Dorene McCormack’s sad tale is scary, and all too common.
She used a debit card to pay for fuel at a New York gas station and an illegal device secretly installed at the pump cloned her card.
“And I had no money in my account, they wiped me out,” she said. “I had to sit there and ask my parents for money, ask my friends for money, just to survive until the bank got it all together. “
Security experts warn that so-called skimmers can read the magnetic strip on the back of debit or credit cards, allowing bad guys stationed nearby to retrieve your info via text message or Bluetooth. Tiny and tough to spot, the devices are criminally simple to install at gas pumps.
“It takes about 15 seconds to be a cyber thief. That’s how scary and easy it is,” said Scott Schober, the president and CEO of Berkeley Varitronics Systems who’s written books on cybercrime. “We need to realize that now there are organized criminal gangs — a lot of them coming over from Russia and different groups that are popping up all over — and they’re deploying thousands of skimmers throughout the United States.”
Payment card fraud is a big deal for consumers, and for credit card companies. Add up all the Dorene McCormacks, and it’s billions in losses — a total of $9.4 billion in 2018 alone. Years ago, the companies ordered retailers, including fuel distributors, to install chip readers, which are more secure. It’s an upgrade that can cost $8,000 per gas pump.
“I estimate that about 75% of the gas stations in New Jersey have already complied and replaced the processing equipment in their pumps in order to handle chip technology rather than swipe technology,” said Sal Risalvato, executive director of the New Jersey Gasoline and C-Store Association. “And I expect all will be in compliance by the deadline in October.”
Visa, Mastercard and Eurocard warned gas stations that, as of October 2020, they won’t pay for any cyberbreach stemming from old magnetic strips. Instead, the station owners will bear the responsibility. Cardholders will still be covered against loss by the card companies and banks, who will recoup their losses from the merchants.
But Mike Geraghty, the director of the state’s Cybersecurity and Communications Integration Cell, or NJCCIC, says that doesn’t mean that, even with chip reader technology, customers’ information is completely safe. Many chip cards still have magnetic stripes, meaning that at least some of their information is still vulnerable to skimming.
Easily as important, experts say, is the issue of what happens to cardholder information after a sale.
“Today the bigger problem is malware hackers are using to hack into a businesses’ computer system that retrieves credit card info from customers,” Risalvato said.
Last month, Visa alerted its merchants that the cybercrime syndicate FIN8 was targeting fuel distributors and other merchants — scraping payment card databases with malware. In a separate case, Wawa, the convenience story and fuel chain, got targeted in a malware attack on payment card information that ran undetected for nine months and exposed customers’ payment card data. Furious customers have sued over the breach.
Technology is available to detect the presence of skimmers, including equipment that Schober sells.
Otherwise, experts advise, use currency whenever possible. “Cash is king,” Schober said.
If you must use plastic, avoid debit cards. Pick a credit card that offers real time alerts.
“I get notified if it gets taken out so I’m sure what gets taken out of my account,” said Matawan resident Augustinas Baksys.
Also of use are payment applications that employ a security system known as point-to-point encryption, like Apple Card or Google Wallet, the experts say.
