Nearly 80 percent of credit card skimmers were found at this 1 gas station chain
By the time Dan Drake discovered the fraudulent purchases on his credit card en route to visiting his son in California recently, criminals had already plundered $1,500.
Drake, a former U.S. prosecutor who spent years going after credit-card scammers in court, had been scammed himself.
The Phoenix resident reviewed his charges and concluded his financial information was probably captured by a skimming device at a Circle K fuel pump as he filled up his truck right before the trip.
If he's right, he's by no means alone.
Circle K is now the most popular gas station chain in the state for fraudsters to install card skimmers at fuel pumps, an Arizona Republic analysis of data from the Arizona Division of Weights and Measures shows.
So far in 2018, 77 percent of skimmers found at Arizona gas stations were at Circle K locations, even though the brand makes up only about 30 percent of gas stations around the state, according to data obtained under Arizona public records law.
Other brands such as Shell and Chevron have experienced drops in the number of skimmers found at their sites in the past five years, the records show.
But Circle K's total has risen from one skimmer found in mid-2013 to 85 so far this year.
The company's numbers helped drive an all-time high of 110 skimmers discovered at Arizona fuel pumps this year as of the end of October.
'Do a better job'
Drake criticized the company for not taking tougher measures to block skimmers.
"A crook is looking for an easy mark," Drake said. "If there are three houses on the street, and one of them has a sign in the front saying, 'We have a burglar alarm system,' that house is going to get skipped."
"(Circle K) either has their personal interest involved or the customer's interest," he said. Investing in security "is just a company being a good citizen."
The Attorney General's Office said it will crack down if retailers like Circle K don't do a better job of protecting customers.
"I hope Circle K does something about this problem, because if they don't — I will," Attorney General Mark Brnovich said in a statement. "Companies have an ethical responsibility to inform consumers when breaches occur."
What is a skimming device?
Criminals can install a skimming device inside the electronic guts of a fuel pump in less than eight seconds, officials said. Hidden behind panels, the small strip of wires is invisible to the public.
A skimming device records customers' debit and credit card numbers, which fraudsters can print on new cards to rack up fraudulent charges.
The scam costs Arizona consumers, banks and credit-card companies at least $9 million a year, but probably more, based on rough state estimates.
In the worst cases, a criminal can wipe out a person's entire bank account using a stolen debit card number.
What's Circle K doing to stop this?
Circle K officials said the company is working to combat the problem.
Employees inspect all fuel dispensers for skimming devices daily and report any sign of a compromised pump to police and the state Weights and Measures Division, Circle K North America Communications Director Lisa Koenig said in an email.
At least half of all devices reported at Circle K locations in the past five years were caught by employees, data showed.
The rest were found by repair companies and by Arizona Weights and Measures inspectors during regular checks of fuel equipment or when customers filed complaints.
The Attorney General's Office said Circle K should do more.
"Circle K is not very cooperative when it comes to working with law enforcement on this problem, and it seems as if they are refusing to take basic measures to better protect consumers," said Don Carroll, a criminal investigator for the Attorney General's Office. "Other big chains, like QuikTrip, are taking action by adding preventative measures at their pumps."
QuikTrip innovates solution
QuikTrip innovated a 24-hour monitored system called "Pump Shield" that immediately shuts off a dispenser and alerts employees if it is tampered with.
The company has stopped scammers before they got out of the parking lot, QuikTrip spokesman Mike Thornbrugh said.
"There's nothing out there that's foolproof, but we know that it's working," he said.
Only one skimmer device has been reported at an Arizona QuikTrip since mid-2013, according to state data.
Maintaining customer trust is paramount, Thornbrugh said.
"Even before we came up with the Pump Shield, we've been really proactive," he said. "Ten years ago, we came up with simple things like changing locks (on dispenser doors), putting security tape on and checking fuel pumps during the daily routine. (With Pump Shield) we wanted to take it to the next step."
What are other companies doing?
No other company has gone to such lengths to improve security, interviews indicate.
- Chevron recommends retailers place seals on pump access doors and inspect dispensers if there is a concern about skimmers, but doesn't require either measure, a spokesperson said.
- ExxonMobil touted its Speedpass+ app, which allows drivers to pay for gas through a mobile phone instead of swiping a card.
- Shell would not go into specifics.
- Valero did not return requests for comment.
Customers weigh in
Circle K urges customers to help fight skimmers by reporting concerns.
"If customers see something that looks suspicious, they should not use the fuel dispenser and inform a store employee right away," Koenig said.
