Data-stealing device found planted on a pump at the island’s only gas station is indicative of a larger cybercrime scam, police say. Longboat Key residents are particularly vulnerable to such attacks.
It took 90 seconds.
One-and-a-half minutes is all the time two men needed to plant a card skimmer in a gas pump in the early morning hours Nov. 30 at Longboat Key’s only gas station.
But when Cindy Dearth started her shift at the Mobil station at 400 Gulf of Mexico Drive as she had for the past two years, she knew something was wrong.
Thin pieces of security tape over screws that hold the pump door closed, which managers replace and sign each morning and night, were broken — a sure sign the machine had been tampered with.
Cameras at the Mobil station captured images of two men in a white Lexus opening gas pump 8 at 12:30 that morning, while the store was not open, and installing a device meant to capture debit and credit card data.
“It basically gives them all the information they need to make a clone card,” said Longboat Key Police Department Detective Lt. Robert Bourque, who added he believes no cards were compromised.
Police gathered fingerprints and video evidence but have yet to make an arrest, Bourque said. This has happened at least twice before at the Longboat Key Mobil station, owner Nazeela Shaw said.
The best way to protect credit and debit cards from skimmers on gas pumps is to pay for fuel inside and with cash, Bourque said.
If that seems laborious, Bourque suggested paying with a credit card rather than a debit card, which banks are often more hesitant to reimburse, use a pump closest to the station and in sight of the clerk, machines criminal are less likely to tamper with, and check card statements often, looking for purchases that don’t fit usual spending habits.
Criminals often create clone cards with information they collect from card skimmers, using it to make purchases themselves or selling them on the black market, Bourque said. Popular purchases are often cigarettes, perfume, fuel and electronics.
A card skimmer at a gas pump can capture 30-100 cards per day, according to the Association for Convenience and Fuel Retailing.
Clone cards are also sold in bulk within criminal organizations and on the darknet, Bourque said, a part of the internet only accessible with specific software and often used for illegal transactions.
Longboat and its affluent population may be a lucrative target for this kind of criminal activity, Bourque said. Individuals on the island may have higher credit card limits, check their purchase history less often or make so many transactions that fraudulent activity could go unnoticed.
All of these variables make cloned cards from Longboat more valuable to criminals.
These rackets are often state-wide or even national, Bourque said. He said individuals or pairs of “expandable” members of criminal organizations often travel from one gas station to another installing skimmers across a region, then come back days later to collect the information by reopening the pump and downloading card numbers or use Bluetooth for the same purpose.
“It’s like a paper route,” Bourque said. “They’re in and out really quick.”
That speed makes them hard to catch, Bourque said.
Although law enforcement across the state cooperate in investigating these crimes, there’s only a few ways to bust these individuals: when they’re installing the skimmers, when they’re making purchases with fraudulent cards or if they’re caught with a skimming device, a third-degree felony in Florida.
Since banks often reimburse individuals in cases of fraud from skimming devices, financial institutions become the victims of the crime and won’t prosecute, Bourque said. And law enforcement must subpoena banks for any information about fraudulent activity.
“I couldn’t begin to tell you how much money they’re losing,” Bourque said of banks victimized by fraudulent activity. “They’ve got to make that money up somehow.”
But even if Longboat Key Police get information from banks, it’s often fake or located in another country — making it difficult for law enforcement to find and prosecute individuals involved.
That doesn’t mean the department doesn’t investigate this kind of fraud when it’s reported, Bourque said. It could spend hundreds of hours on one case and 10 hours on another, but it all depends on how much evidence the department has.
“If you have no film, no fingerprints, no information, there isn’t a whole lot to investigate,” Bourque said.
Clone cards created by skimmers cannot be used to make online purchases, however — security codes needed for internet shopping are not included on magnetic strips criminals copy with these devices, Bourque said. He said fraudulent online purchases are often due to an online security breach.
“Cybercrime is one of the fastest growing crimes in the United States,” Bourque said. “The gas station has done their part, now it’s time for us to do our part.”