Skimmers are active in Maricopa. Very active.
Leticia Rios found out the hard way.
So have a lot of others.
Rios was victimized on Aug. 5, the day somebody used her stolen debit card information to make three ATM withdrawals – two for $500 were made within minutes of each other – that cleared $1,396 out of her account with an online bank. The withdrawals were made from an ATM in Phoenix, she said.
“I was devastated,” she wrote in a post to a private Facebook group the same day her account was hit. “It’s just so unreal when this [expletive] happens to you. I can’t believe that I’m the only one here that it’s happened to …. If anyone else has been a victim of this in the last few days please let me know.”
Rios, who has worked from home since March due to the coronavirus pandemic, said she doesn’t leave the house very often because of an underlying health condition.
Her boyfriend does most of the shopping, and the debit card hasn’t been carried out of the city in months. It was used only in town, mostly at the gas pumps at the Circle K at Honeycutt and Porter roads and Walmart, she said, noting her card was used at the Circle K before she was skimmed.
Her posts in several public and private Facebook groups drew more than 130 comments, with nearly 50 people reporting they, too, were skimming victims, including a couple dozen incidents from this summer. In some cases, people managed to foil the criminals, but many others said they had amounts – from as little as $20 to more than $2,000 – taken from them.
When the first withdrawal was made from Rios’s account, her phone pinged. She had set up alerts to notify her when the debit card was used. Still, it was used two more times to take her money.
She called police in Phoenix to report the incidents and then drove herself to the Circle K in west Phoenix to obtain video footage of the ATM used to make the withdrawals. But store cameras are not set up to capture activity at the ATM and she could only see the person walking away, she said, describing the suspect as a man in his mid-20s, tall and Hispanic – and wearing a mask.
There was no surveillance video available from the ATM machine, she said.
She reported the fraud to her bank.
Rios was surprised at the number of comments from people relating similar experiences.
“There are so many other victims here in Maricopa,” she said. “I was expecting others, but not as many responses as I did.” She received additional responses from her post on NextDoor.
“It’s just a really hard blow for me at this time,” she said, adding that friends and family helped with some money to get them by.
She finally received a credit from her bank at the end of August. Now she only uses cash and doesn’t leave funds in her checking account.
“I’ve lost trust in swiping my card,” she said.
In an interview, Rios said the manager at the Circle K on Porter Road told her boyfriend that the store routinely checks for skimmers.
But many who commented on the Facebook thread said they were convinced their information was stolen at the Circle K pumps. Others said the Porter Road location has a reputation for skimming.
An InMaricopa investigation finds their suspicion was well-aimed.
LOTS OF SKIMMING STORIES
Skimming is the act of attaching an illegal device to fuel pumps, ATMs and point of sale systems to copy and store private debit or credit card information to be misused later to make cash withdrawals and fraudulent purchases. In more and more incidents, personal data is recorded at the pump and sent wirelessly via Bluetooth to the laptop or mobile device of a nearby perp.
In posts on Facebook, local skimming victims said funds were siphoned from their accounts at ATMs in Chandler, Phoenix and Glendale even though their debit cards were never out of their possession and, in some cases, the cards had never been out of the city. Card information is also cloned onto gift cards to make big purchases at stores.
Many victims have reported the fraud to their financial institutions – some also have filed police reports – managing to get their money returned, but sometimes only after weeks and months of hassle.
“The same thing happened to my husband on this past Sunday and the only place he used his card at was Circle K off Porter,” wrote one woman on Rios’s post. “We also put on (sic) a police report and contacted circle K.”
Another woman wrote: “Happened to me, $1K. Used that card at Circle K here in town (porter). They withdrew from QT in Phx off 51st ave & camelback. My card was in my possession the entire time.”
“Circle k has the worst problem with card skimmers,” wrote yet another woman. “Happened 2 times to my mom and once to me.”
A few others claim they were skimmed after shopping at the Walmart in town.
Some say they have been hit more than once, and know friends and family members who were victimized. In one case, a woman on unemployment due to the pandemic saw her state benefits debit card compromised.
