Credit Card Skimmers & SparkFun

Who really gets ripped off by gas pump scammers…

SparkFun just featured a great article about the technical workings of credit card skimmers. It featured an open source app so you can scan your local gas station and detect them but it also had a glaring error.

In case you don’t know, a credit card skimmer is a device a crook attaches to a gas pump or ATM and is able to steal your bank info right off the card! The crook later comes back, grabs the numbers and info and then buys a bunch of stuff which shows up on your bill.

While SparkFun’s technical analysis was spot on there was something that caught my eye as being inaccurate, and that was who really get’s harmed by this crime.

From the SparkFun article…

These skimmers are most scary because there is no one being held responsible or tasked with prevention. If your credit card number is stolen you simply contact the provider and they will (usually) refund any fraudulent charges and send you a new card. In turn, the credit card companies simply do a charge back to the gas station (taking the money from the station and refunding it to the customer whose card has been stolen). The lost revenue is not large enough for the gas station owners to care, but it’s really annoying as the credit card owner to deal with the hassle. Gas stations rarely have alarms or indicators on the pumps so it’s unclear if they ever know the pumps have been opened. And the fuel pump manufacturers have no incentive to install digital or audible alarms on the pumps (that costs money).

Many people (crook and customer alike) assume that if a credit card is stolen and used, that the big bag credit card company foots the bill. This is not true.

While it is true that if the crook were to use the card info at the actual gas station where it was stolen from, that the credit card company would do a chargeback and take the money from them, this is only true if the crook uses the card there.

What often happens (I’d imagine most of the time), is the crook comes back to the gas station, reads the data off the card skimmer, then goes and resells those numbers on the black market or uses them to buy goods from other merchants.

The credit card company does the charge back to the merchant who sold the goods — not the gas station where the numbers were stolen.

This is a key distinction, because the real people who are the victims of these crimes are not the gas station, the credit card company, or even the card owner — the real victims are the merchants, often small businesses, who end up getting these chargebacks.

I learned all of this the hard way, as back in 2005 I had a small online business selling ultimate frisbee gear that was actually shut down by chargebacks. These aren’t just trivial things that business owners can brush off.

SparkFun, if you are reading this, please update your article AND I’d love if you’d release an IOS version of the Skimmer App.