Computer scientists at UC San Diego and the University of Illinois have developed an app that allows state and federal inspectors to detect devices that criminals install in gas pumps to steal consumer credit and debit card data. The devices, known as skimmers, use Bluetooth to transmit the data they steal.
The app, called Bluetana, detects the skimmers’ Bluetooth signatures, allowing inspectors to find the devices without opening the gas pumps.
The researchers found that, compared to similar apps currently available for smartphones, Bluetana is likely to discover more skimmers and produce fewer false positives.
The app uses an algorithm developed by the researchers to distinguish skimmers from legitimate Bluetooth devices, based on the results of a field study, during which researchers analyzed Bluetooth device scans by inspectors at 1,185 gas stations.
In one year, Bluetana has helped discover 75 Bluetooth-based skimmers, which were all recovered by law enforcement.
“We were surprised that there were so many skimmers in the field that had not been discovered by other detection methods, such as regular manual inspections,” said Aaron Schulman, a UC San Diego assistant professor in computer science. “We even found two skimmers that were installed in gas pumps and had evaded detection for six months.”
Skimmers offer a high return for criminals. Skimmed card numbers can be used to withdraw cash and make expensive purchases. A skimming device costs $20 or less to manufacture and can bring in more than $4,000 per day.
To install the skimmers, thieves break into the pumps, often with a universal master key. Skimmers are connected to the keypad and magnetic strip reader, allowing the devices to collect customers’ card numbers, their billing ZIP codes and PINs.
Bluetana take three seconds, on average, to detect a skimmer. Law enforcement can take 30 minutes to perform the same task.
As more gas stations adopt payment systems exclusively for credit and debit cards with chips, criminals will use technologies to capture their information. Visa and MasterCard are mandating that all gas stations in the United States use chip-based systems by October 2020. Read more.