Thieves racked up more than $11,000 in fraudulent charges on Utah credit and debit cards after stealing the numbers with a "skimming" device placed inside a Sandy gas station pump, police said.
The device, used to electronically capture financial and personal data from unwitting credit and debit card users, was found hidden inside a pump at a 7-Eleven at 2175 E. 9400 South after California authorities informed police of the fraud.
At least one local cardholder's account was used in California, where it was dinged for more than $11,000 in withdrawals last month from ATMs in Los Angeles County, Sandy police Sgt. Troy Arnold said.
The skimmer could have been on the Sandy pump for about 60 days starting around Dec. 1 before it was removed in the last week of January, Arnold said. The device is difficult to detect, and the company was unaware of any problem up to that point, he said.
"In California, there are literally thousands of these [incidents] every day," Arnold said. "Unfortunately, it's becoming common practice."
Margaret Chabris, a spokeswoman for Dallas-based 7-Eleven, said the Sandy case appears to be a solitary incident for the chain in Utah.
"Police had contacted the store, and an employee immediately put in a work order with the [outside maintenance] company we use. When their technician found that one skimmer, we alerted all other 7-Elevens in Utah to check all their pumps," she said. "We found only one of those devices in Utah, at the [Sandy] store."
Chabris said 7-Eleven has had other skimming reports, but nothing widespread. "We have found a couple of [the devices] elsewhere, in rather isolated locations in the country."
Police departments throughout Davis, Salt Lake Utah and Weber counties said they had no similar incidents. Springville police had one similar incident at an ATM more than a year ago, but details were not available.
The high-tech snooping gear is secreted inside or under gas pumps and other places where debit or credit cards are commonly used.
"They manufactured this in a door and everything, just like a gas pump," Arnold said. "They probably just removed the gas pump door and placed the door with the device onto the actual gas pump."
When customers swipe their cards for purchases, the device captures and transmits card numbers, PIN codes and other information electronically via Bluetooth, a short-range wireless connection.
"Unfortunately, there's really no way to figure out who put the device on," he said.
Glen Passey, resident agent in charge at the Secret Service, said his agency investigates such crimes. He would not comment on how many cases have been investigated in Utah.
"It's a type of a crime that we see periodically. It goes up and down," he said. "We work closely with law enforcement and make arrests, and after arrests things kind of drop down."
Arnold said the case underscores the need for caution in the use of plastic to make purchases, particularly at such heavily traffic sites as gas stations.
"When possible you should pay with cash," Arnold advised. "If cash is not available, use a credit card instead of a debit card. Police recommend this because these criminals are able to obtain your PIN through the technology and will access or possibly drain your entire bank account."
Passey agreed consumers are the first line of defense against skimming.
"You just have to be careful because it's your card," he said. "Check your statement every month to make sure there are no unauthorized charges."
Those who use credit cards, rather than debit cards, generally are able to successfully dispute losses, Arnold said.
How to avoid 'skimming'
Gas stations typically are favorite skimming targets, with the data being used elsewhere to raid accounts through ATM transactions. Here are some precautions police and banking industry officials agree could help cut down your risk.
Avoid typing in your PIN code » especially with debit cards, where money is immediately transferred from your account; instead use the card as a "credit" transaction rather than debit. The money will still be taken from your account, but through a credit card network that generally provides more liability protection.
Use an ATM at a bank » rather than a convenience store, gas station, or airport. Bank ATMs are not immune to skimming, but they are generally under surveillance and a less-attractive target for cyber-thieves.
Keep a sharp eye on bank statements.» Look over charges listed on your monthly statements, and check transaction records available through most bank and credit union Web sites.
Report skimming immediately » Contact the bank, credit union or other provider of the card targeted. Report the theft to local police as well. Usually, credit card issuers will work with you to recover lost funds, but the process can be difficult and prolonged in some cases.