Gas station smartphone apps and cybersecurity

[wgoldman]

I've just completed a 2400-mile trip without getting out my credit card at a gas station . . . see my blog post at https://openroadscapes.com/blog/2019/12/22/fueling-cybercrime

-- Bill

 

[manholt]

Would help to know Make & Model, DP or Gas!  I got to use a truck stop, 64 feet with toad, your trip would be 3 stops for me!  I go in, never use card at pump & in 53 years, have not had a problem!

Have a great Holiday Season.

[wgoldman]

I'm traveling much shorter -- a 34'4" Tiffin Open Road (Class A gasser) and not towing.  So I can use many different types of gas stations and almost never rely on truck stops . . . and I do have to stop more often than you.  Perhaps that's why I prefer not to go inside and wait in a line to pay for my gas.

Still, going inside to pay is safer than paying at the pump, where "skimming" has become one of the most common causes of credit card fraud.  However, as mentioned in my article, the latest hacker strategy targets the gas station's internal data network.  That means that your account information is at risk even if you go inside to swipe your credit card.  

-- Bill

[richard5933]

There's always the option of using something like the Loves app. Load your payment card, use the app to start the pump, and you can avoid swiping at the pump or going inside. I'm sure other brands offer similar things.

[wgoldman]

1 hour ago, richard5933 said:

There's always the option of using something like the Loves app. Load your payment card, use the app to start the pump, and you can avoid swiping at the pump or going inside. I'm sure other brands offer similar things.

The Love's app does not allow you to use common credit cards (MasterCard, Visa, American Express, etc.), but that app will work if you enter a Love's Express card or an EFS card as your payment method. The apps I discussed in my article mentioned in the original post will all accept conventional credit cards.  

[manholt]

Even if you hack the internal data network, they have been doing that in Europe for the last 30+ years, you still will not get the chip info!  Without that and the pin code,  case closed.  America, surprisingly, is still lagging behind, in that there is no chip in most Debit cards!  I have both  Visa Debit and Visa Credit with the chip, issued by a brokerage house.  My Bank wanted to give me a debit  card, I carry cash, when we are in coach. I asked if it had a chip? No! 

My international CC/DC both have the chip and if you look on the back, they have my photo, home address, DOB, Birth # (same as SS in US) and bank account #!  ID theft, seems to be an American thing...wonder why?

I'm an American Citizen!

[wildebill308]

Bill, you are making me laugh out loud as in LOL. You are a little behind the times. Show me one credit card that doesn't have a chip. 

7 hours ago, wgoldman said:

Still, going inside to pay is safer than paying at the pump, where "skimming" has become one of the most common causes of credit card fraud.

Yes it is in the top 10, but if you do a simple Google search it is listed as the 5th most common causes of credit card fraud. Hacking/ Hacked bricks-and-mortar merchant was number 1. You already said this had happened to you but the CC company had caught it and reversed the charges before you became aware of the problem. So what is your point, outher than trying to draw people to your blog to try and drive hits to monetize it.

9 hours ago, wgoldman said:

I've just completed a 2400-mile trip without getting out my credit card at a gas station . . . see my blog post at https://openroadscapes.com/blog/2019/12/22/fueling-cybercrime

 

7 hours ago, wgoldman said:

I'm traveling much shorter -- a 34'4" Tiffin Open Road (Class A gasser) and not towing.

Why would you drive 2400 miles without a toad? You give up so much of your ability to see and do. I am also intrigued by your infatuation with how fast you need to get through the gas buying process. Us old people who are fumbling with our credit cards don't have to be in a hurry. One more LOL, 2400 miles o my. I just rolled past 8458.0 miles this year in the rig in my signature.

Bill

[wgoldman]

So glad I could provide a few laughs for you, WILDEBILL308.  I don't want to get into a debate about my RVing lifestyle and choices, but I hope you don't mind if I just clarify a few things in response to your post:  

1. Yes, modern credit cards have a chip, along with a magnetic stripe. The problem is that many gas stations still do not have chip readers installed (at the pump or inside), so the magnetic stripe is still used at the point of purchase. 

2.  Yes, credit card companies are very good at identifying fraudulent use quickly.  The problem is that the company will then need to send you a new card, and you will need to enter the new card's numbers into all the online sites that stored your old card numbers, including airline and hotel and rental car websites, online retailers, subscription services, etc.   

3. My blog is ad-free, and I am not affiliated with any company or product that I happen to mention in the articles I write.  If someone clicks the link in my original post, I receive zero income.  And if you're wondering why I write, it's because I enjoy writing.

