Gas-Pump / Petrol-Pump Skimmer Scam

A gas-pump or petrol-pump skimmer is a card-reading device hidden at a fuel pump's payment terminal to copy the card data of everyone who pays at the pump. Early versions were overlays stuck on the outside of the reader, but the more dangerous modern form is internal: criminals open the pump cabinet and wire a small board directly into the card reader's cabling, leaving nothing visible from outside. Fuel pumps are attractive targets because they stand unattended on open forecourts, process a steady stream of cards all day, and are inspected far less often than bank ATMs. A single compromised pump can quietly harvest card details for weeks. Some devices also capture the PIN or postcode typed on the keypad. The stolen data is used to create counterfeit cards or sold in bulk, and victims usually have no idea which of the many places they used their card was the source of the fraud.

Many pump cabinets have historically used simple universal locks, and criminals obtain the keys or force the panel quietly. In a visit that can take under a minute — sometimes staged to look like routine maintenance — they open the cabinet and connect a skimming board inline between the card reader and the pump's electronics. From outside, the pump looks untouched and payments work normally. The device stores every card swiped or inserted, and some record keypad entries too. Rather than risk returning, many crews fit Bluetooth or mobile transmitters so the harvested data can be collected from a car parked nearby or streamed remotely. The card numbers are then encoded onto counterfeit cards or sold on. Fraudulent use often starts with small test purchases to confirm a card is live, followed by larger spending or cash withdrawals, frequently far from the forecourt. Because the compromise can run for weeks and victims fuel up routinely at many stations, the link between the pump and the fraud is very hard for any individual cardholder to make.

Paying at the pump is built for speed and habit: card in, fuel, go. Nothing about a compromised pump looks or behaves differently, because the device is sealed inside the cabinet. Forecourts are self-service and often lightly staffed, so no employee handles your card or watches the terminals, and tamper-evident seals are easy to miss, ignore, or counterfeit. Drivers also use many stations, so when fraud appears on a statement there is no obvious culprit. The scale works for the criminals too — one visit to one pump yields a continuous stream of fresh card data with almost no ongoing risk.

'The card machine inside is down today — you'll have to pay at the pump.'

A man in a hi-vis vest works inside a pump cabinet with no service van, no branded uniform, and no awareness from the station staff

A car sits parked near the pumps for a long time with someone inside on a laptop, collecting skimmed data wirelessly

Choose the pump closest to the kiosk window and cameras — criminals prefer the far, unwatched ones. Look at the security seal or tape on the cabinet near the card reader: a broken, wrinkled, or void seal means do not use that pump, and tell the attendant. Give the card reader and keypad a quick wiggle and look for anything loose or stuck on. Better still, avoid the risk: pay inside at the till, or use tap or a mobile wallet at the pump, which sends a one-time token instead of your card details. Use a credit card rather than a debit card at pumps so fraud never touches your bank balance directly, and keep transaction alerts on.