$300,000 Credit Card Skim Was "Model Employee" Scam
His name was "Erick," and after earning respect and responsibilities at the Arco gas station he'd been working at for 8 months, he dissapeared, leaving behind only a hidden credit card skimmer that stole $300,000 worth of debit card info from reams of customers. Police believe that "Erick," pictured, was a low-rank solider in an organized crime ring who had been given the assignment of working his way up the ladder at the gas station until he was in a position to place the credit card skimmer, a type of con known as the "model employee" scam. As a shopper, protect yourself from skimmers by only using cash, credit cards, or swiping your debit card as credit.
Russian or Armenian Mob Used "Model Employee" Con at PCH Arco [LA WEEKLY] (Thanks to Angela!)
PREVIOUSLY: Credit Card Skimmers Attack Arco Gas Stations In California
Post a comment
Comments:
You'd think it would be easier to just get a job working the overnights and install a replacement scanner that looked like the original with a removable MicroSD card.
IIRC, when I worked overnights, it was the least desirable position.
So what's the lesson for employers? Don't trust model employees? Instead trust horrible ones?
The advice to swipe the debit card as a credit card may cause trouble as well. Some card companies are freezing $75.00 or more for any credit card swipe. If the shopper pays for $20 worth of gas and swipes his debit card as a credit card and does not have $75 or more in his checking account, he could get hit with overdraft fees.
A better idea is to familiarize yourself with how the pumps look normally so you can spot a skimmer on the pump. Here is an example of what they look like: http://consumerist.com/5218680/heres-what-a-card-skimmer-looks-like-on-an-atm
@Dave J.:
I hate having my picture taken and will protest it being taken.
Guess that makes me a ccard scammer. Please don't tell the bank I work for!
@TCama: Get actual information on people and check to make sure you aren't being given a false name?
@TCama: Future headline: "Meth addict steals millions in patented Shitty, Constantly Late, Probably Stealing Everything Employee scam."
@TCama: Don't completely trust either after only 8 months, maybe.
from the article:
"Maybe I should have realized he was into something criminal, but here at the station where he worked? I've never heard of anything like this happening . anywhere."
@TCama: Trust, but verify.
Audit / inspect your equipement/books for fraud at regular (but random) intervals.
I say, if you're a model employee and not disgruntled at the fact that you're working at a gas station, owners should be suspect.
It's one thing to catch an employee giving away free gas to his friends and stealing cigarettes. A well-thought-out patiently-executed scam like this is very difficult to guard against.
@Ben Popken: yeah but then you'd have to do it for everyone or get sued. no one's going to pay for a background check on a teenager who's only working for the summer (for example). I'm with pixelantes. check your equipment.
@Ben Popken: I would agree Ben, but in today's age when you can't even give a negative recommendation to an old employee, or require them to defame themselves by saying why they left their old job, unless they had actual charges pressed, a background check might not even pick them up.
@HiPwr: Actually, in thinking about the times when I worked at a gas station, the inventory was kept under stricter control than the financial data. We did inventory audits after EACH shift.
Uhh... didn't this guy have to produce a few forms of ID to prove he had the legal right to work in the US? Did the employer actually verify these documents?
Never in my professional life have I NOT had to produce my SS card, drivers license or passport, then pass a background and a drug test.
While scammers have sophisticated ways of faking stuff, a comprehensive check like the ones I've been put through would have to weed out many of them, since I can't believe they would use their actual identity.
@Dave J.: Interesting theory. What advantages does this particular scientific method have over say... phrenology?
Well, I would use my debit card if my gas station would let me. But they don't, they have that measly $3.00 min. purchase amount and Mastercard won't do anything about it.
I guess I'll just have to shop elsewhere.
@rainbowsandkittens: You are sadly naive if you think that it's not possible for an organized crime ring to procure false documents that will pass muster with a company's HR department.
@Ben Popken: i'm not sure that's a viable solution. are we to expect small business owners everywhere to conduct expensive background checks on every person they employ or intend to employ?
the con exists because the exploit exists. what we need to do is pressure the networks to create a more secure method of processing payments. it is their lack of security that creates a market for stolen card info. & with the system in its current state, they're the least likely to do anything about it - they don't pay when fraud occurs; banks, merchants, insurance companies & (ultimately) consumers do.
if networks are unwilling to move their card networks into the 21st century, maybe it's time we put a little pressure on them.
The SSN is very easy to verify though the SSA (and free!). Any business owner or representative of the business can legally do it with permission.
@rainbowsandkittens: It's a gas station. Like most other low-end employers wanting to hire dirt-cheap labor, they aren't too picky about making sure your SSN is valid.
SirWired
@TCama: I think the lesson here is simply pay attention. The employer should be responsible enough to check their ATM machines for skimmers.
"As a shopper, protect yourself from skimmers by only using cash, credit cards, or swiping your debit card as credit."
Color me stupid but isn't the only way to protect your self from skimmer is to use cash, not to swip credit or debit cards?
@tonalanswer: Although, yes, that quote indicates too much trust, taken out of context it is from the SMOG CHECK TECHNICIAN - not a man in charge of anything anyways. At least quote the owners if you're going to insinuate they are gullible.
@rainbowsandkittens: Remind me to not apply to every place you've ever worked if they've all required drug tests. I've had blue collar, white collar, and service industry jobs, and was only drug tested for a college summer gig working in a warehouse. Still amazed I passed that one...
@rainbowsandkittens: From the original article:
"But Erick spoke English well enough to get hired at the Arco, using a fake but very authentic-looking driver's license listing his age as 32. The official, state-issued number on his driver's license turned out to belong to someone else, but the company did not pursue a deep enough background check to uncover the discrepancy."