-- Bill

[manholt]

Bill, point taken!  Noticed you joined in 2016...where have you been the last 3+ years?  Truck stops all have chip readers and I only use gas stations that I know, to fill up toad.  I don't use the Jeep at home, we got a SUV & Truck there and know all the locals...small country town.  This Summer we left Texas for the Canadian Eastern Providence's, over 11,000 miles and filled Jeep 4 times.  My coach had 28,000 on it in 2013, my toad is a 2013 & has 51,000+ on it, Coach now has 107,000+ ! 

WBill goes to Maine every year & packs the miles on.  I do at least 14,000 per year. We both live in Texas!  What about you? Full time or S&B?

[wildebill308]

13 hours ago, wgoldman said:

 I don't want to get into a debate about my RVing lifestyle and choices

Yet, you brought them up. Don't worry you can learn and improve your RV experience. Are you full time? where are you located? 

 

13 hours ago, wgoldman said:

1. Yes, modern credit cards have a chip, along with a magnetic stripe. The problem is that many gas stations still do not have chip readers installed (at the pump or inside), so the magnetic stripe is still used at the point of purchase. 

Where do you see this? I don't recall having to swipe a card this year.  I do admit to this being a slow travel year as we only visited 27 states (some 2 or more times) so I know I missed a lot  of places.

The new readers that clamp down on your card so you can't remove it were interesting the first couple of times.

 

13 hours ago, wgoldman said:

2.  Yes, credit card companies are very good at identifying fraudulent use quickly.  The problem is that the company will then need to send you a new card, and you will need to enter the new card's numbers into all the online sites that stored your old card numbers, including airline and hotel and rental car websites, online retailers, subscription services, etc.

I had this happen to me a couple of years ago. I called after being notified and had the replacement card sent to a place we were headed in a few days. Picked up the card when we checked in. I don't have my card stored more than a minimum number of places on line. That only increases your vulnerability if those places get hacked. 

13 hours ago, wgoldman said:

My blog is ad-free, and I am not affiliated with any company or product that I happen to mention in the articles I write.  If someone clicks the link in my original post, I receive zero income.  And if you're wondering why I write, it's because I enjoy writing.

My apologies then. We do see that here.

Seriously if you want to write you need to look at YouTube because there are people making good money there that can't write or video blog.

  Bill

[manholt]

Ok, WBill, time out.  We don't use 2x4's on this Forum...iRV2 does & we're not them!

[richard5933]

10 hours ago, WILDEBILL308 said:

...Where do you see this? I don't recall having to swipe a card this year.  I do admit to this being a slow travel year as we only visited 27 states (some 2 or more times) so I know I missed a lot  of places. people making good money there that can't write or video blog...

  Bill

Around here probably 2/3 of local stations are still using swipe machines instead of chip readers. Same for on the nearby highways. Probably has to do with stations weighing cost vs risk, as updating all the pumps is not cheap.

One thing I've noticed that I like - when many of the stations update to chip readers they also update to accept payments through a smartphone or smartwatch. That's my preferred method of using a credit card at the pump - just a flick of the wrist and no need to pull out my wallet or credit card at all. I hope that more companies start doing like Love's and let you start the pump from an app, but until then the smartphone thing is a step towards it.

UPDATE:

I just installed the Exxon Mobil Rewards app, and apparently you can use it to start the pump and pay for fuel. Options I've seen are to load a credit card or to use Google Pay or Samsung Pay. Looks like BP offers something similar.

[manholt]

Richard...All Apps, free or not are making $$$ somewhere.  Since the cost per gallon is mostly TAX, there is not a big margin between dealer cost/tax unless the price at pump has been marked up & you get a % kick back, then the price is what it should have been to begin with!  That's called "the feel good hook"!  

IMHO, uploading your CC or DC to a App, defeats your chip/PIN to begin with, no security..Pre loading a designated DC with several thousand dollars, is in my opinion silly, you make no $$$, but the bank does!  

[richard5933]

15 minutes ago, manholt said:

Richard...All Apps, free or not are making $$$ somewhere.  Since the cost per gallon is mostly TAX, there is not a big margin between dealer cost/tax unless the price at pump has been marked up & you get a % kick back, then the price is what it should have been to begin with!  That's called "the feel good hook"!  

IMHO, uploading your CC or DC to a App, defeats your chip/PIN to begin with, no security..Pre loading a designated DC with several thousand dollars, is in my opinion silly, you make no $$$, but the bank does!  

Not sure all that is correct...

