App to scan for card skimmers at gas pumps

[JHZR2]

Originally Posted By: SirTanon
Originally Posted By: StevieC
Are you responsible for the charges if your card is skimmed?


For virtually every credit card out there, no.. debit cards, however, are a different story. This is one major reason I've switched to ONLY using a dedicated credit card with a $500 limit to buy gas for my car.


Given that there are credit cards that give cash back fir gasoline, it makes zero sense to buy gas with debit, imo.

Add on top of it the liability element and it makes even less...

 

[y_p_w]

Originally Posted By: Carmudgeon
Originally Posted By: y_p_w
I'm wondering when the first smart card (aka "chip card") systems will be used for POS terminals like pay at the pump. They're already used at self-checkout at stores. They're pretty much immune to skimming. I think a description would be that they receive a "token" that gets fed through an algorithm on the chip inside the card, and there's a unique response. With a different token sent for each transaction, there's nothing that can be used to reverse-engineer the algorithm just by monitoring the entire transaction.


The original deadline was now, October 2017, but it has been pushed back to 2020.

Getting the pumps compliant was more complicated, and costlier than planned.

Quite a few companies have gone with some contactless smart card type system like ExxonMobil's SpeedPass system. It's not conceptional all that different than the "chip card" systems. Of course the idea is that it's futile to try and monitor the transaction because the formula to respond to a large number token is impossible to decipher.

 

[Errtt]

Okay so has anyone running this app had a positive skimmer hit?

 

[LoneRanger]

Originally Posted By: Carmudgeon
Originally Posted By: y_p_w
I'm wondering when the first smart card (aka "chip card") systems will be used for POS terminals like pay at the pump. They're already used at self-checkout at stores. They're pretty much immune to skimming. I think a description would be that they receive a "token" that gets fed through an algorithm on the chip inside the card, and there's a unique response. With a different token sent for each transaction, there's nothing that can be used to reverse-engineer the algorithm just by monitoring the entire transaction.


The original deadline was now, October 2017, but it has been pushed back to 2020.

Getting the pumps compliant was more complicated, and costlier than planned.


You have got to be [censored] me. Card fraud is already at epidemic levels, it's a [censored] free for all right now so by all means, yeah let's postpone the conversion another three fecking years. So, how is it that Canada is chip only now and USA somehow we have to delay another three yrs because we're that lame at rolling out full compliance? What a joke.

 

[blupupher]

Originally Posted By: LoneRanger
... So, how is it that Canada is chip only now and USA somehow we have to delay another three yrs because we're that lame at rolling out full compliance? What a joke.

Well, Canada only has like what, 10 gas stations?

I do agree though.
I can understand the cost with replacing current card readers, especially at smaller, low volume rural stations, but there really is no reason that stations built in the past 2 years or so should not have them.

 

[JustinH]

had my bank debit card skimmed last week.

Bank reversed charges instantly and put a new card in the mail.

Friends told me I should run gas charges as credit not debit, so I started doing that.

Not using credit cards, as I am paying them off.

 

[eljefino]

I'm not playing on my phone every time I buy gas. Too busy.

Use my credit card, fully protected.

 

[StevieC]

Originally Posted By: blupupher
Originally Posted By: LoneRanger
... So, how is it that Canada is chip only now and USA somehow we have to delay another three yrs because we're that lame at rolling out full compliance? What a joke.

Well, Canada only has like what, 10 gas stations?

I do agree though.
I can understand the cost with replacing current card readers, especially at smaller, low volume rural stations, but there really is no reason that stations built in the past 2 years or so should not have them.

11 but who's counting...

 

[riklyn]

I also had this happen last week. Bought gas Thurs. evening, just happened to check account Fri. morning and there was a charge at a another station in my town. Called bank, charge was made at 5:00am. I made police report (really a waste of time, but I was pizzed) filled out dispute claim with bank and refund was within 24hrs.

I wonder if the owners are involved and will not be using either of these stations again.

 

[LoneRanger]

I dearly hope, so dearly, that the liability protocol put in place October 1, 2015 is causing large carding targets like Walmart to eat charge backs at record rates. Only when big W gets tired of taking it in the wazoo from cloned card charge backs will they maybe exert some pressure on the financial sector to tighten up the way the ship is run, i.e. ditch magnetic stripe swipes altogether.

