Understanding Gas Pump Credit Card Skimmers

Nate at SparkFun recently added a fascinating new piece to their Tutorials section. The article offers a fairly deep dive into a teardown of three credit card skimmers (clandestine devices hooked up to gas station pumps by crooks to grab CC info from hapless citizens gassing up). These devices are also found on ATMs and other credit card-equipped machines.

SparkFun has written about skimmers before, including about the time they got a law enforcement subpoena from the state of Georgia because SparkFun components were found inside of some of these devices. About the new piece, Nate writes:

The difference here is that this time the local governmental agency politely asked for help and we’re always down for trying to put a stop to bad actors.

We were given three skimmers found installed within gas pumps with the request that we try to get the data off the board so that the agents could let those who’ve had their credit card compromised know so they can get a new card. Not great, but it’s a start.

Second task: Can we build a jig or system so that they can more easily poke at these systems in the future. We were able to accomplish both as well as build an app that detects known skimmers in the area. You can get the free Android app here from google play – search for the name ‘Skimmer Scanner’ from SparkX.

The front of the board is composed of a PIC Microcontroller 18F4550, an SPI EEPROM part #: M25P16 which is a 16Mbit flash memory, and a standard LM1117 3.3V regulator.

Besides going into the components used and how these devices function, the piece also includes some fun stuff like evaluating the build quality of the three devices that LE supplied to SparkFun. They also point out other interesting tidbits, like one of the devices is numbered (no. 46), likely to keep track of all of the skimmers in circulation by this particular data criminal.

You can read the full piece here. And you can download the Skimmer Scanner locator app that SparkFun created here. The app doesn’t interact with the skimmer or alert LE or anything, it just alerts you to the fact that a skimmer is nearby.