Gas pump credit card readers could pose security risk, experts say

The I-Team has uncovered how thieves can tamper with old gas pumps and card readers, putting your money on the line.

We all use the card readers on gas station pumps -- they're an easy and convenient way to pay. But the I-Team found that when gas stations get rid of old pumps, the card readers attached to them can pose a financial risk.

The I-Team found some old gas pumps, torn out and lined up behind a gas station in the western suburbs. They were somewhat out of sight, and credit card readers were still attached to the pumps.

"A bunch of abandoned pumps that still have the card readers intact are a potential treasure trove for a fraudster because what bad guys will want to do is remove those card readers and then find a working gas station that is using that model pump," said Professor William Kresse of Governors State University.

Kresse, a fraud prevention expert, and security experts from Chicago's Trustwave both reviewed pictures of the gas pumps and said it's a security concern.

Trustwave said it's worried about the internal hard drives and what may be stored on them.

Knowles: Someone could easily get those card readers?

Kresse: Right, in fact, the easiest ones to get at would be the ones in the back, out of sight from any attendant.

Kresse said crooks could take these card readers and turn them into skimming machines, then place the tampered readers on working gas pumps.

Knowles: It's just a matter of picking that lock.

Kresse: Pick that lock, open it up, know where to make the disconnections and lift the device out.

Knowles: So they would tear this out of the gas pump and they would put in the back a blue tooth chip.

Kresse: They would put a blue tooth transmitter inside along with another phonetic head reader known as a skimmer.

In February, the Hobart Police Department said skimming devices were used at gas pumps in northwest Indiana to steal consumer card numbers.

Skimming is not the only risk, old key pads can be used to make what are known as "overlays," essentially a fake key pad that captures your pin when you press down on the buttons.

Once a thief has all of your information, they can make a dummy credit card.

"They can buy at any number of stores or on the internet the equipment necessary to make essentially a replacement card to encode the numbers on the magnetic stripe go to the ATM put that card in and voila, they've got cash," said Kresse.

Experts said all gas pumps should have security tags and tape so customers can see if they've been tampered.

As for old pumps in the western suburbs, the gas station owner said they're sitting out because he may repurpose the equipment. He said he didn't realize the risk and that he will remove them as soon as he can.

Gas stations are the biggest target for skimming because card readers are more accessible and most gas stations don't yet have the chip protection.

In fact, gas stations don't have to be upgraded to chip technology until 2020.

You should always examine card readers before you swipe to make sure there is no added equipment or anything that looks suspicious.