His SSN is not mentioned in here. A LOT of people (that's a scientifically-obtained number...ha) get jobs with fake SSN's every year, companies who see a convincing drivers license or other material often don't bother to check the SSN to see if the name matches.
@AldisCabango: You must be new 'round these parts...
Credit card = chargeback! 0 liability for fraudulent purchases.
Debit card = some liability, the value depends on the bank. I think it's often around $50...could be totally wrong.
Wow, the bit (from the original article) about how they got this single picture of the guy is crazy.
And then the Consumerist would be posting articles about the absurd invasion of privacy that it is to require a background check for a job at a gas station.
@SexWaxin'_GitEmSteveDave: The original article states that he used a drivers license number that belonged to someone else. In this case, a deeper background check would have revealed this, which would have most likely lead (led? I always mess that up) to him being investigated more thoroughly, and/or not being hired.
@mac-phisto: They did a background check, just not a deep enough one. And given both scams like this and the nationwide focus on illegal immigrants in the last few years, I think companies both small and large have a huge stake in spending the extra money to do the thorough check of the individual's SSN/drivers license number/etc.
@aja175:
Actually, it means you're in the Mafia. The FBI is now on their way to your house. Please be outside with your hands up in five minutes.
@Dave J.: Hmmm, methinks you and I are the only ones that read the original article. :) Not that it's required reading, but it clears up a lot of the questions people are asking below.
@Quake 'n' Shake: I'm thinking hiring a palm-reader would be more cost-effective. Especially since they're easier to find then phrenologists.
@jaydez: True, and maybe that's the lesson here for employers. Even employers of kids who only work for the summer should do even the most basic of background checks.
But the reality is that unless a SS# or Driver's License# is invalid typically there is no cross-check against whatever name and address is supplied with that number. Unless you do a background check on the person (which I recommend as an HR person) it's not hard to fool the system. What happens is the original owner of that SS# finds out down the road that they worked at this gas station for 8 months. If they're lucky then that's all they find linked with their SS#.
@Communist Pope: You are probably in a vastly different industry than I am...the majority of the fun, high-paying jobs in my field (aerospace/mechanical engineering) require a drug test, largely because most of them are government contractors. I had to take a drug test to be an intern at a UTC subsidiary a few summers back.
Do not swipe your debit as credit for protection! The card number is still the same, you're just as exposed as if you used your debit card as debit.
Just a side note to all of you NOT in CA and reading this
"As a shopper, protect yourself from skimmers by only using cash, credit cards, or swiping your debit card as credit"
ARCO stations, which is where this guy worked, DO NOT let you use credit cards. Its debit [for a 45¢ charge] or cash only.
There is no using credit or swiping as credit there.
@katstermonster: Invasion of privacy?? I don't care what job you are getting, I think it's fair your employer have the right to require a background check if they feel it necessary. If you have nothing to hide, then what's the big deal?
@Dave J.: Actually, I know someone (and obviously, I won't reveal who) who takes great pains not to be photographed, because of two things.
First, this person is in witness protection.
Second, this person has a really vindictive ex-spouse who will track down this person down and make life a living hell.
Again, I cannot offer proof that this is so, I can only tell you that I am personally satisfied that these two statements are true.
@kc2idf:I would think not liking to be photographed would suffice. I don't like my picture being taken. I also don't like having pictures of people on display around the house. I think it's more because I get that creepy "I'm being watched" feeling.
@dragonfire81: Did you mean to respond to Cant_stop_the_rock? I said nothing about invasion of privacy. I am all for background checks as a requirement for employment.
@Red_Flag: No, because if you do it as credit you don't put in your PIN number, which is (from my understanding) how these scammers were so successful. And if you put it through as credit, I believe you still have the option of a chargeback, or at least less liability with your bank.
@katstermonster: Its the same reason alot of people can BS having a BS. If you're convincing enough the interviewer and HR will beleive it and never think to verify it.
Heck, back when I worked at Lowe's we had a guy who'd been hired and had reported for work end up getting fired 3 weeks later because they FINALLY got around to doing a background check on him. And this was a large company that took 3 weeks to check a guy's background. I'm sure smaller operations take even longer, I mean background checks aren't free.
@veronykah: Huh, interesting fact. Thanks for the heads up...it makes this story much more interesting, because it means the scammers targeted a place that they KNEW would be rich with debit purchases. Sneaky!
@katstermonster: Ew, and fail for me using the phrase "PIN number." I make fun of people for doing that all the time...
I know the consumerist has had several example photos of ATM skimmers posted up, but I would seriously be more concerned about gas pump skimmers. Generally speaking the top portion of the pump where the card reader and keypad is is rather empty. Anyone with a key to that pump could install a skimmer in-line with the box inside the building. The pump could process the cards normally and you'd have no idea that something was logging every card number swiped in that reader.
As someone whose installed POS systems for gas stations, I'll tell you right now the card reader in the pump is going to be the easiest way for someone to skim your card.
They wouldn't neccessarily have to be an employee either. Gilbarco pumps are all keyed alike, and the gas station will get so many dozens of pump keys I've ended up with a couple accidentally in my toolbox when I was cleaning up when I was finished with the install. These keys aren't hard to come by if you're savvy. Also, employees of the station will have to have access to the pumps in order to replace receipt tape.
The reason the ATM skimmers are easier to catch is that ATMs are like mini vaults and getting into one without authorization is difficult at best. The one time I ever worked on ATM equipment I was watched constantly by two armed guards from an armored car company.
I guess the lesson to learn from this story is that all business owners should, from time to time, hire someone to walk around taking photos of their employees. The employees who freak out and ask for the photos to be deleted--those are the guys to watch.