New Breed of Fuel Pump Skimmer Uses SMS and Bluetooth
krebsonsecurity.com
krebsonsecurity.com
Also, I wonder if there would be a way to enclose virtually all of the pump in metal so that the card reader would be RF shielded and removing the shielding would cause a noticeable change in appearance.
The delivery address gives you away though. Either you or one of your associates is going to have to be in a specific place at a specific time to sign for the package.
Have you seen the security video that comes out of most convenience stores? You can't even make out people who rob the place at gunpoint.
90% of convenience store surveillance cameras make Ring doorbells look like tools of the NSA. (In terms of image quality, not the other way.)
Seems more likely than someone discovering a GPS tracker on their car and sticking it to a gas pump that just happened to also contain a skimmer device. I'd more likely attach the thing to a random landscaping vehicle so the "stalker" could see it going to all sorts of upscale houses.
--edit--
Or, after a bit of googling and not being able to find the specs on that thing, it could be a canary device to tell the skimmers "the jig is up" as it has motion tracking.
What’s so groundbreaking about Bluetooth skimmers and a central hub with long-range comms (GSM, etc)?
This seems like a logical evolution, and frankly I’m surprised it hasn’t been done already (or maybe it has, but those guys were good enough to not get caught yet).
In any case I was pretty disappointed by the alarmist tone of the article. Are the people who investigate these things that far out of touch with the state of technology nowadays ?
Anyone can buy a Raspberry Pi and a GSM module and get up and running with a bunch of tutorials from Google. It’s not rocket science.
I had to a couple times when driving to California for an internship, because despite telling my CC company this I didn't specify exactly what days I would pass through which states, so even after entering my billing ZIP (and calling to confirm, yes, I assure you I'm traveling) I'd be forced to pay inside.
You had to specify a specific amount though and most interestingly, if you overshot (asked for 50, used 46) they refunded the difference in cash.
Personally, since I am not responsible for credit card fraud, I simply choose to have a separate card for re-occuring payments like my phone and internet. If someone skims my daily spending card, I'll just report it as fraud and not worry about it.
I never seen that. What I always saw was they authorize for $50, then charge $46. If they're doing how you described it, they're paying interchange on the extra and not getting anything for it.
It does, however, require that the machine operator is aware of how to do those operations - it's probably easier for them to just charge the card for the set amount, and refund in cash.
Though this slightly increases their risk, as any chargebacks means not only do they lose the product, but the cash too.
And if it does... just call your bank and get a new card and get the transactions reversed in a 30min phone call.
Such criminal activity tends to occur in concentrated pockets.
Gas stations around Joshua Tree, CA had been rumored to be skimming people's cards, and some now carry large official stickers warning users of their cards likely getting frozen for 72 hours should they be used at the pump, confirming the rumors.
I imagine the active number is probably more in the thousands nationally. There are a lot of lower income, high-crime areas where pumps are neglected. The Venn diagram of gas stations lacking squeegees and those compromised I suspect has a lot of overlap.
Why do I care if someone hacks that, can they blow up the gas station?
Ten seconds later: ooooh.