A Honolulu company has taken steps to prevent a repeat of a scam that skimmed credit and debit card information from pay-as-you-go pumps at four of its gasoline stations.
Meanwhile, officials with some of the financial institutions victimized by the skimming operation are assuring customers that it is safe to use credit and debit cards at gasoline stations, ATMs and other bank machines as long as they take proper precautions against devices that illicitly read card data.
An Oahu grand Jury indicted three men last week on charges of identity theft and credit card fraud, alleging they had skimmed from four Aloha Island Mini Mart locations last September. The indictment said they returned to California, where the recorded data helped to make counterfeit debit and credit cards used to steal more than $150,000 from 156 customers at six Hawaii financial institutions.
Aloha Petroleum, which owns the four minimarts, said it constantly upgrades its fuel dispensers and card acceptance equipment in accordance with a worldwide Payment Card Industry Data Security Standard.
Richard North, Aloha Petroleum information technology director, said the company recently installed new locking mechanisms on the fuel dispensers at all Aloha stations.
Additionally, the company stopped accepting payment cards requiring personal identification numbers, PINs, at some of its locations, including the four where skimming machines were placed.
"Because we do not prompt for a PIN, it is impossible for criminals to capture it from the dispenser," North said. "The debit cards at these locations are now processed like credit transactions without requiring a PIN."
PINs are typically used with debit cards but sometimes with credit cards as well.
Officials with local banks said skimming is not a new phenomenon, but happens rarely here compared with the mainland.
The scheme the three California men were indicted in last week was bigger than anything seen by Kevin Nagata, First Hawaiian Bank senior vice president and division manager for businesses services.
"We’ve not seen any large, multilocation occurrence (such as the latest scheme), not from our perspective, anyway," Nagata said.
"Obviously, from time to time it does happen," he said. "We constantly warn our merchants to really be vigilant and try to implement safeguards."
Brian Ishikawa, Bank of Hawaii senior vice president and director of corporate security, said businesses using self-serve, point-of-sale terminals are often at higher risk of skimming theft.
Besides gasoline stations, several grocery, hardware and even big-box stores use self-checkout counters for customer convenience.
But Ishikawa and Nagata said skimming machines aren’t attached just to self-checkout payment machines.
"Any location that doesn’t have an attendant there would probably be of some concern," Nagata said. "But even a cash register location that is not occupied when a store or restaurant is closed may be susceptible as well."
Ishikawa said restaurants have also been targeted for skimming in recent years.
"It usually involves the corruption of a waiter or a waitress using a hand-held skimming device," he said.
But he emphasized that that has happened in "just a very few" instances.
"Card use is safe for consumers, and the benefit of using cards outweigh any associated risks," Ishikawa said.
Ishikawa and Nagata offered advice to merchants and consumers on how to avoid skimming.
Nagata said merchants should check their card machines frequently to ensure they haven’t been tampered with. "Make sure you are vigilant and that others don’t have access to tamper with your equipment."
They should also keep tight reins on the employees who have access to their card machines, he said.
Consumers, meanwhile, should examine self-service card machines and ATMs when using them to see whether they might have been tampered with in some way, Ishikawa said.
Consumers should also scrutinize their bank statements and credit card bills for discrepancies, Ishikawa said.
"As long as you’re reporting it to your card issuer, you’re not going to take a loss," he said.
Bank of Hawaii and First Hawaiian were among the six Hawaii institutions victimized. All the banks refunded the 156 account holders who used the compromised pumps.
The others were American Savings Bank, Central Pacific Bank, Hawaii State Federal Credit Union and Hawaiian Tel Federal Credit Union.