Chip Technology

Chip Technology Protects

• Encrypted live communication between credit card company and card at retail location
• Random code exchanged to verify this is a legitimate card
• Even if card number is stolen, no ability to generate the new random code.
• Card is still vulnerable if used online or swiped at a reader which doesn’t have chip technology

Deter Before Chip Technology is Installed

Ways to Deter and Detect before Chip Technology is Installed

• Find out if your card readers can be encrypted
• Change the locks on dispensers
  • Unique keys
  • Heavier latches
• Control who has access to dispenser keys
• Talk to your service company Internal alarms if cabinet is opened
  • Power down if cable to card reader is interrupted
  • Shields installed to prevent access to boards
• Use tamper-evident security tape and place it effectively.

If you use security tape, customize it so that it is not easy for criminals to replace it with their own identical tape after they have installed a skimmer.

Security tape alone cannot actually stop criminals, but it will let them know you are looking for skimmers – and it will alert you if a dispenser has been opened.

Security Tape should be:

• Personalized
• Serialized
• Void if tampered with
• Placed strategically.
  • Over opening to access boards (not on hinge side!)
  • Over outside of scanner.
  • Over key holes.
• Checked daily (or even every shift) Don’t have it be the same person every time.
  • Keep a log.
  • Consequences if checks are not done.
• Checked after contractors.

Security Cameras

Install security cameras to capture activity on all dispensers.

Criminals may target remote dispensers because they are less visible to the cashier, but they may also risk installing skimmers on the heavily-used dispensers close to the building because they get a bigger payoff in less time. Often they work in pairs or groups. Some distract the cashier while their partners install the skimmers. Review security film regularly, especially after unusual encounters which took employees’ attention away from the pumps.

Consider using internal cameras Motion activated when dispensers are opened.

Notes and Other Vulnerable Devices

Document any discussion relating to credit cards.

• Has anyone contacted the station about suspicious activity related to their credit or debit card? If so, get the caller’s complete contact information (name, address, phone number, type of credit card) and the details of the allegations.
• Does the station have video? If anything is suspicious, the station should make a copy of any video it has concerning the matter and give the video to law enforcement.
• Have employees noticed any suspicious people or activity?

ATM: Gas pumps are not the only devices at risk of credit card skimmers. Thieves can install external skimmers in seconds on the credit card readers of your ATM machine or even on the credit card reader at the counter.

Car wash: Credit card readers on car washes are vulnerable to both internal and external skimmers because the cabinets are easily opened. Use tamper tape to cover the card reader to detect an external skimmer. Also use tamper tape on the cabinet so you can see at a glance if it has been opened

Know how to recognize skimmers

Train your employees to know what the insides of your dispensers are supposed to look like.

Check for skimmers on every dispenser every day. It takes an average of 10 seconds for a criminal to break into a dispenser and install a skimmer. Just because you found no skimmers yesterday doesn’t mean they weren’t installed overnight. Make checking for skimmers a regular daily duty. Design your internal inspection program in a way that triggers an alert to upper management if the daily inspection does not get done.

Skimmers don’t all look alike. Some can look like home-made and are easily identifiable. Others can be extremely sophisticated and made to look like real components of the dispenser.

Suspect anything that is unusual or does not match the other dispensers. When in doubt, shut down the dispenser and consult your service company or contact the Kansas Department of Agriculture Division of Weights & Measures.

External Skimmers

External Skimmers are quickly installed and removed without detection. They fit over the outside of the card reader and steal the credit card information as the card is being slid into the slot. They may look slightly different than the other card readers (color, texture, etc.). Often they will feel loose when you try to wiggle them and may even come off in your hand.

Internal Skimmers

Internal skimmers copy the information at one of three points.

• The card reader board.
• In the cable.
• At the device main board.

Installation of internal skimmers require access to the inner cabinet and may take as little as 10 seconds to install.

Look for:

• Broken or missing or voided tamper tape
• Evidence of forced entry into dispenser.
  • Cabinets that look like they’ve been pried open.
  • Broken locks or locks with tool marks and scratches.
• Loose or missing screws that show the board has been replaced.
• Check the connection from the board on the card reader all the way to the board that controls the operation of the pump.
  • Ribbon (or wires) should be unbroken form one connection to the other.
  • No objects along ribbon.
  • Only one ribbon coming from board.

In addition, criminals may try to capture PIN numbers at the same time they capture card information. Look for cameras aimed at the keypad, false keypads placed over the real keypad or connections from the keypad to an internal skimming device.