 

[Carmudgeon]

Originally Posted By: LoneRanger

You have got to be [censored] me. Card fraud is already at epidemic levels, it's a [censored] free for all right now so by all means, yeah let's postpone the conversion another three fecking years. So, how is it that Canada is chip only now and USA somehow we have to delay another three yrs because we're that lame at rolling out full compliance? What a joke.


The EMV transition was originally planned out over a three year period.

First, the POS terminals in retail store counters would need to comply by October 1, 2015.

Second, terminals in ATMs in October 2016 (Mastercard), and October 2017 (Visa)

Third, terminals in gas pumps, which was originally set for October 2017.

The card associations' (Visa, M/C, AMEX, etc.) "stick" (there was no carrot) to make this happen was to shift liability from the card issuers to any merchants who didn't modernize their systems and comply.

What they didn't anticipate was the cost and complexity that the merchants would have to bear to make it happen. Some merchants would rather just take the risk than spend the money to buy new equipment and software. Even those who did make the effort ran into problems with the software, and integrating it into their other systems.

So it turned into a kind of wild west, where some stuck with the old equipment, some bought new equipment, but didn't activate it because the software wasn't ready. Even for those that were prepared and had the equipment working, there was the issue of training their clerks, and customers to adapt. For a while, I dreaded being in line behind someone using a credit card because of the extra it needed for them to learn how to use ("dip") the new system, and clerks often weren't much help. Early versions of the software also took more time to process the transactions.

The gas pump deadline was extended because station owners faced those issues and more -- apparently, some old pumps cannot be adapted, and the pumps have to be replaced. Even for a small station, that's a very large chunk of change, so the card issuers have cut them some slack.

If you want to blame anyone, blame the station owners, but in the meantime, we have to bear that burden.

And yes, the US is woefully behind in adopting EMV that the rest of the world had long ago. Worse, the form of EMV set as the standard is lower than the rest of the world uses.

Originally Posted By: LoneRanger
I dearly hope, so dearly, that the liability protocol put in place October 1, 2015 is causing large carding targets like Walmart to eat charge backs at record rates. Only when big W gets tired of taking it in the wazoo from cloned card charge backs will they maybe exert some pressure on the financial sector to tighten up the way the ship is run, i.e. ditch magnetic stripe swipes altogether.


Walmart and others have tried to do an end around on the card issuers altogether, by developing their own new payment system to avoid merchant fees. (see--CurrentC) It failed miserably. It has implemented EMV though.

 

[LoneRanger]

Originally Posted By: Carmudgeon

If you want to blame anyone, blame the station owners, but in the meantime, we have to bear that burden.

And yes, the US is woefully behind in adopting EMV that the rest of the world had long ago. Worse, the form of EMV set as the standard is lower than the rest of the world uses.


It's not that hard to make genuine effort to fight skimming. Just takes some people with the authority to legislate who are willing to stand up and do something about it:

https://www.cityofmadison.com/news/gas-pumps-in-the-city-of-madison-now-safe-from-credit-card-theft


Big mean old city council, making those poor gas station owners secure their flimsy pumps. The nerve of Madison to act in protection of their citizen's !!! Poor gas stations owners going to have to spend a few bucks per pump to upgrade their antiquated locks.

 

[LoneRanger]

Gas stations have no incentive to step up and do the right thing. It is their antiquated infrastructure that is the key component being exploited that creates an entire category of card fraud where the losses to merchants are approaching the hundreds of millions of dollars. The gas stations are kind of like if Microsoft never did anything to address the myriad of security flaws in each version of Windows, refusing to release any updates whatsoever and simply telling users "too bad so sad, not our problem."

Here's how you force gas stations' skin into the game: If law enforcement can tie fraud victims to a particular common point of exploit, a particular gas station, then it's Tort Claim time and bring in the lawyers. Sue them to the brink of bankruptcy for Gross Negligence. Not a hard tort case to prove by Preponderance of the Evidence. Go for the largest settlement the defendant gas station can bear. Make an example of one or two this way and publicize it well, and others will fall into line and start securing their pumps.

