Home page logo

dataloss logo Data Loss mailing list archives

Identity Theft at the Pump Spikes From Credit Card Info-Stealing "Skimmers"
From: Jake Kouns <jkouns () opensecurityfoundation org>
Date: Mon, 10 Dec 2012 02:23:41 -0500


Skimmers are "all over the place," according to a detective who said
two suspects were arrested

"Skimmers" that steal credit and debit card information have been
discovered across San Bernardino County, and hundreds of people have
been victims of identity theft, authorities said Friday.

A boyfriend-girlfriend team that's thought to be part of a larger
organization was arrested on suspicion of involvement in the crimes
this week, but multiple police agencies are looking for more suspects,
sheriff's department Detective Bill Stringer said.

The hidden skimmer devices can be installed in less than two minutes
at gas station pumps, drive-thru and even outdoor card-activated
security doors at banks, Stringer said.

"They're all over the place. A lot of these restaurants have these
devices outside the drive-thru. You don't want to use those either,"
Stringer said. "The gas station thing is off the chart right now."

Sheriff's department and local police investigators believe they are
seeing a spike in skimmers installed at gas stations because fuel
companies are starting to catch on and install new pumps that
apparently cannot be hacked, Stringer said. That's prompted criminals
to try to install as many skimmers as possible before their
opportunities for identity theft are reduced.

"They're kind of on a mad dash to get these in there," Stringer said.

Hundreds of victims have reported identity theft across the county, he
said, but could not provide an exact figure.

The San Bernardino County Sheriff's Department on Thursday announced
that it was seeking information about skimmer-based thefts after a yet
another device was found at an unidentified gas station in Rancho
Cucamonga. Department spokesman Randy Naquin said many stations had
been affected and authorities did not want to single out particular
stations for fear they would lose business.

The department advised people to avoid using card-swiping machines
that "look or feel loose to the touch or appear to have been affixed
with glue or taped to the machine." Be on the lookout for and report
suspicious activity at gas stations too, the department said.

Stringer would not provide details or names about the recent arrests,
which he said took place in Colton. The male arrested is a suspected
gang member, and the female is his girlfriend, said Stringer, who is
assigned to the gang team at Rancho Cucamonga Station but has been
working on identity theft cases.

Criminals who install skimmers at gas stations pull up to a pump,
typically in a van, blocking the view of attendants, he said.

Using one of several generic keys that work on almost all gas pumps,
the thieves open the pump, power it down and install the skimmer
device so that it takes data from credit, debit and gas cards.

"They power it back up and away they go. Two minutes, approximately,
or less, it takes them," Stringer said. "We've done it ourselves just
to test it."

A young man getting gas at a Rancho Cucamonga fuel station on Friday
said he himself had learned how to install skimmers and had stolen
people's identities.

"It's very easy to do," said the man. "Easily I can make about $1,000 a week."

But he said the crimes were "not worth it." Asked why he told an NBC4
reporter on camera about the crimes, which he said took place years
ago, the man said he wanted others to get caught.

"I really do feel bad for all my victims," he said.

Skimming devices can hold information for up to 2,400 cards,
authorities said. Depending on the device, thieves can either drive up
and access it from within 30 feet via Bluetooth from a newer device,
pictured at right. Or they must unlock the pump again and download the
data from an older skimmer, seen below.

"If they get your credit card, they'll go to the mall and go shopping.
If they get your gas card, they'll go buy gas," Stringer said,
describing specialized trucks operated by skimming rings that can hold
up to 500 gallons of gas.

Authorities believe newer gas pumps with raised keys, pictured above
in blue, tend to be safer. Flat keypads are more likely to get
skimmers installed, Stringer said.

Authorities advise people to use cards with low credit limits and
check monthly statements for unusual activity.

"Cash is the best," Stringer said.
Dataloss Mailing List (dataloss () datalossdb org)
Archived at http://seclists.org/dataloss/
Unsubscribe at http://datalossdb.org/mailing_list


Risk Based Security (http://www.riskbasedsecurity.com/)
Risk Based Security equips organizations with security intelligence, risk
management services and on-demand security solutions to establish
customized risk-based programs to address information security and
compliance challenges. 

  By Date           By Thread  

Current thread:
  • Identity Theft at the Pump Spikes From Credit Card Info-Stealing "Skimmers" Jake Kouns (Dec 10)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]