Schneier on Security

I frequently hit the $75 limit on my credit card at my local gas station, as I drive a pick-up with a 32 gallon tank. I live in Oregon, where we can't pump our own gas, so the limit is pretty pointless. All I need to do to get around it is have the attendent run the card a second time.

Totally pointless security.

I'd never realized the bit about no human interaction being required. I always figured it was because if the card was rejected, they could just pay cash, as it was something they were going to have to buy anyway. Do the gas pumps have a credit card machine built right into them in the US?

How do gas station attendants know someone hasn't just filled their tank, swiped some piece of cardboard, fiddled with the machine a bit, and left? At least when they have to come in to pay, the attendants can tell who's left without paying, and try to catch their plate numbers.

I guess I should read the article first, eh? I see now - the transaction is authorized first, then charged only after the amount is known.

Seems like a rather circuitous way of buying gas...

dragonfrog,

You must not live in the US. Potential gas thiefs are deterred in the US by the a sticker placed prominently on the gas pump of a grim looking state trooper who states they will take your driver's license if you steal gas. Ironically, it doesn't mention the penalty for the inevidable graffeti/vandalism that the sticker usually attracts. (sarcasm liberally applied here)

Most gas stations have cameras some where to capture license plates (typically, though they aren't going to go after a single drive off but an "easy mark" gas station will see a rash of thefts and then the cops move in and do "sting" operations). Some require you to come in and "pre-pay" even with a credit card, others require you to come in and pre-pay if its a certain times of day (like at night where the outlying pumps are harder to see).

I come across this constantly. One station on the island always stops at $50. Second swipe and keep filling.

The other three stations have no limit. Seems pointless that the station has set the controls, not the bankcard (Visa) in this case.

The result is that I seldom buy gas at the limited station. Their loss.

Recently my credit card was flagged for fraudulent charges. It was "an automated fuel dispenser and transportation charge" in CA, and Ontario. I did not authorize the charges...FIA caught it at two charges both right under $100. I'm a college student who had had the account for almost 4 years and this is the first time my card has been flagged and / or compromised.

My past spending must've made it easy for them to detect.

True story:

I hit the $75.00 limit on my 25-gallon tank at a Shell station in Bothell, WA last year. I swiped my card a second time, topped up the tank, and went on my way.

A couple of days later, my card stopped working. I called Bank of America to ask why.

"Shell reported your card stolen," they told me.

As a result, whenever gas prices go over about $3.40/gallon, I choose to pay inside the station so that I can fill my entire tank without risk of having my card shut off.

I think the point of the cap is to limit the fraud.

The way I understand it, authorization is usually for a low amount to validate the card is active (e.g. USD $1.00). Then the card is settled at the actual amount of the transaction (e.g. USD $75.00)

If the settle exceeds the capacity, then the re-auth won't work.

Why auth for low amount? Because the auth essentially reserves part of the card balance for several days, and cannot be canceled by the merchant. The complaints from customers who have an additional $65 held off their card for a $10 gas charge, aren't going to be happy.

In short, its a trade-off -- they cap their risk at $75 rather than annoy customers (but with rising gas prices they still are) and also allow the convenience of pay at the pump.

I was under the impression that the charge limits were related to the authorize, then pump, then charge process that occurs. I don't think it really has to do with security... In other words, when you swipe your card at a gas pump, knowing that your card is 'valid' is not enough. The gas station also wants to know that you have enough money in your account to actually cover the cost of the gas you pump.

But they don't want to waste time or go over your limit by authorizing for too much money (which would require them to step down the authorization amount and try again). So they have to pick some amount that is more than most people pump, but not so much that it will overdraw people's accounts... and $75 to $100 is typically enough.

The same thing happens at restaurants, where the waiter will authorize your card for the cost of the meal, hand you the receipt, then place a single charge on your card for the cost of the meal plus your tip.

The amount of the limit is the retailer's choice. Wawa (a PA based convenience/gas retailer) originally had a $50 limit on their pumps last year. When gas prices rose so much, they have raised it up to at least $75

The issue here is how high of a transaction the retailer is willing to deal with losing a dispute over in favor of faster throughput at the cash register (or the pump).