It’s been such a problem in recent years the U.S. Secret Service launched a nationwide initiative in 2018 to find and remove skimmers at gas stations across the country. Agents found nearly 200 skimmers on gas pumps at convenience stores and service stations during investigations in 16 states. The skimmers are capable of saving hundreds of credit card numbers, the agency said.
According to some estimates, skimming is a $16 billion business in the United States.
And immensely profitable for the perpetrators.
EAST IS NOT EDEN FOR VICTIMS
In early September, InMaricopa sought police reports through a public records request for skimming complaints investigated between Jan. 1 and Aug. 31 of this year.
We received 22 police reports in total for skimming incidents reported between June 26 and Aug. 7, including 19 cases where victims lost money from their accounts. (In three other cases, financial institutions were able to stymie the thefts.) Over those 43 days this summer, nearly $14,000 was jacked from Maricopans’ accounts, an average loss of about $731 per victim. In most cases, the criminals made withdrawals and purchases at ATMs and businesses in the Phoenix metro area.
Many victims never filed a report with police, and some were directed to police departments in Phoenix and other cities to file reports.
Residents in the east end of the city comprised the biggest bloc of victims and for good reason, analysis of those police reports show.
On June 28, employees at the Circle K on Porter found a skimmer on a credit card machine inside the store. It had been there about two days, according to a police report on a July 5 case involving a Homestead South resident whose credit union debit card was misused nine times that day at a Fry’s Market in Scottsdale. Her total loss: $445.63.
That resident had used her debit card twice at the Circle K between June 26 and 28, buying snacks and drinks inside the store, she told police.
In the 19 cases where victims lost money, residential addresses were available for 16 of the victims. Of those, 12 lived east of Porter Road, including six in Homestead North and South, two in Sorrento, two in Rancho Mirage and two in Tortosa. One victim lived in the Glennwilde neighborhood, just west of Porter.
The first two complaints received by Maricopa police were from residents whose financial accounts were struck on June 26. One of them was filed by a Maricopa police officer, whose bank account was hit for $463. (Eighteen days later, the officer would take a complaint from a Rancho Mirage woman skimmed for $1,200.)
The store manager refused to comment on the skimming incidents, saying company policy did not allow her to talk to the media.
Donna J. Humphrey, advertising/brand manager for Circle K’s Grand Canyon Division, also declined to comment, saying she did not have an approved statement to release.
Maricopa police Det. Gary Gatzke investigated the skimmer at the Circle K on Porter and was provided video surveillance of four suspects, according to the police report written in the Homestead South victim’s case.
Able to identify one of the suspects in the video, Gatzke contacted an agent with the U.S. Secret Service who said the agency is working multiple cases in Arizona involving the suspects in the Circle K video, according to the police report.
In the immediate days following the discovery of the skimmer, five more complainants were asked by police if they had used their cards at the Circle K between June 26 and 28, and they all indicated yes. Two others told police that their most recent card usage included purchases at the Circle K.
The Homestead South woman’s case and several others police linked to the east-end convenience store were referred to the Secret Service.
Incredibly, of the dozens of people who commented on Leticia Rios’s Facebook post to say they, too, had been victimized, the name of just one turned up in the police reports.
HOW IT’S DONE
Skimming cases at gas pumps in Arizona are also investigated by the Weights and Measures Services Division of the state Department of Agriculture, which has recorded 37 skimmers so far this year – through Sept. 9, according to Kevin Allen, associate director.
Weights and Measures, which partners with retailers and law enforcement agencies to aid in the identification and investigation of skimming devices, reported a total of 209 and 148 skimmers in 2019 and 2018, respectively.
Of the 539 cases investigated by Weights and Measures in the past five years, however, just one was in Maricopa.
In February 2019, two card skimmers were discovered by investigators in pumps at Circle K at John Wayne Parkway and Smith-Enke Road after a consumer complaint. In that case, Allen said investigators used technology developed at the University of California San Diego to detect skimming devices using Bluetooth, a high-speed wireless standard uses to exchange data over short distances.
Increasingly, skimmers are using the technology to capture credit and debit card information. It’s called “bluesnarfing,” or “blue skimming,” and it’s been around for years. It starts when criminals break into a gas pump, often with a universal master key, and install a skimming device – in less than two minutes.
