way that triggers an alert to upper management if the daily inspection does not get done.

Suspect anything that is unusual or does not match the other dispensers.

Criminals are constantly designing new devices and ways to steal information. Suspect anything that looks unusual. When in doubt, shut down the dispenser and consult your service company or contact the Minnesota Department of Commerce.

Other vulnerable devices

Gas pumps are not the only devices at risk of credit card skimmers. Thieves can install external skimmers in seconds on the credit card readers of your ATM machine or even on the credit card reader at the counter as shown in this video.
Protect your customers and business by checking every day for external skimmers on ATM machines and counter credit card readers. Use tamper tape on these credit card readers so that you can easily see if a skimmer has been placed over the reader.
Don’t forget your car wash! Credit card readers on car washes are vulnerable to both internal and external skimmers because the cabinets are easily opened. Use tamper tape to cover the card reader to detect an external skimmer. Also use tamper tape on the cabinet so you can see at a glance if it has been opened.

External
Internal

External Skimmers

External Skimmers fit over the outside of the card reader and steal the credit card information as the card is being slid into the slot. They can be detected because they stick out just a little further than the other card readers. They may also be a slightly different color or material and look like they are newer or older than the card readers on the other pumps. Often they will feel loose when you try to wiggle them. Some may even come off in your hand.
Internal skimmers

Internal skimmers on the card reader board

Internal skimmers on the card reader board may look like another computer board except that instead of being directly connected to the card reader, they will plug in to the 7-pin connector at the same place where the communication cable connects. If you look at other dispensers, they will not have the same extra board.

If most boards look like the board on the left, suspect boards that are similar to the board on the right.

Internal skimmers on the communication cable

Internal skimmers on the communication cable look like 7-wire cables with some kind of device on the end. The cable plugs in to the 7-pin connector on the credit card reader’s board on one end and to the real communication cable on the other end.

Internal Skimmers on the Main Board

Internal Skimmers on the Main Board will look like a skimmer board that would be attached to the credit card reader board. Suspect it if it is connected to the main board at the 7-pin connector where the communication cable from the card reader connects.

In addition, criminals may try to capture PIN numbers at the same time they capture credit and debit card information. Look for cameras aimed at the keypad, false keypads placed over the real keypad or connections from the keypad to an internal skimming device.

Card Skimmers