But Circle K employees aren't always receptive.
Scottsdale resident Maile Ferro said a Circle K store attendant hung up on her, and a manager promised to call her back but didn't when she tried to report her family's prepaid debit card was compromised in May.
"(The attendant) was really snotty with me and said, 'What do you expect me to do about it? ... I've got a line of people. I don't have time for this,' " Ferro said. "I was livid."
Ferro, who used to work in Bank of America's fraud department, said she won't use that Circle K location again.
"We're never going back there because if it happened once before, and (the manager) didn't call me back, who's to say it won't happen again?" she said.
Ferro got her money back after reporting the fraud to her bank.
But she worries about people who aren't so lucky.
"Someone like myself who lives paycheck to paycheck, it could have been something worse, and I thank God that it wasn't," Ferro said.
Drake, the Phoenix resident, also got money back from his credit-card company and doesn't plan to visit Circle K again.
"Customers' only salvation really is not to do things that take them into harm's way," Drake said.
Police suggest other solutions
One way gas retailers could protect customers better is by installing EMV chip-card readers at fuel pumps, according to law-enforcement officials and credit-card companies.
Card fraud has plummeted at U.S. retail stores that have installed the technology, as well as gas stations in Canada and Europe, where fuel pumps have been upgraded to accept chip cards, experts said.
But few American gas stations offer chip readers at the pump. Gas stations in the U.S. are not required by law to install EMV.
Replacing or retrofitting a dispenser can cost thousands of dollars, making the upgrade difficult for some independent store owners to afford. Shortages of parts and installers also have delayed the process.
Circle K's 650 Arizona stations do not have EMV readers but are "actively preparing" for when they can be installed, Koenig said.
If gas stations don't install chip-card readers by 2020, they'll have to pay credit-card companies for fraud costs attributed to their pumps.
The financial incentive could cause more gas stations to convert, officials said.
Arizona inspectors keep watch
Arizona officials are ramping up efforts to protect the public.
When a skimmer is reported, state inspectors check nearby gas stations as a precaution, said Michelle Wilson, associate director of the Weights and Measures Division.
Gas stations, banks and police departments can attend training on how to spot skimmers and sign up for email alerts when skimmers are found by calling 602-542-4373 or emailing firstname.lastname@example.org.
"It's definitely a team effort in addressing this crime," Wilson said. "It's all hands on deck. The retailers and financial institutions and law enforcement and us (Weights and Measures) all work together."
To better inform the public about the risks, the Attorney General's Office began mapping locations where skimmers are found.
Skimmers found at Arizona gas stations since Aug. 30, 2018:
How to protect yourself from fuel pump-card skimmers
Pay cash inside, if possible. If you pay at the pump, always use a credit card. Even better, use a low-limit credit card reserved for fuel purchases.
If you must use a debit card, run it as credit to prevent having to enter your PIN. Some skimmers have the ability to capture PIN numbers, which could allow a criminal to withdraw funds from your bank account.
Look for dispensers with chip-card readers, which are safer.
Wiggle the card reader slot before inserting your card. If any part of the card reader comes loose, move to a different pump. You can do this at ATMs too.
Be suspicious of loose or damaged equipment, a slightly open gas pump door or pry marks, which can be signs of forced entry.
Some gas stations place security tags or stickers on pump doors to show they are secure. If the tag is broken, or it looks different from tags at other pumps, move on. Criminals sometimes use counterfeit stickers to cover their intrusion.
Use dispensers that are in well-lit areas in view of store employees. Avoid pumps close to the street or far from employees.
Watch out for large vehicles that park in front of fuel dispensers for long periods. Criminals have been known to use large vehicles to block the view of the dispenser from site employees while they install a skimming device.
Ask site employees about security measures they use to protect against skimmers. Does the station check for skimmers daily? Are there alarm systems? Do they use security cameras?
Keep an eye on your bank and credit card statements to ensure all transactions are correct. If you see unfamiliar charges, contact the bank and call your police department's non-emergency number.
Check the Arizona Attorney General's website for a map of locations where card skimmers have been found.
Trust your instincts. If something does not seem right, pay inside, use a different dispenser or go to a different gas station.
Report your concerns to employees and your police department's non-emergency number. File a report online with Weights and Measures or call 602-542-4373.
Are you the victim of a financial scam? I'm #HereToHelpAZ. Contact consumer investigations reporter Rebekah L. Sanders at email@example.com, text HereToHelpAZ to 51555 or fill out our online form.