Gas Theft Gangs Fuel Pump Skimming Scams

When I added my American Express card to Apple Pay, it started sending me push notifications for every transaction. It's crazy how fast it is, before I can even put my card back in my pocket my phone buzzes. You see pre-authorizations too, so when you swipe at a gas pump it usually shows a $100 authorization check.

Does it have to be SMS? My Simple card notifies me every time the card is used. https://www.simple.com/

I have "in-app" alerts (push notifications) enabled for a Discover card and two AmEx cards but they are set at relatively high amounts ($500, IIRC). I haven't checked to see how low they can be set. That requires you have their apps installed, however. I'm not sure if you can get them via SMS.

All the banks I deal with offer it. Chase. USAA. Citibank. Capital One.

> The best I have it American Express which will alert me only when I have a transaction over $10.

You can configure that amount in the online settings; change it to $0 and you'll get an alert for every transaction.

I don't know about alternatives, but I noticed that when I hooked up my Amex to Apple Pay, every transaction shows up as a push notification on my iPhone, nearly instantly.

I just checked (and enabled) the texts for any amount over $0 on my Chase card.

I know both Simple and Capital One (their credit cards, at least) offer near-instant iOS and SMS notifications of all transaction.

> Seeing as you have 60 days after posting to dispute a charge, immediate notification seems like overkill.

It's often much more than 60 days.

We had a chargeback at work that was a couple months over a year old. That surprised me...I had thought that a year was the limit.

That's not actually the most surprising thing I learned about credit cards last year, though. We got a notification from the payment processor near the end of the year that a charge from March had been reported as a success but actually failed. By "reported as a success" I do not just mean that the API had reported success on the charge. The payment processor had also reported later that it had successfully settled. They just never actually transferred any money to us.

While talking to them on the phone the payment processor rep then told me that the same thing had happened on the charges on this customer's monthly subscription for all subsequent months.

According to the payment processor rep, the customer had told his bank that he no longer wanted our service (but neglected to tell us...). The card was still good, and so the bank still said "approved" when we would try to charge it, then would apparently later notice that the customer did not want the charge and somehow arrange to block settlement, and the payment processor apparently has no way to report this.

Notice how messed up this is: you can put through a charge on a credit card, have the issuing bank and payment processor tell you it went through, have it settle according to the payment processor, have it show up as successfully settled in all reports from the payment processor...but the money just doesn't show up.

Unless the payment processor tells you about this, the only hint you'll have that something is wrong is that there will be a discrepancy between what is supposed to have shown up in your bank account and what actually showed up, and you won't have any way to tell which charge is the one that silently failed.

It would be nice if you could have some kind of "leading edge" trigger on it, so if there's a transaction from a merchant that's unique in, say, the last two months, you get an SMS. If someone steals your credit card and goes on a shopping spree they're unlikely to do it at the same stores you go to.

The problem with chip and pin is:

A) you want me to type my pin into a compromised device, the pinpad at the pump

B) you expect me to remember seven pins, I carry seven credit cards (yes that's excessive) and each should have a separate pin for security, right?

What is the point of the sigature? Mine never look even close to the same. Is this a serious security mechanism?

If you're not going to do chip and PIN (and you should), why not just chip and nothing?

When I lived in Canada almost 10 year ago, most pumps have contactless readers... so if Canada can do it then it's probably doable here.

(It wasn't NFC exactly, but similar technology)

NFC is limited in the amount you can charge and what's to stop the bad guys fitting their own nfc and taking $5bucks.

Some one has demoed a proof of concept system that you could hide in a back pack and walk through a crowded train/tube station and harvest small sums from hundreds of people.

Almost all recent snack vending machines in the UK support contactless payment. if it's economical to do for £0.50 snacks, it'll work for fuel pumps.

I've found that they will detect the fraud before I do. Like they always have. It's your responsibility to report fraud, but they're the big loser so they have more incentive to find the bad purchases ASAP.

Going through notifications after each purchase, or looking at a monthly bill, you're doing the same thing but in different time periods. We're all on the brink of app notification overload, I don't need one for each purchase I or my wife makes.

But what about the fraud makes using credit cards a 'pain?' It's a pain free system for consumers.

That's what I do I only use atm's inside bank branches where possible.

So conversely if I'm already traveling I should ignore any fraudulent charges until I finish my trip so they don't cancel my card.

What a well thought-out system!

This happened to me once. AMEX and I worked things out. They overnighted a card to me and gave me a number to call if I really had to make a purchase. They were going to generate a one time use card number and the merchant could punch it in. I never did need it though. I just waited for the replacement to arrive the following morning.

As a firefighter, this is an issue around here (Washington state).

People steal the brass end caps off hydrants. Dozens of them. Sell them to scrap metal places.