Short of private attorneys, then the state Attorney General's Offices need to step up. Someone has to force the hand of the gas stations to secure their pumps, the stations do not give a rat's [censored] if your card is skimmed because it doesn't cost them a dime if it happens and it costs them a dime to secure their pumps. Time to end that situation and force them into implementing Security Best Practices.

Which costs more, changing out the locks on pumps or losing a lawsuit?

 

[Garak]

Originally Posted By: JHZR2
Given that there are credit cards that give cash back fir gasoline, it makes zero sense to buy gas with debit, imo.

Unfortunately, not everyone can afford credit cards, and some places here require pay at the pump after certain hours, or even all day in certain neighbourhoods. In BC, there is even legislation about it after some robbery years ago.

LoneRanger: You're quite right. I haven't seen any name brand gas stations that lack a chip reader right now, and even the reputable independents. There might be some tiny, discount independents or full serve only stations (a couple still exist) that don't have it, but that's about it. Heck, the chip system is already on its second or third generation of encryption protocols.

As for the oldest stations, I might have to take a peek over the next couple days, but I bet I'll have little luck finding ones that don't have a chip reader on the pump.

 

[UberArchetype]

Originally Posted By: Garak
As for the oldest stations, I might have to take a peek over the next couple days, but I bet I'll have little luck finding ones that don't have a chip reader on the pump.

I just completed a 5,000 mile round-trip across the country, fueling up at least 10 times in 5 different states along the way and saw not a single station with chip readers on the pumps between Denver and Plymouth, NH.

 

[DBMaster]

Originally Posted By: UberArchetype
Originally Posted By: Garak
As for the oldest stations, I might have to take a peek over the next couple days, but I bet I'll have little luck finding ones that don't have a chip reader on the pump.

I just completed a 5,000 mile round-trip across the country, fueling up at least 10 times in 5 different states along the way and saw not a single station with chip readers on the pumps between Denver and Plymouth, NH.


Garak is in Canada. Europe and Canada switched to "chip and PIN" payments LONG before the U.S. did. We still don't have chip and PIN. The chip is not enough, IMO.

 

[Garak]

Originally Posted By: UberArchetype
I just completed a 5,000 mile round-trip across the country, fueling up at least 10 times in 5 different states along the way and saw not a single station with chip readers on the pumps between Denver and Plymouth, NH.

It is interesting how different it is. The only pumps I can think of without any pay at the pump functionality are a couple Coop examples in small towns, but that's no chip, no stripe, no nothing. I can't think of any stripe only options.

 

[DBMaster]

Originally Posted By: Garak
Originally Posted By: UberArchetype
I just completed a 5,000 mile round-trip across the country, fueling up at least 10 times in 5 different states along the way and saw not a single station with chip readers on the pumps between Denver and Plymouth, NH.

It is interesting how different it is. The only pumps I can think of without any pay at the pump functionality are a couple Coop examples in small towns, but that's no chip, no stripe, no nothing. I can't think of any stripe only options.


Garak, the U.S. has been slow to adopt the chip. The deadline keeps being pushed out. Most retail locations now use it, but there are still some notable exceptions. I have yet to see a chip reader on any gas pump. I believe the main reason was the sheer scale of having to change all the readers and software in the U.S. I also recall that we haven't had the PIN requirement added yet because Americans may find it "too inconvenient." We really need BOTH chip and PIN, but for now it's just chip or chip and signature.

 

[Garak]

Yep, chip and pin here, except for tap, of course. As for paying for gas that way, it sure is more convenient than years ago, having to bring in a fistful of cash or a driver's license when filling late at night before they'd turn the pump on. I think I've filled far more often after midnight than before, so places have security procedures.

 

[DBMaster]

I remember clearly when the stations here converted to pay-at-the-pump. It was in 1994. So awesome! Back then they would still turn on the pump for you no matter how you were paying, but you had to go inside to pay. Now, of course, paying in cash is quite inconvenient - requiring two trips inside thanks to the scumbags who perpetrated proliferate drive-offs when gas prices were higher.