InBoxRevenge KS Forum

Hopefully this is still within the purview of this site:

I've got a list of probable skimmers installed in gas pumps (IE addresses of impacted stations), the inside the pump variety not the stuck on top kind. I haven't confirmed with my own eye or credit card, but I am pretty certain a few of these will hit gold.

Does anyone have a trusted security type contact with Valero, Bradley Petro, Conoco or Shell they would be willing to share?

Thanks for any help,
Helly

Sorry, no. But at least in the U.S., most gas stations are independently owned, and they occasionally even change brands if the owners feel it is in their best interest. I don't know if the petroleum companies would be any more likely to investigate than the credit card companies or local police.

Brian Krebs (krebsonsecurity.com) has written several pieces on skimmers, and they've been some of the most popular posts on his blog. Any day he can write about skimmers is a day his blog gains in popularity. I suspect he would be receptive to information if you have something concrete to give him.

In most US jurisdictions gas pumps fall under local and state jurisdiction. At the local level that might be called something like the Bureau of Weights and Measures. At the state level oversight usually rests with whatever state environmental agency exists. All of that is in addition to local and state police forces, which would be the appropriate contacts if there is reason to believe that a crime is in progress.

Hans

I'm thinking the police would make a better contact than the gas companies themselves.....but they'd likely need "proof" or reasoning as to how you figured out the pumps were rigged.

Thanks for the advice all, I've settled on an approach of using all the methods suggested. One of them is bound to work out.

Indeed - The Beareau of weights and measurements would be a good first contact...since they are called out at various times of the year to "inspect" the pumps to make sure they are calculating the right gas usage - same place also inspects the scales used at grocery stores too :)

The pumps should have a contact address, telephone number, or web address on them.

Going directly to the police may be a bit out of the question - they may be unsure how to handle the problem, and likely push it under the carpet.....now unless you called the emergency number while sitting at the pump :) That may lead somewhere :)

All else, contact your local news outlets......Fox News, or any others...I know around here our big "Whistle blower" is "Channel 9" they like to pull up all kinds of dirt about local businesses, and publicize anything they can for some air time $$$ :)

Any reason you don't think it appropriate to ask the clerk for the owner's phone number to call him/her?

I find it unlikely that a mere "counter person" will give an individual the owner's contact information, for privacy purposes and such......if the station happens to be part of a franchise (for example, a big one around here is "Sunshine Foodmart") I suppose you could inquire their contact information.

I see two possibilities:
The owner/operators are well aware of the skimmers and may get "edgy" due to finding out this information regarding their pumps.

The owner/operators are not aware of the skimmers and will go into "guilt mode" when you inform them, due to them actually modifying the machine.....

In either case, I don't think it would yield results consulting a counter operator or the owner.....whether they are aware of the skimmers or not they will just play it off like they don't know anything.

Indeed, I haven't had much luck contacting the specific clerks. I've also held off in general because of the potential for insider involvement. Part of my suspicion as well stems from the fact that there is one vendor in particular that is very problematic. Its difficult to conclusively say if its an insider, bad luck, or poor physical controls on the pumps. I've noticed that almost all gas pumps seem to contain only one small lock preventing access to the machine. That doesn't seem particularly secure, but its difficult to tell by just a glance.

In this case I would rather work from top down, or possibly with the media or LEOs just on the off chance that local employees are involved. It actually is looking like media involvement may be the best option at this point, I will post a link if anything comes of it.

It should not be difficult to get the contact information of the station owner. People have to do it all the time. No one shows up at a corner and sets up a booth to sell flowers or Girl Scout cookies without permission from the business that owns that corner. It should be routine for the clerk to have that information available when people inquire.

I wouldn't encourage you to go to the media first. Most people are so clueless about skimmers that they could work next to them every day and be unaware. You don't want to victimize the victims.

What evidence do you have there are skimmers? Usually they're easy to peel off, so the criminals can collect their expensive equipment after they've gathered their data. They aren't internal or locked up. Can you find a hole for a camera to record the PIN? Can you get a photo of an unaltered machine of the same model and one of the ones you're suspicious about, so you can show law enforcement or Weights and Measures the photos side by side?

I would guess the average person who owns a gas station is completely in the dark about some of the technology he's operating. He knows cars, if he even knows that, and not computers. He would have to have an outside vendor to maintain his electronic pumps. If the vendor had an employee in that area who was placing skimmers, that would explain the predilection for one group of stations. You don't know who owns the stations or how the tasks of running them are distributed, so you need to be very careful about ruining an innocent person's reputation on hunches and assumptions. You could get an innocent clerk's face on the news, get her fired, and make it impossible for her to get hired anywhere else. And remember, the farther up the chain of command you go, the easier it is for a person to get financial information without having to resort to skimmers in the first place, so you have to question whether the station owner would have any motivation to do something like that.

Funny timing:

http://www.networkworld.com/news/2010/0 ... -scam.html

Via Slashdot, moments ago.

SiL

Ok, I take back my statement about skimmers not being inside the pumps.

Sounds like an inside job. Gas stations with pay-at-the-pump devices are located in areas with lots of traffic going by, and they often have clerks inside the stations 24/7. And bluetooth is short range, unlike the cell phone devices that Brian Krebs has described, so the receiving devices would have to be close by. Why choose bluetooth? If you weren't watching the pumps pretty closely all the time anyway, why take the risk of your device being discovered and altered to give you away next time you tried to connect to it?

Someone who is suspicious could detect one by standing next to the pump with a bluetooth device to see if it picks up the signal, I suppose.

Thanks everyone for the help and advice on this issue. Happy to report its being satisfactorily resolved in the best way possible for everyone. Law enforcement is actively involved and putting a stuff to the issue. No media necessary

Are you implying that the networkworld article is related to the particular case you've been documenting and attempting to "contact" related to this thread?

If that's the case, good job!

That's scary....this hits really close to home, I'm about 2-3 hours from Gainesville.

Now back to the article:
I know in America it's "innocent until proven guilty" - but just say for example, the station owners have put up these Bluetooth skimmers......I doubt they're gonna report themselves :)

My reasoning/thinking it's the station owners....is we are talking about bluetooth here......last I heard Bluetooth was for short distances only....i.e.: maybe 50 sq ft, if that.....depending on weather and single strength. For example, I know in high school, kids would often "trade" ringtones over Bluetooth with other kids in the classroom....but it couldn't go much further than that (outside, or through the wall to the next classroom (someone tried it....lol).

Sadly nope, the networkworld article was just very strange timing. The particular incident I was working on was geographically distant, and quietly addressed by law enforcement. With the spread of these things though, I will definitely be paying cash at the gas pump regardless of where I live...