The apps that the companies put out themselves, like the Love's app, don't directly make money. In fact, one of the apps I mentioned offers a discount on fuel. Where they make money is in how they push/entice/cajole you into entering the store to buy items there. That's where most of the money is made at stations nowadays.

A good chunk of a gallon of fuel is tax, but it's nowhere near "mostly TAX". Even in PA, the state with the highest tax I could find on gas, it's only about 1/3 the cost. That's a lot, but not "mostly".

If the app is using Samsung Pay, then how is it any more/less risky than using Samsung Pay anywhere else? The merchant never even gets the account information.

I've used apps to make purchases probably 1000's of times on multiple continents. Both using Samsung Pay and apps with credit cars loaded into their "wallet". So far there have been zero problems. The few times over the past years that my card number was stolen it was at a restaurant, where the waiter takes your card out of sight to complete the transaction.

If I understand correctly, the chip & pin cards were designed to prevent someone from simply copying your card by using a skimmer or by swiping it through a card duplicator.

Anyone that shops online would be doing the same thing as I did with these apps. I have only so many things to stress over, and once I've taken what I consider to be adequate steps to ensure that the apps are legit, I let the credit card people worry about it. If someone hacks into the system, the risk is all on Capital One.

[manholt]

You'd have to ask LSU Mike in Houston, what the break down is!  Restaurants in US = cash, outside US = Card, because the card reader comes to you!  I have bought zero online. I call FMCA for my Rally reservations, they have a  card on file with a very low credit limit.  Unlike Linda, I carry no balance on anything...learned that lesson 37 years ago, when I retired, back then, you had to be home when the CC  bill came in, or take the info with you & pay a estimate.  Since Al Gore invented the Internet, things have changed !

[richard5933]

Guess you and I choose different risks Carl. Neither is right, neither is wrong.

I rarely carry more than a couple hundred cash at a time. Always have a credit card. Someone steals my cash, I'm out. Someone steals my credit card the bank has all the loss, not me. Even when overseas, I'll use my Cap One card before I take out cash, if possible. They charge no fee for international, and they still carry the risk if someone steals my number. They've got a top-notch security protocol. There are many times when I get a security notice immediately after the card is used and before the transaction is complete - they are confirming that it's me using the card for an authorized purchase.

There are also more and more places that have gone cash-free. Not sure I like that as a concept, but if you want to shop there you've got to use something besides cash.

I agree about the restaurant difference - wish the US restaurants would get in on the mobile machines as well. I'm starting to see them use the tablet based mobile devices more and more though.

Back to the fuel topic...

No way I'd feel safe traveling with enough cash to pay for all my fuel on a trip with cash. Also no way I'm interested in having others in the store see that I'm carrying enough cash to fuel my 165-gal tank. Seems like I'd just be inviting trouble. They want to take my credit card? I'd hand it to them without a fight - it won't get them far.

[manholt]

Like you, I carry little local currency abroad.  Enough for small things & bus, tram fare!

 

[wayne77590]

20 hours ago, wgoldman said:

[...]

2.  Yes, credit card companies are very good at identifying fraudulent use quickly.  The problem is that the company will then need to send you a new card, and you will need to enter the new card's numbers into all the online sites that stored your old card numbers, including airline and hotel and rental car websites, online retailers, subscription services, etc.   

[...]

-- Bill

My CC service issues a different number to me and my wife tied to the same account.  If my card is compromised, credit payment use on it is cancelled. We still use her card for transactions without a loss of time waiting for another credit card.  The CC service sends me another card and life goes on for both of us.

Guess it is which CC service you use that might be the best. Mine is with one of the largest Federal CU's in the Nation with $110.2 billion in assets.

7 hours ago, richard5933 said:

[...]

One thing I've noticed that I like - when many of the stations update to chip readers they also update to accept payments through a smartphone or smartwatch. That's my preferred method of using a credit card at the pump - just a flick of the wrist and no need to pull out my wallet or credit card at all. I hope that more companies start doing like Love's and let you start the pump from an app, but until then the smartphone thing is a step towards it.

I have Apple Pay. A random number is used, not the CC#. So far no indication of a compromise anywhere by anyone using Apple Pay. You CC# is never seen by the merchant and a random token or number is used. Apple does not story the CC# either.

Quote

UPDATE:

I just installed the Exxon Mobil Rewards app, and apparently you can use it to start the pump and pay for fuel. Options I've seen are to load a credit card or to use Google Pay or Samsung Pay. Looks like BP offers something similar.

In 1984-85 Exon Mobil had the little dongle smart chip. Pull up to an Exxon/Mobile pump, hold the dongle next to the pump and the start pumping.  I stopped using it when there prices locally were higher than other stations.