Arco gas stations in California have become favorite targets of thieves who use skimmers to steal debit card information and empty consumers' checking accounts.
In dozens of thefts since December, the devices have been used to download debit card numbers, which thieves have encoded on blank cards with magnetic stripes, writing the corresponding personal identification numbers on the backs of the new cards.
Over the Memorial Day weekend alone thieves withdrew about $325,000 from about 200 people's checking accounts after stealing debit card data at an Arco station in San Jose, according to Enrique Garcia, a spokesman for the San Jose Police Department.
Other gas stations and convenience stores in California have been hit to a lesser degree. But thieves are targeting Arco stations in particular because most of them have just one or two payment terminals for all their pumps, so it is easier to steal more information in a shorter amount of time, Detective Eugene Kim of the Costa Mesa Police Department told bank security officials at a California Bankers Association conference last month.
Moreover, the thieves appear to be targeting Arco because its stations accept only cash and debit cards, not credit cards, Detective Kim said. Thieves would have no way to access checking accounts using customers' credit card data, he said.
Bankers say the increased threat of debit card theft at gas stations is alarming, particularly because there is not much they can do to stop it.
"It's a grave concern to financial institutions, because ultimately we end up taking the loss," said Sharie Quarry, director of security at the $1.2 billion-asset Affinity Bank in Ventura, Calif.
She also said she is not aware of any of Affinity's customers being victims of the thefts.
Arco gas stations operate primarily on the West Coast. Calls to Arco, a subsidiary of BP PLC in London, were not returned.
A clerk at an Arco station in San Diego said the company recently asked the station's franchise owner to install an alarm in the convenience store that alerts the clerk if anyone is trying to tamper with its payment terminals.
Also, signs posted on Arco pay terminals warn customers to check for "loose" card readers and key pads, and to report them immediately.
Law enforcement officials say suspects in a number of the thefts are thought to have traveled to California from Eastern European countries such as Romania and have shipped much of the stolen funds back to colleagues in their home countries.
James Van Dyke, the principal and founder of Javelin Strategy and Research, said debit card theft from skimming devices — whether placed on bank automated machines, gas station payment terminals, or ATMs in retail stores — is on the rise, because thieves see it is a way to steal checking account information quickly.
"The risk at gas stations compared to merchant point of sale terminals is much higher, because so many of them have unattended checkout stations, and not all of the stations have cameras in place," Mr. Van Dyke said.
Linda Chumley, a vice president at Wells Fargo & Co. in San Francisco, said it is difficult for banks to get merchants to beef up their security procedures to minimize skimming, because the Payment Card Industry standards do not require them to do so.
Wells has instituted a number of protection and monitoring measures, so its customers' losses from skimming incidents have been minimal, Ms. Chumley said. Still, there is the inconvenience factor, she said; customers whose account information is stolen will have to take the time to get new debit cards and checking account numbers.
For liability reasons, Wells and other banking companies have refrained from warning its customers specifically about the risk at Arco stations, Ms. Chumley said.
Detective Kim outlined a number of things banks can do to help law enforcement agencies identify suspects.
For example, banks should provide copies of surveillance tapes at ATMs within days of the crime, not weeks, he said, since suspects can be held initially for only 48 hours, and if they are foreigners, the flight risk is much higher if there is not enough evidence to hold them longer.
In addition, bankers should try to provide law enforcement officials quickly with a history of transactions from stolen debit cards, to help determine if the common compromise point was at the machine where the skimmer was placed, he said.
Bankers also should cooperate with law enforcement task forces that have been established to deal with such cases, and they should communicate often with other banking companies in their markets, Detective Kim said.
