Local officials are warning residents to be vigilant in order to protect their data when using credit and debit cards after authorities found two card “skimming” devices recently in St. Augustine Beach.
Commander Thomas Ashlock with the St. Augustine Beach Police Department said the devices, which are used to steal card information at ATMs or point-of-sale machines like gas pumps, are among the first he is aware of being found at the Beach in his five years there.
The first “skimmer” was found on Oct. 19 installed on the ATM machine at the Ameris Bank in the 2000 block of State Road A1A South.
The device, according to a police report, was found inside the card reader and a separate “white strip” with a camera in it — thought to be used for recording card PINs — was found adhered to the machine as well.
The report said the device was found after the branch manager there called police when a customer said she was having problems inserting her card in the machine.
Then, on Monday, a clerk at the Circle K convenience store in the 1100 block of A1A Beach Boulevard called the Beach police saying he found a skimmer installed on a gas pump.
The clerk told the responding officer that he had observed two men walking between pumps around 1:30 p.m.
After they left, the clerk checked the pumps and located the device installed on a pump near where the two parked the white Toyota Sequoia they were traveling in.
The Beach Police Department announced in a news release Thursday evening that, with the help of the U.S. Secret Service, investigators had signed felony fraud charges on Jose Alexander Rojas Arevala, 27, and Daniel Ramon Sangiao Mendoza, 39, both of Jacksonville, in connection with the device discovered at Ameris Bank.
Arevala and Mendoza are currently in custody in Jacksonville on similar charges, the release said.
Beach Police Chief Robert Hardwick said Thursday evening that authorities don’t believe the two men were involved with the device at the Circle K.
The discovery of the two devices come about three months after Agriculture Commissioner Adam Putnam, whose agency is responsible for gas pump inspections, sounded alarm bells at a July news conference in Orlando by saying that inspectors and law enforcement officers had seen a “steady trend upward” in the use of the devices since 2015.
At the time, state figures showed 315 skimmers had been discovered at pumps through July 18. Over the same period of time in 2016, only 120 had been found.
The seven-month figure for this year far exceeded the 219 devices found in all of 2016 and the 169 found in 2015.
St. Johns County Sheriff’s Officespokesman Cmdr. Chuck Mulligan said deputies aren’t recovering a record number of devices in the county, but that doesn’t mean skimmers aren’t being used.
“The last one we had was about a year ago,” Mulligan said Thursday.
The problem with finding installed devices, he explained, is that they are very difficult for consumers to detect and, often, the people installing them only leave them in place for a few hours at a time before removing them.
That means the only way for a person to discover, in a timely manner, that card information has been stolen is to check his or her bank register on a regular basis.
“Other than that we won’t get the complaints until the end of their 30-day billing cycle,” Mulligan said. “By that time the individuals have moved on to a different area.”
The best way for consumers to prevent having their information stolen, he said, is to know what to look for.
“There are three types of skimmers that go on a gas pump,” Mulligan said.
One is the type that gets installed behind the access panel door on the pump.
The only way to detect those, Mulligan said, is to look for the tamper-proof tape to see if it has been peeled back (if it has it may read “void” or a similar message) or to see if it has been cut.
Another type of skimmer is a plastic shroud that slides over the card reader on the outside of the pump.
Those are easier to spot.
“Just pull on it,” Mulligan said.
Often times the device is only secured in place by some double-sided tape.
“See if it comes lose,” he said. “If it does, you may have just found a skimmer.”
The third type covers the entire card reading system on a pump and mirrors the keypad with a false set of keys.
Those types of devices, Mulligan said, are less typical on gas pumps and similar to the ones often found on ATMs.
Installed over the keypad, with a “hollow back,” the device not only reads the card information but records the keystrokes when the user inputs his or her PIN code, Mulligan said.
“All they have to do is come and lift it off,” he said.
Putnam said in July that he and other state officials are working to cut down on illegal activity at the pumps.
In 2016, the state Legislature passed a law that toughened penalties for credit card fraud and required security devices on gas pumps, including the use of the security tape.
This year, the Legislature passed another law making it illegal to possess skimmer-device equipment.
Putnam said the industry has taken steps to protect gas pumps from tampering, including moving away from a universal key system that allowed access to pumps in different locations, and said the newest stores and gas stations are putting technology in place that will shut down pumps if they are opened without authorization.
But Putnam said skimmer criminals are growing more sophisticated, with some now using devices where credit card data can be downloaded remotely, eliminating the need to retrieve skimmers from inside the pumps.
“Unfortunately, like many forms of criminal activities, the bad guys continue to evolve just like the laws continue to evolve,” he said.
This story contains reporting from a July News Service of Florida story by Lloyd Dunkelberger.
St. Augustine Record