Crime by numbers

Fuel buyers could be forgiven for feeling uneasy next time they hand over their plastic at the filling station.

Last year 60% of the 250 credit card fraud ’hot spots’ in the UK were petrol forecourts, according to APACS, the UK payments association, and the problem was recently highlighted when an international scam, believed to have been funding Sri Lankan rebels, was discovered.

It’s thought that millions of pounds were taken from credit and debit cards after their owners used them to pay for goods at petrol stations. Staff copied data on the magnetic strips and also took their PIN numbers - sometimes by filming customers using the keypads on temporary over-head cameras, put up when the site owners were away.

One victim, via a news website, said: "My credit card was skimmed at our local BP garage before Christmas, along with lots of other people’s. They had set up a CCTV camera to watch the PIN numbers being entered, and were skimming the magnetic strips behind the counter."

Sri Lankan authorities have accused the Liberation Tigers of Tamil Eelam (LTTE) of masterminding the scam which has hit anything up to 200 petrol stations around the country.

Maxwell Keegal, the first secretary of the Sri Lankan High Commission in London, says Tamil Tigers were cloning cards to fund attacks in their home country. He believes terrorists lent asylum seekers money to set up petrol stations and newsagents, then forced them to use skimming machines or work with employees to carry out the cloning.

It’s rumoured that some staff were approached by fraudsters with suitcases full of cash.

Police began investigating when thousands of motorists reported money disappearing from their accounts - usually to countries such as Egypt and Thailand - after using their cards at independently-run petrol stations in Leeds, Hull, Edinburgh, Norwich, Bury St Edmunds, Peterborough, Bristol and Nottingham.

Ray Holloway, director of the Petrol Retailers’ Association (PRA), said: "Instances of fraud like this happen spasmodically, but not in a huge number of sites.

"Organised gang crime is prevalent in countries that are new to the EU, and it is finding its way here. But you can’t say that it’s any particular nationality involved - we have a very cosmopolitan industry."

Although there are a large number of Sri Lankans working in petrol stations, most are employees rather than owners, according to Holloway. He believes that only 60 forecourts were involved in the scam and insists it can’t be assumed the staff were all Sri Lankan. "We should assume the bulk of this has been addressed," he added.

A BP spokeswoman reports that about 20 of the oil giant’s 1,300 sites have been affected by complaints of card fraud in the past six months, and it has studied shift patterns and receipts to try and pinpoint any corrupt employees. She added that BP does not know if Sri Lankan staff were particularly involved but admitted: "We believe the incidents are linked to international crime."

APACS says the introduction of Chip & PIN has made it more difficult for fraudsters to commit card fraud in the UK, with losses at UK retailers falling by £146.7m over the past two years. However, criminals are still copying the magnetic stripe data on cards to create counterfeits that can potentially be used in countries that haven’t upgraded to Chip & PIN. This has caused an increase in fraud-abroad losses over the past 12 months - up 43% to £118m last year, while counterfeit (skimmed/cloned) card fraud also rose 3% last year to £99.6m.

Forecourts are particularly vulnerable to card fraud because of their high turnover while many petrol stations are independently run which can make them the target of organised crime - the sector attracts transient staff, and fraudsters can easily move from area to area.

Holloway says owners should examine their own pay points regularly and make their staff aware that they’re doing it. They should also make surprise visits, especially during the night. BP has upped security at its sites recently and is looking at ways to make inputting numbers on keypads more secure while Shell insists that it works with its retailers to promote best practice and makes sure its equipment exceeds security standards.

APACS director of communications, Sandra Quinn, suggests that customers ask for the PIN terminal rather than handing their card over to forecourt staff.

Susie Hawkins, partner at the Gloucestershire-based Simon Smith Group, is meticulous about checking staff references and making sure engineers have the right credentials. "Staff aren’t allowed mobiles at the tills and we also regularly check ceilings to make sure no cameras have been installed," she said.

But according to the PRA, consumers themselves need to do their bit to help prevent fraud. "Motorists are just too casual about entering their PIN numbers and should use one hand to cover what they’re doing," said Holloway.

Some seem to have a particularly cavalier attitude to security, which could put them more at risk. Robin Stanton, who owns Gogerddan Garage in Wales, regularly has about 10 cards behind his counter which have been forgotten by customers - mostly pensioners. "I trust my staff but these customers often don’t realise they’ve left their cards here until they come in the next week. It’s pretty irresponsible and leaves the whole system open to total abuse."

Holloway does not believe that the industry should be unduly worried about recent events and reckons that if the petrol stations involved are identified, it may well affect them in the short-term but it won’t be lasting. After all, adds APACS, most people aren’t the victim of card fraud.

However, this has all evidently had an impact on some customers, as one fed-up fuel buyer posted on a news website: "I had my card skimmed while using a BP garage - a total of £1,200 was taken from my account. I will never ever buy fuel from BP again - I now only buy supermarket fuel - which I consider to be a safer option than franchised companies."

Just as worryingly, there have been reports in local papers of forecourt staff suffering verbal abuse from angry customers.

Card fraud is many retailers’ worst nightmare. Paul Deary, group operations manager at James Graven & Sons, said: "We check our Chip & PIN terminals daily to make sure they haven’t been tampered with and check staff references, and thankfully it’s meant that we have never been targeted by these scams. It would be terrible PR if we had though - it would only take a story in the local paper and I’m sure you’d see a big drop in sales."

----

=== Credit & debit card fraud losses ===

Fraud Type 2005 2006 (% change)

Counterfeit (skimmed/cloned) card fraud £96.8m £99.6m (+3%)

Card ID theft £30.5m £31.9m (+5%)

Fraud on stolen or lost cards £89.0m £68.4m (-23%)

UK fraud £356.6m £309.8m (-13%)

Fraud abroad £82.8m £118.2m (+43%)

Source: APACS