Fleets, Suppliers Work to Curb Fuel Card Skimming
[Stay on top of transportation news: Get TTNews in your inbox.]
Legitimate fuel charges are difficult enough for carriers to fit into their operating budgets, let alone battling the fraudulent payments. Cybercriminals cause this difficulty by scamming fleet drivers, using phishing schemes to steal payment card PIN codes and identities. Yet, there’s been one scam proving to be the most challenging and expensive: fuel card skimming.
In this scheme, scammers install devices at truck stop fuel pumps that appear as legitimate card readers. The fraudulent device captures the information on the truck driver’s payment card. Once captured, the thieves use it to make their own purchases until a fleet manager is notified and deactivates the card.
Hemant Banavar, vice president of financial products at San Francisco-based Motive, noted the problem is exacerbated by the lack of innovation in chip technology.
“Some of the cards that exist in the market today don’t have a mechanism to prevent them from skimming,” he said. “There are still the magnet strip cards and they don’t have any of the advanced security like the chip.”
Scammers can take advantage of environments in which drivers rely on the card's magnet strip because the chip reader failed or is not enabled. (Daniel Acker/Bloomberg News)
However, scammers can take advantage of environments in which drivers rely on the magnet strip because the chip reader failed or is not enabled. Banavar said that implementing a series of multifactor authentication measures, and soon the use of AI and machine learning, helps to quickly detect when an anomaly might indicate fraud.
Driver Frustration
For fleets, fraudulent charges from card skimming can compound significantly due to where the crime is taking place: the gas pump, a repeated point of purchase. For the driver, once fraud is detected, most likely the card will be locked, forcing the driver’s dispatcher to issue alternative payment methods, such as an electronic funds source, to stay on the road.
Milo Dubak, CEO of Chicago-based Pure Freight Lines, found out in a costly way what happens when the scammers succeed. At its worst, fuel card skimming was happening weekly, costing the fleet up to $10,000 per month in fraudulent charges.
“At that point, we’re having to cancel the fuel cards, figuring out where the driver has gone from point-to-point or if the driver was involved,” he described. “That is always an uncomfortable conversation, but you’ve got to go through the motions.”
Barkoff
Spencer Barkoff, president of Relay Payments, explained that to fight fuel card skimming, the solution should focus on eliminating the physical card from the equation. For example, drivers go through a set of prompts and security questions, after which they can simply type a code directly into the pump and purchase their fuel at a pre-negotiated discount. The driver, using an integration into an electronic logging device, accesses a system that monitors the purchase process.
This method leaves potential scammers little to work with — while getting the trucking industry a little closer to a modern reality, Barkoff added.
Relay developed a partnership with Pilot Flying J to spearhead the system, including pre-negotiated discounts that drivers could access.
“We’ve helped trucking companies from 10 trucks all the way up to 600 trucks completely eliminate their reliance on fuel cards and fleet checks,” he said.
For drivers still using fuel cards, the challenge of spotting a skimming device is daunting. Scammers will often place the skimming devices on top of the actual card reader with the driver none the wiser. However, with closer inspection, one might notice discrepancies such as the device sitting slightly off-center from the rest of the pump.
Most pumps have a band of security tape covering the cabinet panel, but even that isn’t a guarantee. (TydenBrooks Security Products via Amazon.com)
Most pumps also have a band of security tape covering the cabinet panel, but even that isn’t a guarantee. Scammers can get their own tape online and replace the tape they broke once they’re finished installing the skimmer device. If the tape has the logo of the fuel company that operates the station, it is much more likely to be the original. If it doesn’t, buyer beware.
Finding Solutions
In 2021, card skimming became a daily nightmare for Evans Delivery, a container drayage carrier based in Schuylkill Haven, Pa. Evans utilizes about 7,500 independent contractors to do the hauling and issues drivers’ fuel cards. As card skimming became a widespread problem, Meghan McBride, the fleet’s manager of business operations, found herself with an unwanted full-time task: dealing with $30,000-$60,000 of fraudulent charges per month.
“Our fraud was at absurd levels,” McBride said. “It was just through the roof; nonstop we were replacing cards. It was almost everything I was doing all day long.”
Evans Delivery ranks No. 23 on the Transport Topics Top 100 list of the largest for-hire carriers in North America.
Evans Delivery was already working with Portland, Maine-based WEX to manage its Electronic Fund Source payment card program. And according to fleet Chief Financial Officer Brian Frey, WEX continually covered the fraud charges — sparing Evans the financial hit but still leaving the company with the administrative nightmare.
Stroup
But in summer 2023, the firm offered a solution that, according to McBride, has eliminated all fraudulent purchases using Evans Delivery fuel cards.
According to Karen Stroup, chief digital officer for WEX, the problem of card skimming should be met with a process that allows fleet managers flexibility to control spending and to assist drivers while securing fuel purchases across several TMS platforms. She added that managers should be able to always know their truck’s location. “If it doesn’t match up, we won’t approve it,” Stroup explained.
WEX’s system also identified what Stroup called geographic hot spots, where fraud was widespread — right down to the specific stations and even the specific pumps. That enabled a team to be sent out to check those pumps for fraudulent devices.
One solution to fraud is to eliminate the physical fuel card and use codes instead. (Relay Payments)
When Evans first implemented the system, the only way a driver could get a passcode was to call a number on the back of the card. As the product matured, they could log into an app using a default passcode, which might be their payment card number.
“Unfortunately, things happened,” McBride said. “Guys wouldn’t enter their entire card number. They’d only enter their last four digits. They would get locked out and we’d have to get EFS on the phone.”
There was also a learning curve with fuel stations. If a cashier had to get involved with a purchase, McBride said she sometimes spent time on the phone with the cashier, pointing them to the exact spot on their computer screen where they would find information to process.
McBride
With a large group of drivers, Evans had to train them in phases. It took until the entire implementation was complete for the fuel card skimming issue to go away. “But I will say, since then, not a bit of fraud,” McBride said.
The idea of illegally installing a device on a truck stop’s fuel pump might seem awfully daring; however, it is an extremely quick criminal act with rapid return on investment.
In some estimates, once a skimmer is added to a pump, it can start collecting card data from users within 17 seconds.
With a fraud scheme that combines physical tampering with digital tools, it’s no surprise that fintech firms are pulling out all the stops to fight back, such as deploying geofencing for card deactivation.
In addition, Banavar noted that Motive applies AI and machine learning to identify suspected skimming by detecting anomalies in tank levels. “Fuel tank levels are very noisy,” he explained. “Fuel is just a liquid going around in a tank, and we can get a good reading on tank levels and say, ‘This transaction should have been 100 gallons, but he did a 120-gallon transaction.’ ”
Motive’s system also detects when a card assigned to a driver — or what appears to be that card — is processing a lot of transactions far away from the vehicle’s location.
Want more news? Listen to today's daily briefing above or go here for more info
“If the location happens to be 100 miles away from where the transaction is happening — and we can even detect if it’s 1 mile away — we know something is not right,” Banavar said. “We can see that the transaction comes from a Love’s in Oklahoma City, and we know the driver is somewhere in Texas.”
Barkoff stressed that fuel card skimming frauds are keeping fleets mired in extra costs that ultimately take their toll on business.
“In the trucking industry, what happens is that you have a $10,000 fraud claim, and the trucking company has to pay their bill and then go to their billing card company and submit a request,” he said. “It can take several days for the merchant and the billing card to work out if they’re going to cover the fraud. In the meantime, the company is out the cash flow. We’ve seen companies go out of business over this.”
