WEX’s Fraud Spike Puts the Spotlight on EMV-Induced Skimmer Placements on Fuel Pumps

Fraudsters are hitting fuel pumps hard as they hunt for the dwindling number of places where they can take advantage of magnetic-stripe payments while EMV chip card acceptance takes hold in U.S. stores and restaurants. Last week, fleet-fueling payment card specialist WEX Inc. revealed that it increased its second-quarter provision for credit losses by 150%, to $16.1 million from $6.44 million a year earlier, in large part because of higher fraud at fuel pumps.

Most of the fraud is coming from so-called skimmers placed over the pumps’ card readers. The devices capture track data on mag-stripe credit and debit cards and enable fraudsters to create counterfeits.

“Increased levels of skimming fraud contributed to an incremental $8 [million]-$10 million of credit losses this quarter, a situation that will likely continue for the next several quarters,” Thomas McCrohan, an analyst at Mizuho Securities USA LLC in New York City, wrote in a report about WEX’s otherwise strong second quarter. The report is titled, “Unintended Casualty of EMV.”

The payment card networks had their U.S. EMV liability shifts for physical retailers nearly two years ago, in October 2015, after which merchants began to bear financial liability for counterfeit fraud if their point-of-sale terminals could not read a chip card. Citing the difficultly and expense of upgrading so-called automated fuel dispensers for chip cards, Visa Inc. and Mastercard Inc. originally gave gas stations two extra years, until October 2017, to convert. But late last year, with conversions far behind expectations, the networks extended their liability shifts to October 2020.

The postponements further delayed EMV upgrades at many of the nation’s estimated 150,000 retail fueling sites, some of which have 10 or more pumps. South Portland, Maine-based WEX is in a particularly exposed position for fuel-pump skimming because its fleet cards are accepted at 95% of gas stations, according to McCrohan. Plus, the cards typically have usage controls that prevent them from being used anywhere but at the pumps and the adjacent convenience store.

“As a result, once fraudsters produce a counterfeit WEX card, they are using the card to purchase large volumes of gasoline, which they later sell to others,” the Mizuho Securities report says.

WEX president and chief executive Melissa D. Smith said on a Thursday conference call with analysts that “we’ve seen much more [fraud] activity over the last two quarters than we have historically,” according to a Thomson Reuters StreetEvents transcript. Much of the fraud is coming from Texas and Florida, she said.

Still, McCrohan wrote that “fraud issues appear fixable,” and Smith and chief financial officer Roberto R. Simon said on the call that WEX is taking several steps to control them. While fraud will remain elevated in the near future, WEX expects it to come down gradually by year’s end.

“We have taken a number of actions to combat fraud at the pump, beginning first with engaging our customers and merchants,” said Simon. “We are investing in [a] best-in-class software solution and are continuing to tighten daily transaction limits and purchase limits, blocking sites when necessary, and working very close with law-enforcement agencies to assist in building cases to prosecute criminal activities.”

Much attention has gone to online payment fraud as EMV cards make point-of-sale counterfeiting hard to commit, but skimming also is a serious problem, according to fraud analyst Julie Conroy, research director at Boston-based Aite Group LLC. “The fraudsters are quite good at going after the weakest link, and the fuel pumps at the moment are the weakest link,” she tells Digital Transactions News.

Gas-pump fraud often happens in ports where fraudsters buy large amounts of fuel with counterfeit cards and then sell it at cut-rate prices to dishonest ship operators, according to Conroy. Based on some recent conversations she’s had with oil-company executives, Conroy says a gas station in Kansas might have as little as $500 or less in counterfeit fraud per year, while another in a port city was hit with $340,000.

Despite their exposure to skimming, when to invest in EMV card readers for fuel pumps remains the decision of jobbers and convenience-store owners based on their widely varying individual experiences, Conroy says. But she predicts that fuel-pump skimming will move inland as hard-hit gas stations in coastal cities upgrade.

“Once again the fraud will move to the weakest link—the rural areas will be the weakest link,” Conroy says.

Some estimates have placed the total U.S. fuel-pump upgrade cost at $6 billion. Conroy says one of the executives she talked to said a chain-wide conversion at his firm would cost $300 million.

While EMV chips make counterfeiting very difficult, there are non-EMV fraud-control services for fuel pumps out there. For example, one operator saw about a one-third reduction in its fraud rate on Visa cards after implementing Visa’s Visa Transaction Advisor, an analytics service to flag suspect gas purchases. “The downside is that’s only working on Visa,” says Conroy.