A couple of local grocery stores around me have instituted $25 and $50 minimums before they will ask for a signature (even though they have a signature capture device at every register and don't need to deal with paper anyway). Home Depot has at least a $50 minimum, and I think they are experimenting with a $100 minimum.

Without the signature, the retailer is almost certain to lose a dispute with a customer who claims they didn't make the charge. BUT having worked in retail for a long time, I can tell you that most cashiers NEVER look to match up the signature as they are supposed to, so the signature doesn't prevent fraud anyway.

The floor limit allows the store the benefit of increasing throughput at the register while still providing a cap to the potential losses from any single fraudulent transaction. Is it an effective way to STOP fraud? No. But it is an effective way to improve throughut at the register without increasing the exposure to fraud exponentially.

Now, as far as being flagged for possible fraud by your bank - that is most likely just a byproduct of the smurfing that people have to do in order to get around the floor limit. When the credit card companies see smurfing, it raises all kinds of flags in their fraud detection software.

Whoever programmed the gas station fraud detection didn't think about location correlation. At least, whoever programmed the AmEx one.

I frequently go on road trips to LA, about 500 miles away from where I live. I'm able to purchase dinners out no problem. However, on the last trip, I couldn't use the card at *any* gas station. It was rejected (which is one reason I always have another credit card of a different company) because I don't live in LA (according to the company). Yet the multiple dinner purchases went through no problem.

OK, I worked in a gas credit card operation for a while (waaaay back). It really is more to do with how a credit card works. You swipe your card, the gas station puts a hold on say $50 of your credit, the credit card company approves the hold (yes you have money and I've earmarked some of it for me!). The station then approves the pump up to the amount they put on hold. You pump gas. They 'complete' the transaction for the actual amount (say $30). The credit card company eventually releases 'excess amount' ($20) back to your line of credit. (note: the 'release' is usually quick, however if you are near your line of credit and I hold $50 and you pump $20 then immediately try to pay for dinner, you may get a reject at dinner if the excess hasn't cleared.)

So, here is the game. If you are near your line of credit and I attempt to 'hold' too much I get a reject, you don't get gas, and I lose a sale. If I attempt to 'hold' too little either I take a risk if you pump more or I set the pump to the amount already approved (and I'm NOT taking the risk) and risk you hitting the limit. If you hit the limit you can reauthorize (a new hold) or decide you have enough. Either way I still have a sale.

Now if you hit the limit too often at my station but not the one down the road, I lose custom to the other guy (the 'bother factor'). Given that I own one or two stations I have a few choices on how I set the hold amount: I can guess, I can accept the limit that came with the software as packaged, or I can hire my own team of researchers to determine the optimal hold point and rehire them each time gas goes up (oh and several other choices like survey my competition, I'm sure I can just call them). Your particular station management is probably doing what most do, leave it alone until it becomes too much of a pain then up it say $20 and see what happens.

@dragonfrog and others outside U.S./Canada;

Yes, there is a card swipe reader in the pump.

Here's the usual workflow for gas on credit...

1) drive up to pump
2) swipe credit card - initial credit transaction check done
3) pump gas - limited to certain amount
4) return pump handle - final transaction is done
5) take receipt and leave

It's slightly different on debit with PIN...

1) drive up to pump
2) swipe debit card, select pre-auth amount - initial debit transaction check done
3) pump gas - limited to pre-auth amount
4) return pump handle - final transaction is done
5) take receipt and leave

It's slightly different AGAIN with cash...

1) drive up to pump
2) make sure cash is accepted -- often can't be done late at night. May have to pre-pay inside, then pump.
3) pump gas - may be limited to pre-pay amount
4) return pump handle
5) if not prepaid, go pay

Note that depending on your locale, station staff may need more or less involvement. Apparently (see above) in Oregon nobody pumps their own gas. In Ontario, a person at the station must authorize the dispense by remotely unlocking the pump just before the pumping point in the workflow.

Finally, Bruce, if you read carefully, the limit is there partly to protect the *merchant* from a liability shift. Above that amount, it sounds like the merchant would bear the liability for fraud.

A few years back, I had a major CC provider phone me to confirm that it was I making frequent high volume fuel purchases on my card. I was fueling up the family vehicles and a boat often enough. I mentioned I did this often, but was quite consistent with the stations I used. They made a note, no other issues.

