GAS PUMP SKIMMER PROTECTION S.B. 415:
ANALYSIS AS ENROLLED
Sponsor: Senator Wayne Schmidt
House Committee: Commerce and Trade
RATIONALE
Credit card skimming is a type of theft in which small devices, called skimmers, are used to steal credit or debit card information in the course of an otherwise legitimate transaction. When a card is passed through a skimmer, it captures the information contained in the card's magnetic strip and stores the data for subsequent retrieval and use. Skimming devices can be employed in a variety of retail settings, including at a fuel pump. Since 2015, approximately 82 skimmers have been found in the State, according to the Michigan Department of Agriculture and Rural Development. Reportedly, many pump owners and operators are implementing measures to deter those using skimmers from placing them in the pump, or are making it easier for customers to detect a compromised pump so they do not use it. However, adoption of such measures is not compulsory, and some gas station owners have opted not to implement them. To address this situation, it has been suggested that fuel pumps be required to include additional security measures aimed at preventing skimming.
CONTENT
The bill would amend the Motor Fuels Quality Act to require fuel pumps to include security measures to restrict the unauthorized access of customer payment card information.
The bill would apply to a pump for dispensing motor fuel for sale at a roadside retail location that includes a scanning device for reading a customer payment card as an integral part of the pump. The pump would have to include a security measure to restrict the unauthorized access of customer payment card information, and the security measure would have to include one or more of the following:
-- Pressure-sensitive security tape imprinted with a customized graphic and placed over the panel opening leading to the scanning device so as to restrict unauthorized opening of the panel.
-- A device or system to render the pump or the scanning device inoperable if the panel were opened without proper authorization.
-- A means for encrypting the customer payment card information in the scanning device.
-- A device to replace a manufacturer-supplied standard lock.
-- Any other measure approved by the Department of Agriculture and Rural Development.
The bill provides that if the owner or agent of the owner of a pump received a notice of noncompliance, he or she would have to bring the pump into compliance. If the violation were not corrected within five days after receipt of the notice, the Department could prohibit the use of the pump until a properly functioning security measure was installed on the device.
The bill would define "customer payment card" as a credit or debit card or other card encoded to provide an electronic means for initiating a fund transfer from the customer's deposit account or for initiating electronic billing.
"Scanning device" would mean a scanner, reader, or any other electronic device that is used to access, read, scan, obtain, memorize, or store, temporarily or permanently, information encoded on the magnetic strip or stripe of a customer payment card.
The bill would take effect 90 days after its enactment.
Proposed MCL 290.628f
ARGUMENTS
(Please note: The arguments contained in this analysis originate from sources outside the Senate Fiscal Agency. The Senate Fiscal Agency neither supports nor opposes legislation.)
Supporting Argument
The installation of payment card skimming devices at gas pumps has become a concern in Michigan. Electronic skimming devices can be installed within seconds, and are relatively easy to hide inside of gas pumps. Such crimes are made easier by the existence of universal master keys (for gas pumps) that can be purchased by criminals. An offender can use a key to gain entry to a pump's scanning mechanism, to install the device. The criminal returns later to retrieve the stolen information, which can be used to make fake credit cards and fraudulent purchases. Approximately 82 devices have been found in Michigan since 2015; these include three devices found at several Howell gas stations in June 2017. The bill would require gas station owners and operators to implement greater security measures to help protect consumers, which would decrease the threat posed by credit card skimming devices.
Legislative Analyst: Jeff Mann
FISCAL IMPACT
The bill would have a minimal fiscal impact on the Department of Agriculture and Rural Development, as the Department would be required to approve pump security measures and monitor and respond to noncompliance with the bill's provisions, activities supportable by existing departmental resources.
This analysis was prepared by nonpartisan Senate staff for use by the Senate in its deliberations and does not constitute an official statement of legislative intent.