Protect Yourself Against Card Skimmers

Paying at the gas pump is convenient, especially for those in a hurry. But that convenience comes with a risk. Credit card skimmer fraud is on the rise at gas stations, with the skimmers becoming more difficult to detect and fraudsters using advanced technology to steal your information.

What Is Card Skimming?

Credit card skimming involves thieves attaching devices on gas pumps, ATMs and other machines that read and gather your card information.

Skimmers read the magnetic strip on the card, which gives fraudsters the full name on the card, the credit card number and the expiration date. Some thieves even hide small cameras to capture PIN numbers from those using debit cards. They can then either sell your information on the dark web or use it to steal your identity, charge up your credit card or even get access to the money in your account.

In the past, skimmers could be spotted if you knew to check. The scanner often looked like it was tampered with or it wiggled when you put the card in. Now skimmers are designed to fit snugly over the scanner, making it nearly impossible to tell something is not right.

Shimming the Chip Card

Skimming isn't the only scam at the gas pump. Fraudsters can now target the computer chip embedded in most credit cards. Overall, the computer chip makes cards more secure and are supposed to prevent nefarious activity like skimming. But fraudsters and hackers are very good at staying one step ahead of security measures. Instead of skimming, some now turn to shimming.

With this method, a paper-thin device called a shim is inserted directly into the card reader slot (the one that holds your chip-enabled credit card). The shim is loaded with a microchip and flash storage that intercepts the information from the chip on your credit card. The stolen information can then be used to clone the old magnetic strip style of credit card (which are still in use, especially for online purchases).

Shimming is even more difficult to detect than skimming because inserting and removing the shim looks the same as someone inserting and removing a credit card. What makes them even more stealth is that fraudsters can just as easily use a shim inside the gas station's cash register when making another purchase as they can at the gas pump. It's an attack that's hard to catch.

Shimming is still a new practice. So far, it can't clone the CVV number on the card, so a cloned card is less likely to be used for any purchases that require that number. However, it's a good bet the fraudsters will figure out some way to better game the system.

How to Avoid Card Skimming

Even as fraudsters become more sophisticated in their tactics, you can take steps to avoid becoming a victim of card skimming.

• Pay with cash. You might even save some money if the gas station provides discounts for those using cash instead of a card.
• Pay inside where it is less likely the credit card terminal has been tampered with.
• Use mobile payment options like Google Pay or Apple Pay if they're an option.
• Use the chip reader rather than swipe. Shimming is possible this way, but less likely.
• Use credit, not debit, whenever possible. If a thief is able to steal your debit card information, they have access to your bank account.
• Investigate the card reader to make sure nothing looks or feels unusual. If something doesn't seem right, pay inside and report your concerns.
• If possible, only stop at busy, well-lit and well-maintained gas stations. Look for stickers or other signs that the pumps are regularly inspected.
• Download the Skimmer Scanner app, which can warn you about a skimmer. Using Bluetooth, the app can alert you if the pump has been tampered with.

What to Do if Your Card Has Been Skimmed

You should check your credit card bill regularly for any fraudulent charges. If you find anything unknown or unusual, contact your credit card issuer immediately to alert them of the theft and to cancel your card. If you use a debit card, contact the credit union right away and ask what steps you should take to safeguard your account.

To safeguard your debit card, WKFCU offers the fraud-fighting app, Shazam Brella. You can set alerts to let you know each time your card is used, temporarily block and unblock your card, and make travel notices. You can download it for free.

If your card has been compromised, you may want to consider putting a freeze on your credit report to ensure no new accounts are opened in your name. Finally, continue to monitor all of your accounts.

Partially reprinted from experian.com.