Texting and skimming

Skimming in the United States has taken another leap forward as the criminals attempt to stay one step ahead of law enforcement and vigilant merchants. Skimming is a lucrative enterprise for many thieves who take the stolen information and sell it on the Dark Web or use it themselves to go on a spending spree with their victim’s bank account. But there has almost always been an element of danger to it for the criminal.

You see at first the crook had to come back and remove the skimmer meaning they could be caught red handed. A wireless transmitter helped to eliminate that danger but not only did the criminal need to come within range of the transmitter, meaning they still needed to return to the area and risk being caught but their wireless transmitter could be picked up. Recently an infrared skimmer was found in Oklahoma that removed the danger of the signal being picked up. In New York in July 2017 skimmers were found taking a whole new direction.

These new skimmers used cannibalized pieces of cell phones that would send the stolen information out via SMS services (text messaging) to the crook. Not only can the crook receive the information in real time (and thus use it in real time) but they can be theoretically just about anywhere in the world reducing the risk of being caught to almost 0% as long as the bad guy is using a prepaid (with cash) cell phone that is easily acquirable and anonymous. The scariest thing about these particular skimmers is that they were hooked into the power system that keeps the pump on so no batteries are required and the skimmer’s life could last until the pump is opened up the next time.

So far at least these types of skimmers have been only spotted at three gas stations in New York state but that will almost certainly change. This is a scary proposition as the only risk the thief runs is when the skimmer itself is placed inside of the pump.

Security experts are warning customers to avoid using gas stations that do not have security cameras or place an emphasis on security. Thieves target stations near busy highway intersections and use master keys to access older pumps so it may be best not only to avoid gas stations in such locations but also to look to see if a pump is newer. Remember that the liability shift for gas stations to upgrade their pumps to more modern EMV-capable equipment was pushed back last year to 2020 so this will remain an issue for the foreseeable future.

Update in February, 2019 – After analyzing the device in question it was determined that the device was actually a GPS tracker and was not capable of sending information via SMS. It appears that these were simply GPS trackers left behind by someone who discovered them and were attached to the pump to dispose of them.