News10NBC finds gas station still vulnerable after skimming incident

April 26, 2018 11:47 PM

Gas pumps are easy targets, and a News10NBC investigation found crooks, armed with the key to unlocking your personal information, are hitting pumps in big cities as well as tiny hamlets. 

News10NBC set out to investigate how crooks easily access pumps and what gas station operators are doing to protect you.
Our investigation took us to Lakeville, New York, with a population of 756.


The tiny Livingston County hamlet seems swathed in a sleepy serenity at the foot of Conesus Lake.  And not far from the lake sits an unassuming four pump gas station in front of an equally unassuming two store strip.  No one would ever believe this could be the site of a sophisticated high-tech scheme to steal your money and your identity.  But that's exactly what deputies said happened at an Exxon station located at 5953 Big Tree Road in Lakeville. 

Livingston County Sheriff's deputies found skimmers at the station in February.  Thieves used them to intercept card information when victims swiped their plastic at the pump.  Sheriff Thomas Dougherty said that 87 Livingston County residents were victimized in the scheme.  

"They'll (The thieves) come back a day, two days, sometimes hours later and transmit that (credit card data) remotely.  So they never have to go near the pump again, and they've got all your personal information," said Dougherty.

That's because the skimmers use Bluetooth technology, enabling thieves to download credit card data remotely.  Investigators said that crooks usually stay in a town only long enough to steal data, and then move on.   And what really frustrates the sheriff is that it's so easy for thieves to get inside most gas pumps.  

"The large majority of these gas pumps have one key. So if I have the universal key, I got access to every pump," said Sheriff Dougherty.

That’s key to unlocking your personal information.  And the universal keys are cheap, accessible, and available for sale on the dark web.  

"We've been taking a proactive approach with our gas station owners and saying, ‘Please change the locks,’" said Sheriff Dougherty.

News10 NBC wanted to know whether gas station operators are heeding the advice of the county sheriff.  So we obtained our own universal gas pump key and headed back to Livingston County. We went back to the very same Lakeville gas station where thieves stole all that credit card information in February and tried to use our universal key at the pump.  It slipped in the lock and appeared to fit.   We did not open the pump, but we did go inside to talk to the manager.  He declined an interview with News10NBC, but did talk to us by phone. 

We spoke with a man who called himself Sammy and wouldn’t give his last name.  He said that he manages his brother's store.  And Sammy admitted that they have not changed the locks.  He claimed that they can't because while his brother owns the store, he does not own the pumps; a third party company does.  Despite our repeated questions, Sammy would not tell us the name the company that owns the pumps.  But he says it refuses to change the locks or allow him to install security features. 

And many Monroe County gas stations are no safer.  Craig Lape is Monroe County's Director of Weights and Measures, the agency that inspects gas pumps.  Lape said that his inspectors found as many as eight skimmers in gas pumps last fall.  Asked when it’s safer to use your credit card at the pump, Lape was thoughtful.

 "If it's a newer pump, they're pretty secure," he said.

Lape said that you can generally recognize new pumps because often they have screens that play ads.  The newer pumps are loaded with security features like chip readers, unique keys, and automatic shut-off abilities.

Paul Marone, owner of East Avenue Auto, recently bought three of the high tech pumps.  He says most notable of the many security features is the pump’s ability to turn itself off if opened by an unauthorized person.

"It knows that somebody took the ribbon cable off that device, and it turns the pump off," Marone explained. And in the unlikely event thieves were able to open the pump without disabling it, he said that they still couldn't get the data.

"The data is immediately encrypted when you put your card in," said Marone.

But the pumps are expensive. Three pumps cost Marone $100,000.  Owners are able to offset some of the cost with those ads you're forced to watch while pumping your gas.

But police said that there are more old pumps than new. Consumers must be vigilant.  Make sure the key pad panel isn't loose, the card reader is secure, and look for tamper evident seals.  Most of the Livingston County stations we checked do have them.   Sheriff Dougherty said that you should put your money where your safety is.

"If your gas station is not going to put those seals on just go inside and say, ‘Hey, just so you know, I’m not going to pump gas here until you take those steps,’" he said. 

In addition to the recommendations from the Sheriff Dougherty, here's Deanna's Do List.

  • Consider using a credit card at the pump rather than a debit card that's linked to your bank account.
  • Choose a pump nearest the attendant.  Thieves are more likely to put skimmers in the pump farthest away to avoid detection.
  • Consider paying inside when paying with a credit or debit card.
  • Use your Android phone to detect a Bluetooth signal coming from the pump.  An app for Android phones called Skimmer Scanner detects a skimmer’s Bluetooth signal.  The maker of the app is working on developing a similar one for iPhones.  You can also check for skimmers by turning Bluetooth on in settings while standing in front of the pump.  If your Bluetooth is trying to connect with a signal, be wary.  The signal could be coming from the pump.  
  • If you see something, say something.  Make sure to alert the gas station operators if you see anything suspicious.


Deanna Dewberry

Copyright 2018 - WHEC-TV, LLC A Hubbard Broadcasting Company

Relay Media Amp

We no longer have Facebook comments on this site. Please visit our Facebook Page to join the conversation.