'Tin Foil' Payment Fraud Scheme Resurfaces at Gas Stations

Fraudsters are once again taking a shine to using tin foil to tamper with the satellite dishes that gas stations use to transmit payment card data to authorizing banks and processors.

Several years ago, criminals developed a devious method for completing fraudulent card transactions through a process called "tin-foiling" in which they place tin foil over the satellite dish connector, or receiver, to knock the payments system offline, says Simon Gamble, the president of North America for Mako Networks, a security provider for cloud-based networks.

The crime is showing up again at various U.S. gas stations, Gamble says.

Earlier this month, Hagerstown, Md.-based petroleum distributor Ewing Oil Co. informed Chevron station marketers that several Chevron stations had become victims of the tin-foiling scam. Ewing suggests employees monitor the satellites "more closely."

Ewing Oil and Chevron did not respond to inquiries prior to deadline.

"With the satellite connector covered, the system skips the authorization process and the transactions go unchecked," Gamble says. "And it's fairly easy for a criminal to get on a roof at some of these stations and not be seen [when covering the receiver]."

When the system is offline, criminals will use fraudulent magnetic-stripe credit cards to purchase large volumes of gas to eventually sell on the black market, Gamble says.

It is also common for gas station owners to report incidents of petty theft, in which a fraudster illegally purchases only a tank of gas and a carton of cigarettes, after a partner has successfully covered the satellite in tin foil. 

The tin-foiling method has been around for several years, with word first traveling quickly in the Detroit and Washington D.C. areas through car associations and police departments. Security vendors like Mako Networks have been hearing complaints about the crime more consistently this year, Gamble says.

Below: an NBC news report describes one incident of this scam.

Two weeks ago, the ABC-TV affiliate in West Palm Beach, Fla., reported that a group of people attempted to make fraudulent transactions at a Jupiter, Fla.,  station after two of the group got on top of the station's roof and covered the satellite connector with tin foil. In this particular instance, the gas station owner reported he was no longer using the satellite the would-be thieves had covered, according to the report.

As many as five years ago, gas stations were sharing their methods online in how to thwart the tin-foil thieves, some resorting to lubricating walls or installing razor wire at the rooftop or around the satellite dish.

"It's important for a gas station to have a backup system in place if their network goes offline, or a way to be alerted when the system is offline," Gamble says.

Consumers who have had to deal with stolen cards may notice the trend as they review their statements, Gamble says.

"It's become remarkably common to see many bills for gas purchases when your card has been stolen," he adds.

The transition to EMV-chip payment cards will resolve these types of card-present fraud issues, Gamble says, but he acknowledges that it will be several years before all stations have converted to the chip-based cards because of upgrade challenges and costs.

The tin-foiling scam again illustrates "how creative the bad guys can be," says Julie Conroy, senior analyst and fraud expert with Boston-based Aite Group.

But the tin-foil problems will likely always be a secondary issue to "good old-fashioned skimming" of card stripe data at the pumps, especially while the U.S. still favors magnetic-stripe cards, Conroy says.

"Gas stations tend to be particularly attractive to crooks anyway, thanks to the unprotected nature of the pumps, and the tendency for the point-of-sale equipment to be fairly outdated," Conroy says.