Connected to both the magnetic stripe reader and the keypad, skimmers are able to steal a customer’s credit or debit card number, plus a ZIP code and PIN number for debit cards. Using Bluetooth, that sensitive information can be sent to a laptop or mobile device without the risk of re-opening the pumps to retrieve the device.
Just one skimmer, which can be manufactured for less than a family meal at McDonald’s, can put more than $4,000 every day into a crook’s pocket, according to University of California San Diego researchers. But a skimmer’s daily revenue is potentially much higher.
“We estimate the range of per-day revenue from a skimmer is $4,253 (25 cards per day, cashout of $362 per card, and 47% cashout success rate), and our high end estimate is $63,638 (100 cards per day per day, $1,354 cashout per card, and cashout success rate of 47%),” said a study by the same group of researchers.
In September 2016, a well-known blog on computer and internet security took a look at nearly nine months’ worth of skimming incidents at Arizona gas pumps after there were more attacks in August 2016 than in all of 2015.
“A review of the locations of the skimmed stations suggests that skimmer scammers prefer poorly secured stations that are quite close to a major highway, no doubt so that they get away from the station relatively quickly after the skimmers are planted,” KrebsOnSecurity.com reported. “It’s unclear whether the skimming attacks documented here are the work of one or multiple scammers or gangs, but the activity pretty clearly shows a focus on stations directly off the main arteries from Phoenix on down to Tucson.”
‘I DON’T TRUST ANYTHING’
Lori Cincotta Apt and her husband were each hit, her in July and him in August.
Furloughed from her job in March due to coronavirus, the Maricopa resident was in line buying groceries with her state unemployment debit card when it was rejected. She tried the card a second time, knowing she had funds in the account. Denied again.
The money was gone. She had no idea that criminals had stolen her information and removed $500 from her unemployment account. She was never notified by her card company.
Her husband was hit for $100 weeks later, but they reported it to his bank, which locked the card to halt subsequent attempts.
They did not file police reports and she did not want to name the businesses where she believes her information was compromised. But she did say it was a “hassle.”
It took the Apts a few weeks to get the unemployment money back. She said she felt “very violated,” adding that it came at a tough time for them as the couple had to deal with a blow to their income from the pandemic.
“You know, the income is not there,” she said.
“There’s an awful lot of people who have been affected,” she added.
It has changed how she pays while shopping, especially when she is filling the tank. “I’m being very careful,” she said. “Now I go inside and pay for gas. I don’t trust anything.”
LONG ROAD TO HELP CONSUMERS
Retail stores, gas stations, banks and credit card companies are well aware of the problem.
Visa and Mastercard mandated that gas stations be compliant with EMV, or chip-based, card technology by October 2017, in part to increase security at the gas pumps.
The technology is called EMV because it was proposed by Europay, a European financial company, MasterCard and Visa. Unlike the magnetic stripes on debit and credit cards which store data statically, the account information on EMV cards uses unique encryption each time it is accessed, making them more secure and fraud-resistant – at least until the skimmers again figure out how to beat the system.
But the 2017 deadline was pushed back because of difficulties involved with updating hardware and software at pumps or replacing them altogether.
Recently, a new October 2020 deadline was postponed until mid-April 2021, according to the Association for Convenience & Fuel Retailing, because of the economic effects of the coronavirus pandemic. But it is likely that many gas stations will not make that deadline either, given the significant expense in adopting the technology.
The Fry’s Fuel Center in Maricopa was among the more than 90 in the state that made the transition to chip readers last year.
One national retailer with gas pumps in the region took action on its own in December 2017 to thwart skimmers.
QuikTrip, an Oklahoma-based chain of convenience store/gas stations that operates nearly 140 stores in Arizona, including 117 in the Phoenix metro area and one in the city of Maricopa, rolled out a program called PumpShield.
“PumpShield helps protect consumers from getting their information compromised,” said Aisha Jefferson-Smith, spokeswoman for the QuikTrip Corp. “When there is any unauthorized attempt to open a pump, silent alarms alert us, and the pumps are automatically shut off. Recently, two criminals were arrested for attempting to install card skimmers at a Tulsa QuikTrip, which was a huge mistake. We were able to assist law enforcement with catching the criminals and making arrests.”