The merchant bears most risk of anyone in credit transactions, either stolen card or customer denying they got what they paid for. The limits on credit card risk is for the holder of the card.

Suspiciously enough, Visa's $50 limit at gas pumps is exactly the same amount that consumers are liable for under the Fair Credit Billing Act if the charges are unauthorized.

I think requiring a PIN entry for all gas purchases--be it credit or debit--may be an improvement. Not perfect, but it makes it much tougher for someone to use a card that is lost or stolen.

I remember a blog a while back regarding the ability to electronically read license plates. Perhaps they can eventuall do this at gas stations, and associate a license plate with the credit card used. At least that would provide some trail as to who used it, and help the card holder determine if it was legit or not (i.e., he doesn't remember getting the gas, but it was his license plate at the pump). Fraudsters may be less likely to do so if their card could be traced. Just a thought (that is probably full of holes too).

Urox - the difference is that the gasoline transactions are pre-pay, while the dinner transactions are post-pay. Why Amex has different rules I can't say. I'd call them and harrass them big time if you travel frequently - while it's reasonable for them to start flagging transactions and make some phone calls, it's highly unreasonable for them to deny transactions that they don't have an direct evidence of being fraudulent.

At my local gas station (in rural New Jersey) there is a debit card reader and keypad on each pump. When people hand him a debit card, the attendant casually asks them for their PIN so he can key it in. He says they always tell him the PIN. He didn't seem to think this was unusual at all.

When I purchased my laptop, my credit card was rejected and I had to call the company. They said that since I had purchased gas earlier in the day, they needed oral authorization for the higher purchase. I think that is where it comes into play. The theives test on the gas, then they try for the high cost item(s).

can verify that gas was the first purchase when I lost a card and it was used fraudulently. I tried to see if the police could look at the security camera and get the license plate #, but they couldn't be bothered. Case load, small $ amount, ...

If the gass pump is such a common 1st stop after a card is stolen, seems like it would be easy to nab lot's of fraudsters matching plates with pump transactions. Even if the gas purchase is not that much money the subsequent purchases might get on the police radar. Security camera focus and time stamp required.

My wife's job is looking at CC Transactions to see if there has been any fradulent activity. The first thing she was taught to look for, was a charge at a gas pump, that was not normal for the history, as more times than not, it is stolen, and the thief is just using the pump to make sure it not only works, but has at least the limited ammount free.
So, i can see where a higher-limit though more convenient ceiling, could make all the fradulent users happy. Really is a trade off, of Security Vs. Usability.

I recently moved to the UK and it still amazes me that they still only have the old "pump gas then go inside to pay" system everywhere. You often have to stand in line^H^H^H^H a queue for several minutes all the while blocking one of the pumps. This is true even at motorway stations and stations that are conveniently located right at on-ramps where presumably people are trying to get somewhere quickly.

I'm not sure if it's because they hope people will buy stuff in the store or if it's some EU regulation against efficiency or if it's just one of those quaint traditions they have here.

There can be problems on the other side of the usage spectrum, too. Since motorcycles have very small tanks, filling one up doesn't cost very much. So it's hard for the card company to differentiate between "someone with a stolen card travelling and making small purchases to check that it's still valid" and "someone with a valid credit card travelling and making small purchases to refill their motorcycle tank."

Having one's credit card suddenly stop working because of fraud suspicions on the part of the company has occasionally happened among the long distance motorcycle travellers I know.

Jeez people, it's simple. Under federal law, you are liable for the first $50 fraudulent charges. By forcing you to use two separate cards, they make it so you stay liable for all the charges.

http://www.ftc.gov/bcp/conline/pubs/credit/...

I think it's all a way of getting SUV drivers to buy a smaller car that uses less gas. It's a conspiracy by the environmentalists against gas guzzlers. :)

Lucky for me, even at $3 / gal, I can't fit more than $40 in my tank.

Some of the stations near my house have started to require you to enter the zip code for the billing address associated with the card.

Filling my last car was hitting the £60 limit at my local supermarket, over $110. Comparing with US limits mentioned above, this does suggest they are adjusted to suit local conditions so they are rarely annoying.

