/ Department: Wholesale / SOP#
Division: Project Management / Revision #
Last Reviewed/Revised Date

Standard Operating Procedures
Skimming Prevention

Purpose

The purpose of this process is to have a standardized check system for preventing fraud at Southeast Petro locations at the pump. The use of skimming devices to steal credit card information is detrimental to the gas station industry and it is imperative to take as many preventative measures as possible to curb any theft of the customer’s personal information.

Scope

The scope of this process will involve daily checks, logs, and replacement of security seals on each and every pump with a card reader on the property.

Responsibilities

It is the responsibility of the Store Manager to ensure that all measures in this procedure are followed with the appropriate documentation. The Store Manager may delegate this task to an employee so long as it is monitored as having been done.

References

Processes that Apply / Supporting Documents
Daily Pump Security Inspection Sheet.xls
Dispenser Security Seal Monitoring.xls
Security Seal Placement Diagram.docx
/ Department: Wholesale / SOP#
Division: Project Management / Revision #
Last Reviewed/Revised Date

Process

Security Seals and Anti-Tamper Stickers

Skimming fraud can occur in several ways.

  1. Criminals can place skimming devices inside the gas pump and “skim” customer card information.
  2. Skimming devices that mimic the gas pump card reader can be placed over the top of original card readers and “skim” customer card information.
  3. Cameras can be inserted above card readers to steal customer card information.
  4. Skimming devices that mimic inside pin pads can be placed over the top of the original pin pads and “skim” customer information.

For inside pump security, security seals are used. These are special stickers placed over any door opening that gives someone access to the credit card readers. These special stickers, when peeled back or broken will display a “VOID” message to indicate that someone has tampered with it.

Valid reasons security seals will be voided:

  • Employee needs to open pump door to replace receipt paper
  • Employee needs to open pump door to fix paper jam
  • Technician needs to access pump door to do a repair

If an employee is inspecting pumps and the seal has been broken, the employee will need to determine if the seal is broken due to the above valid reasons, or if a criminal has been tampering with the pumps to plant a device to steal someone’s personal information.

If the seal was broken by a store employee or technician, the employee needs to replace the seal and document that he/she did so on both the sticker and the Dispenser Security Seal Monitoring Log.

  • Placement of Security Seals

Security seals should be placed over the opening of any door that allows access to the credit card reader.

Never place a security seal on the hinged side of the access door.

See the Security Seal Placement Diagram for detailed placement of seals according to the pump model.

  • Replacement of Security Seals

Security seals should be replaced immediately upon breaking the seal for any valid reason. The person that broke the seal must be the one to replace and document that the seal was both broken and replaced by that person. Always clean the area well (remove old residue) where the seal was removed before replacing.

If someone notices that a seal was broken, and they were not the person that broke the seal, further investigation needs to take place. This process is provided in greater detail under the inspection process.

For outside pump security and inside pin pad security, Anti-Tamper stickers should be used. Stickers should be placed on both the outside card readers and the inside pin pads to identify the originals. See the Security Seal Placement Diagram for detailed placement of stickers.

These stickers should be noted during pump inspections daily. If a sticker is missing, a further inspection of the reader needs to take place. This process goes into more detail in the inspection process section.

Pump and Pin Pad Inspections

Detailed pump inspections will be conducted first thing in the morning before 8am. During this inspection, each pump needs to be thoroughly inspected using the Pump Security Inspection Sheet.

Managers should ensure that this inspection has been done by initialing the Pump Security Inspection Sheet every day.

  • Pump Security Seal Inspections

Each pump security seal should be thoroughly inspected. Things to look out for to indicate tampering:

  • Security seal is voided
  • Security seal has been sliced with a razor blade
  • Security seal is not the type of security seal that the station uses (criminal replaced with generic seal to hide that tampering took place)
  • Another indication is that there is no writing on the seal from the employee that replaced it.

Person inspecting the pumps will need to check that they inspected each pump and then initial at the end of the row on the inspection form. Inspectors that initial the inspection are confirming that they have checked the seals for the above criteria and found that there was nothing suspicious about the seals.

What to do if something is suspicious

If the person inspecting a pump finds something suspicious, the store manager will need to be contacted immediately. The store manager should inspect the pump(s) in question.

Some preliminary checks should include:

  • Checking the log book to see if an employee forgot to write on the sticker
  • Determining if a technician broke the seal and someone just didn’t replace it correctly

If it is determined that no errors were made and the seal was broken by an unknown source, further inspection inside the pump needs to take place.

  • Immediately stop fuel sales at the pump(s) in question and bag the pump.
  • Open up the pump and look inside to see if you see any skimming devices present.
  • If a skimmer is found, do the following:
  • DO NOT TOUCH the skimmer. Leave it in place.
  • Contact your District Manager and notify them that a skimmer has been found.
  • Contact authorities.
  • DO NOT sell any gas on the pump that a skimmer was found on.
  • Check security tapes to see if you can identify who placed the skimmer at the pump.
  • If you are not sure, contact your District Manager and notify them of the incident and the actions you have taken. Do not sell any fuel at the pump(s) in question until your District Manager has cleared you to continue sales.
  • Do not sell any fuel at the pump(s) in question until your District Manager has cleared you to continue sales.
  • Credit Card Reader Inspection

Each pump card reader should be inspected for visibility of the anti-tamper sticker. If all stickers are visible, check the boxes for each pump and initial that all are in compliance.

If a sticker is missing, a closer inspection will need to take place by the store manager immediately.

  • Determine if the sticker was peeled off or fell off.
  • If this is the case, replace the sticker and sign off of the inspection sheet.
  • If there is further suspicion, tug and jiggle on the credit card reader to see if there is a fake one on top.
  • If there is no give to the reader and you are absolutely sure that there is nothing on top of the reader, sign off on the inspection sheet.
  • If you are uncertain, bag off the pump immediately. Contact your District Manager and let them know the steps taken. They may inspect or send a technician to inspect.
  • You may not sell gas at the pump(s) in question until a District Manager has given the OK.
  • Pin Pad Reader Inspection

A final inspection should be done on the inside pin pads. Follow the same procedure for credit card reader inspections.

Log and Inspection Paperwork

The Dispenser Security Seal Monitoring Log should be filled out each and every time a security seal is removed and replaced on a pump.

The Dispenser Security Seal Monitoring Log and the Daily Pump Security Inspection Sheet should be kept up to date through 6 months. You may discard records after a 6 month period of time.