That conversation, I'm certain, doesn't go like "Oh, hey, I'm Bob from the Fire Department, getting rid of old hydrant caps" "Oh, sure! Sounds legit, Bob, let me give you some cash!"

Indeed, let's tackle that big problem of barrel parts being stolen before it becomes an epidemic!

I'm surprised that running a gas station isn't more regulated, i.e. being required to provide reports of how much has been sold, how much has been delivered, and who it was purchased from (and eventually using ANPR to say who bought how much :D).

In EU something a little bit like this will become mandatory for banks. To my understanding one part of Payment Service Directive 2 (PSD2) is that banks will be required to allow third party access to bank account statements (on customers permission, of course).

http://europa.eu/rapid/press-release_MEMO-15-5793_en.htm?loc...

Why /s? That's actually a really good question.

I am well aware of their various duties. That doesn't detract from my point that enforcement by such an agency is a remarkably inefficient means of addressing the problem.

> I still don't really know how the people in power think about that, because they are the people perpetuating that.

It's a risk-cost tradeoff. Many people desperate enough to work in these areas are happy they actually got even a shit job and don't intentionally defraud their employer (and losses due to customer theft are priced in, anyways). The bet is on those who are crazy/desperate enough to actually exploit the weaknesses in the system to commit bigger fraud - and how much damage is to be expected.

Now, take the expected damage and contrast it with paying your employees more, and I bet that it's cheaper risking one or two 10K thefts a year than paying all employees more which can be, even if you're only running a 10-employee shop and raise salaries by 2-3K/yr, the cheaper option.

From the article:

---- On Oct. 1, 2015, Visa and MasterCard put in force new rules that can penalize merchants who do not yet have chip-enabled terminals. Under the new rules, merchants that don’t have the technology to accept chip cards will assume full liability for the cost of fraud from purchases in which the customer presented a chip-enabled card.

But those rules don’t apply to fuel stations in the United States until October 2017, and a great many stations won’t meet that deadline, said Verifone’s Turner. ----

According to "Yearbook 2005: British Retail Consortium" [1], by the time of the liability shift (1 January 2005) "retailers accounting for 75% of transactions" had a chip+PIN terminal, with the remainder "well on the way". It goes on to explain that small businesses including petrol stations were consulted as the change was planned, there was no relaxed deadline for them. (If my memory is correct, petrol station pumps were among the first to switch, as they had the highest level of fraud — relatively high-value transactions with no supervision.)

[1] https://books.google.dk/books?id=csUYwwVZ2AUC&pg=PT207&dq=ch...

Canada somehow did it. So did the UK and much of Europe. The US is not a special case.

The problem is most gas stations are pre-pay now. So if you want to pay with CC inside, you have to make two trips -- one to give them your card to hold onto while you pump gas, and a second trip to finalize the transaction and get your card back. Unless you know you are buying exactly $xx.xx of gas (and not a fill up), then you could just do one trip to the register.

Another low tech scam involves thieves swapping pump handles on two sided pumps. You swipe your card and the thief on the other side of the pump gets a free fillup. Takes a bit of coordination to not get caught, but most people don't pay attention when they're filling up.

http://www.pressdemocrat.com/news/3869514-181/low-tech-thiev...

In what way is that a scam?

Speed limits and road restrictions are all well and good, but if a tanker catches fire those extinguishers are not going to help. They may help prevent some external fire from propagating to the tanker, but if the tanker itself is burning ... run.

Diesel might seem better, but there are issues. Gas will burn/evaporate away and be gone. Diesel gets into soil and lingers, creating more environmental damage than if gas was left to burn away. The driver is safer hauling diesel, but the environment is safer if he hauls gas. This conflict is more dramatic with propane trucks (bigger fire risk, but no real chance of soil damage).

We are not talking about Europe, we are taking about the US, there is no real safety regulation on the streets, and people heavily mod cars on the war tank model (rigid box for everybody). It's not 30 sketchy tanks in a State the size of Germany that will add any significant risk. Every single handy US guy will weld his own tank instead of buying a plastic one because it's manly and DIY. And they love gas: for the home generator connected to the AC in the summer when the electricity is out, because in the wild everything works with gas engines, because of boating, for preparation to the apocalypse etc. So many reasons to make your own welded gas tank.

Legit oil carrying trucks are everywhere, and they are no real different appart that they hold way more gas in them. As far as I know every single accident involving a volatile liquid carrying truck has led to a fire. There is no real push for double hull or stuff like that in the oil trucking industry. The only safety is segmented tanks, but as far as I know they don't really stop fire propagation (but they stop waves, so they are tremendously useful anyways).

edit: of course, you'll have the prepper, the boat enthusiast, the car or truck modder, the american wild lover, and a bunch of other people carrying sketchy home made gas tanks everywhere around you in the land of freedom.