Uhm, apparently the US still hasn't decided on when to go for chip-and-pin?

Note that requiring the PIN for all magnetic strip card transactions is doomed to fail. That mode of operation relies on the trusted terminal assumption, which just isn't true for point-of-sale terminals... If you go down that route, you will have massive scams involving real-time copying of magstripe data and PINs at the terminals.

Ahhh, typical yanks. Talking about security and shit but failing to see the underlying issue. Why use credit cards at all? Why involve a third party (and even pay them shitloads of money!) in a two party transaction? Always railing about freedom and rights yet making themselves slaves of the banks and freely handing out all their most sensitive data without thinking twice about it. And when there is a problem they call their master and beg him to make the plastic work again. All in the name of convenience of course.So totally devoid of, like, you know, COMMON SENSE, yet so American...
Fuck plastic.

@Gerg

Any big supermarket which also sells fuel will have a "pay at the pump" option these days. My experience is that they're unreliable and more hassle to use than paying inside. ( Aside - supermarkets are also a *lot* cheaper than UK motorway service stations who have a captive audience and hike the prices accordingly. Not the case for France where the autoroute prices are quite competitive )

You'll also see warning signs about your vehicle licence plate being photographed. Whether they are or not and if anybody ever gets caught is another matter. I think that the cameras were installed mainly to deter "drive off" thefts, i.e. fill your tank and then drive off without paying.

@Gerg

It's not an EU regulation or a 'quaint' tradition, it's where you're buying petrol. Try Tesco's, at the one closest to me you've had the choice of pay at the pump or inside with the cashier for a good two or three years now.

Here in .de it's still common use (95+%) that you pump first, then go in and pay at the cashier. Only a few gas stations in much-transited cities offer EC card readers, and even less take credit cards to keep the business running at night when the station is closed.
I've never thought of that system to be a bottleneck, as our gas stations usually have enough pumps that you have one or max two cars before yourself. Some stations have introduced parking lots where you put your car to free up the pump, but have found that this encourages people to drive away without paying (subconscious action? "I'm driving again, so I must have paid.."). Besides, this doesn't solve the bottleneck, as the pump is only unlocked after the price has been transferred to the cash register.

$70? In the UK the floor limit is usually £70 (~USD 140)...!

Some of the newer devices here use chip and PIN in addition to a floor limit; unfortunately many of the devices seem to be specially designed to make it easy to fit false fronts for card cloning!

'Pay at Pump' has been around in the UK for a while, but does seem to have gone out of fashion a bit. Probably due to fraud.

I have also encountered it in France, though prior to chip and pin the pumps wouldn't accept UK credit cards which made it almost impossible to buy petrol on a Sunday as most stations are not staffed then.

Purpose of the limit? As suggested I think top limit cc companies losses more than anything else.

This is the real reason credit card companies accept a fairly high level of fraud (actually less than 0.2%).

Legitimate customers get really hacked off when the card doesnt work.

There is a real cost to the CC company for false positives. Customers switch to other cards, start using cash again, in extreme cases cancel the card.

Amex has the tightest fraud controls which may or may not explain why it has the smallest (and shrinking) share of the card payments market.

I live in UK and use Egg card. They seem to have a pretty useful process for checking fraud - I once paid £200+ for a train season ticket, which I had never done before, and they phoned me a few minutes later on my mobile phone to confirm that it was a legitimate transaction. I thought that was pretty cool way of handling the situation - if I had stated I didn't make the transaction, they'd have cancelled my card within 5 minutes of the first unauthorised transaction, saving them money, and me hassle.

Dam you guys have HUGE gas tanks......

I never use debit at a gas pump/station. The devices are less secure than ATM/ABM and the Secure PIN entry devices used on our debit network. The CC liability policy will work in my favour if there is a dispute. Why make it easy for the crooks!

BTW, Canada is implementing EMV Chip Cards on the national debit system called Interac right now. Merchants are upgrading their POS systems.

Canadian CC issuers will follow, but without US buy in the stripe will be around for a while. And sadly, our current CC fraud will too.

Once Canada is stripeless, the fraud will shift south of the border.

