Any independent owner who watches the payments market closely may also ask why they would want to spend $25,000 on an upgrade now, when chip card could be replaced by contactless, mobile or biometric payments in just a few years’ time?
In the long run, many owners could see the risks of assuming liability for any losses being justified in these cases.
As always, fraud migrates to the next easiest place. After personally working with fuel card fraud in Europe for several years, I have physically seen that movement. If you upgrade security sites in France, fraud levels rise in Belgium. Upgrade in Belgium, it moves to the Netherlands. Until recently, all sites in the U.S. were "equal" in their card acceptance, but if a percentage of them upgrade, clearly the fraud will be pushed on to those that haven’t.
The other factor in this upgrade is the lack of a fall-back option. It’s standard practice when rolling out new technology to have a fall-back option if things don’t work properly. In the case of EMV acceptance on fuel pumps, the fall-back payment technology is mag stripe. Realistically, a chip should rarely fail, but from a fraudster's perspective this is a golden opportunity, particularly for stolen or counterfeit cards.
This was a problem with fuel cards in Italy in 2018-19, where fraudsters would simply damage the chip (often with a hammer) and pay using the fall-back option. A very simple workaround! The scheme was very well organized. The fraudsters would regularly operate out of the car parks or rest areas in Northern European fuel sites. The security at such rest areas is often relatively low, so this is a perfect area to set up – and with EU regulations on the number of hours drivers can be on the road, it means that these areas are often populated.
The fraudsters would approach drivers individually, offering cash in exchange for the use of their fuel card for a short period of time. The fraudster would then swipe the mag stripe through a copy device and distribute the details to another person – often based in Northern Italy. For many fuel sites in Italy, the fall-back option was set as mag stripe – which means the details were skimmed by the first team based in Northern Europe. Italy was often selected for the high price of fuel compared to most of the rest of continental Europe – the high initial price meant a good resale value for those looking to sell on stolen fuel at cut rates.
Because the fraudster only has the magnetic stripe card details, they need to be sure that the chip cannot be used, so that the only option is the fall-back method. This can be achieved by scratching the chip so that it is unreadable, overlaying the chip with a fake sticker, so that it cannot be used, or simply smashing the chip out of the card with a hammer.
This fraud method may well be one of the most likely to be seen by fuel sites across the U.S. after the AFD switchover – and because it is mostly larger corporations that have already switched over, it will see the same issues with staff likely not noticing, or more likely not caring, if the card is damaged and the fall-back has to be used.
There is no denying that the upgrade to EMV will reduce certain types of fraud by noticeable amounts, but there should be no illusion that this is a “silver bullet” to a growing fraud trend.
