Gas Station Skimmers Can Send Stolen Data Via SMS

Police have discovered a new credit card skimmer that connects to the inside of a gas station pump and is able to send stolen data via SMS.

According to Tech Crunch, thieves tear apart cheap phones and send credit card information to their location instantly without having to access the skimmer physically or rely on an open Bluetooth connection.

Brian Krebs of Krebson Security received images of the skimmer — found at a gas station in the Northeast — from an unnamed source. The skimmer connected to the internals of the pump and received power from the pump itself, so there is no worry about battery failure.

“The beauty of the GSM-based skimmer is that it can transmit stolen card data wirelessly via text message, meaning thieves can receive real-time transmissions of the card data anywhere in the world — never needing to return to the scene of the crime. That data can then be turned into counterfeit physical copies of the cards,” Krebs wrote.

While it’s unclear how this model worked, the skimmer included a GSM-based device with a SIM card produced by cellular operator T-Mobile. It most likely intercepts the credit card data as it’s being swiped.

Krebs explained that skimmers at the pump are most often the work of organized crime rings that traffic in stolen credit and debit cards and the wholesale theft and commercial resale of fuel.

Fortunately, many gas stations are trying to fight back. “Many filling stations are upgrading their pumps to include more physical security — such as custom locks and security cameras. In addition, newer pumps can accommodate more secure chip-based payment cards that are already in use by all other G20 nations,” Krebs wrote.

One way consumers can protect themselves: Don’t use debit cards at gas stations — ever. In addition, be sure to protect your PIN from prying eyes or cameras.