Lastly, I have two concerns about EMV. First, personal risk from more aggressive theives. Second, liability shift in the event of successful fraud. In the first case, the effect will likely be small until the US goes EMV and stripeless. In the second, I may consider erasing the stripe on my EMV cards to reduce my risk.

...Amex has the tightest fraud controls which may or may not explain why it has the smallest (and shrinking) share of the card payments market....

Well, _I_ am no longer an Amex customer because multiple times in succession they just didn't bother to send a bill, then stacked on rather large late-payment charges, then mishandled _that_ (mis-state the current amount, claim to accept payment in full, then slap on a multi-dollar late-payment charge for the two cents in interest accrued while the check was literally in the mail).

But mostly because I got the card in the first place for their single-use-number feature, for e-commerce, which they promptly abandoned. Since I always pay in full, they probably said "good riddance" :-)

Meanwhile Visa blocked my card without even calling me, due to (apparently) a railway ticket agent cancelling and re-entering a ticket purchase. Then kept me on hold at international roaming rates for 1/2 hour to get it un-blocked. They're all scum, but try using cash these days in the U.S. Might as well be wearing an "I am a terrorist" tee-shirt.

@MikeA: "They're all scum, but try using cash these days in the U.S. Might as well be wearing an "I am a terrorist" tee-shirt."

Cheap shot.

Wouldn't this apply to petrol more so? gas is a fraction of the price ...

the gas limit is not to prevent a thief from getting more gas, rather, it sends an alert to the CC company as a potential there is a theft involved. If you already filled your gas, why would you do it again? So there must be a DIFFERENT car, which more likely to be a thief's car.

i have a gas station with out side credit
card transactions,i receive charge backs
from visa for transactions over $50.00
visa does not attempt to bill customers
for same and wait for a challenge from
customers.they claim i have no redress
on this. would like input .

Think the way most pay-at-pump systems work is with "pre-auth" transactions. This is where merchant bills your card for an amount that they guess you may spend, so blocking the funds on your card. They then have up to 15 days to present the real (auth'd by you signing or entering pin number) transaction. The real tx should quote the original auth number from the pre-auth tx and so replace the pre-auth funds block with the real tx amount. As days can pass between the real tx getting to the cc company and the online pre-auth, and you could use up the rest of your credit by then, the merchant is only guaranteed the original pre-auth ammount or the real tx amount (whatever's the lower). So for most UK pay-at-pump machines you must have at least £60 available credit on the card you use at the pump even if you are only going to put £15 in the tank, as they normally will pre-auth for £60 and convert to the correct lower amount later.

I started to use pre-pay cards and cards connected to my bank account in place of credit cards (i.e. no credit - just my own money). But big problem I've found is with hotels. They never match the pre-auth to the real tx, so locking up £100's & £100's in pre-auths for up to 15 days. Have tried not giving them the card until I check out - but guess how well that goes down!

Big winner with this pre-auth system is the cc company. They have little risk by only guaranteeing what they have locked in your account that you must PROVE you didn't spend if you dispute it, and for most tx's they hold on to your money for 15 days (as they only give the merchant money from real tx's - some while later).

Why do the service station attendants lie about who sets the limit. They always blame the credit card company. The credit card company always blames them. Who do you believe? I think it's individual to the station you are dealing with.

Feb 19th I stopped at a Marathon station and purchased $25.00 in fuel and placed it on my creditcard at the pump. That evening when I got home there was a message on my phone from the manager of the station that i had drove off without paying and they had contacted the police. My wife and I could not believe it. I found the reciept in my wallet and went to show them that I had paid but the station was closed. We were very upset and never slept all night. finaly the next day I took the receipt to them. If I had not found that reciept, this would have cost me jail time and thousands of dolllars in legal fees. Since this was dispatched by the police some people think I really had stolen the gas.This could have given me a heart attack. Is there anything I can do about this? Kip

Kip

tell them to shove off. they can get f'd for all you care... they want to charge you with a crime then you can sue the bajeezus out of them.

Kip

i also forgot to mention... they are idiots. i don't know where you live or what gas station you went to... but in order for the pump to pump out any gas it has to be paid for ahead of time (going in with cash or swiping a card). these arent the olden days anymore that station manager must have been a complete retard.

Wow my heart goes out to all those poor credit card companies getting ripped off from those heartless credit card fraudsters. I had my card charged for something I didn't charge it was no big deal, just had to call the card company and cancel the transaction. It was way less of a hassle than a traffic ticket. I have little or no sympathy for banks, credit card and gas companies, they rape us for billions daily compared to the petit thieves stealing gas. I know you say we have to pay for it in higher credit card rates but we have to pay higher for everything rent, gas the executives expense account, the politicians
and the war in Iraq, I rather pay a few more pennies for a smal time crook than all the big money to the big time crooks which are politicians,oil companies and credit card companies who are loan sharks with a license not to mention parasites who get a percentage from every merchants transaction. Guess who pays for that we do. 3-7% more. Credit card companies have a license to steal! Screw them!!!

I've been working with the corporate management of my local gas station on trying to understand who sets the limits and who does not.

This much I did find, there are different limits for security reasons for PATP (pay at the pump) versus coming inside, the latter usually having security cameras.

But the PATP limits vary by card type from $75 for Visa to $100 for most others. Some fleet oriented credit cards have higher limits. I was forwarded a TIF file from Exxon-Mobil's Point of Sale Technologies division with this listing of credit limits.

But my bank and MasterCard both deny setting these limits, pointing to the 'acquirer' that provides the technology between the retailer and MasterCard. I'm still trying to understand who that entity is.

You make mention of limits, but not that if you swipe your card at the pump, this is a non-disputable charge. Why?

Along with all this...the new twist is I cannnot swipe my Visa card twice. I have a one ton van with a 35 gallon tank, I fill between $80 and $100 (depending on the price of fuel) I used to be able to swipe twice and now it says I have to go inside and see cashier. I have my 3 little one with me most of the time...not condusive to bringing them into a crowded gas station and waiting in line...;-) So...I've had to split up my purchase between 2 diferent CC's. What an inconvience...

My credit card was recently stolen and the $75 DID NOT help at all. It is really pointless. He just reran the card a couple more times. I guess the only thing I can think postivly about this is, he had to use it a couple times so there is 4 charges against him instead of just the one. He used it at 2 different stations and at the station he used it 3 times they will not give the detectives a picture. They just ignore his calls and happens to never be in when he goes there. The other gas station a BP has been wonderful. SUNOCO sucks!!

I bought $16 in kerosene at Raceway in NJ in March. They don't use signatures for their receipts. In NJ it's full serve so an attendant swiped my card. My credit card statement showed the $16 plus an additional surprise charge for $190 from Raceway right underneath. Visa didn't impose a cap. They removed the $190 charge but put it back because I didn't report the card lost or stolen (isn't an unauth charge considered one or the other?). I then went to Raceway. They said the card was swiped twice -- once for kerosene, once for diesel (not that I've ever bought diesel) and there's nothing they can do. Their records "prove" I was there spending $190. This is a huge mystery. Any ideas????

>>> I bought $16 of kerosene ... plus an additional surprise charge of $190.

What if the attendant (NJ is full service only) swiped your card to sell you the $16. of kerosene, pumped it, then swiped your card again and after you left a friend's truck pulled in and was filled up with $190. of diesel?

Still disputable I say.

>>> purchased $25.00 in fuel and placed it on my creditcard at the pump. That evening when I got home there was a message on my phone from the manager of the station that i had drove off without paying and they had contacted the police.

I wouldn't drive back there to show them the receipt. Rather I'd call them and tell them they can drive over and see me and I'll show them the receipt. Or sue for false arrest if needed.

>>> He just reran the card a couple more times. ... the station he used it 3 times they will not give the detectives a picture. They just ignore his calls and happens to never be in when he goes there.

Guess some gas station wants to be out 3 times $75. or $225. in chargebacks rather than try to catch the crook. If a station makes 20 cents above wholesale for every gallon of gas it pumps then it would have to sell 1125 more gallons of gas with no further credit card fraud over the next so many days just to recoup that loss. Or could witness intimidation be involved?

Someone used my card at a bp and spent 30 dollars then went on a shopping spree of about 750 dollars. In nj do they investigate these crimes and will the person get caught? I read that investigations were rarely conducted for crimes less than 2000 dollars.