This is the second of a two-part article taking a look at the issue of sophisticated fuel theft for both card lock and retail operators. This article focuses on some experiences in the retail sector.
Fuel theft at retail sites is hardly anything new. Perhaps the most common area of concern is the traditional drive off where the customer fills the tank then drives away without paying. This is a continual concern for the industry but one, of course, that ramps up as the economy declines and/or fuel prices increase. These same factors put added pressure on thieves to get away with even larger volumes of fuel not just for personal use but for sale to others. While the remote card lock site offers some degree of privacy (and therefore security) for the theft a busy retail forecourt has not been an impediment to some of these thieves.
In part one of this article, we took a look at some of the extraordinary measures modern thieves are using in order to steal large amounts of fuel at card lock sites. Brian Decker, card lock and retail operations manager for El Monte, Calif.- based DeWitt Petroleum was a valuable source of information for that article. During the course of our interviews, he similarly described some of the extraordinary efforts thieves and undertaken at some of his company's retail sites. There is considerable similarity between the techniques used to steal from the card lock sites and those used to steal from the retail sites. That is not surprising giving the highly similar to in some cases identical equipment used in both types of operations. In general, thieves attempt to compromise the dispenser or the tank.
The thieves committing this type of crime are typically seen as having a background in the industry where they would be familiar with the technology and how to manipulate it to their advantage. With the dispenser, the typical goal is to compromise the pulser in order to allow them to pump out a high volume of fuel while only appearing to have pumped a handful of gallons.
A shower of sparks
"One day, one of our maintenance people reported that one of the panels was taken off the front of a dispenser," said Decker. "We couldn't figure it out. Dispensers are manufactured in such a way that they are not that secure. Or they are made with locks that have the same key or, depending on the manufacturer; you could just wiggle the panels and remove them. So we thought maybe it just fell off."
That was proven not to be the case when another dispenser panel was off the next day. A bit of investigative work found the plastic box that holds the pulser had clearly been removed. "We found that somebody had been removing the pulser gears then authorizing and filling up and controlling the pulser by hand instead of with the meter," said Decker. "They would go in and say, ‘Give me $20 on No. 3,’ then they would go out and pump $800 worth of fuel and they would go back inside, and it only showed $2 and they would get their change. So we had to devise a way that not only keep them out of the pulser box, but out of the dispenser itself. We started looking at things from the perspective that whatever we do it would have to be practically overkill because thieves were going to such great extents."
After considerable research and trial and error, Dewitt substituted tough, round vending machine locks for the standard dispenser locks. But even then, the company has video of a thief using a grinder at the pump to cut off the lock in broad daylight. "Sparks were flying everywhere and nobody said a word," he said.
Other marketers have used a steel rod running through one side of the dispenser to the other with the lock on the each side to secure the dispenser panels, but this is not immune to attack and also impairs aesthetics and branding. Security bands can also be added.
Dewitt began looking to provide a second line of defense inside the cabinet by fabricating steel cages around the pulser itself. "Everything seemed to be going well. We ordered new locks for every dispenser and swapped them all out only to find out the thieves had discovered a new way," Decker said. "We started finding the top anels open on dispensers, and we thought maybe they had popped open because they’re plastic and don't secure very well. So we opened it up and could not see that anything was messed with, and locked it back up. The next day we found another one open so we immediately knew something was going on."
To address this still undefined threat, Dewitt took sheet metal and screwed it down around anything that was obviously accessible from the panel. "The next day we found another open cabinet and the sheet metal had been cut off with shears," Decker said. Although Dewitt ended up losing some fuel, the criminal cut himself on the sheet metal and a bloody fingerprint indicated the new line of attack. The thieves were accessing the pulser from the top of the cabinet by removing the connector and then plugging in their own pulser.
In response, Decker changed out all of the top panel locks to have individual keys. He also added a dispenser shutdown switch on the panels so that if anything opened the dispenser would automatically shut down. The reset was located inside the building so that it cannot be turned back on simply by shutting the door. The company would also be notified by e-mail when this occurred.
"They only came back one more time and they opened up the door and found the power suddenly dead and they jumped back on in the truck and took off," Decker said. "The guy's partner was behind the truck and we have video of him taking off and jumping on the running board."
Decker noted that thieves have also used a screwdriver on the front of a dispenser through a vent to press on the rod that goes up from the meter into the pulser. This stops it from turning and strips the gears. While the dispenser would timeout after a certain period, the thieves would still get some free fuel. To combat this tactic, Dewitt installed a piece of pipe around the rod. Prefabricated guards can also be purchased to protect from this type of attack.
"Each time we have looked at it from a wider point of view, not just stopping them from doing what they're doing, but trying to think like they think, what else could they possibly do?" said Decker.
While he has not personally encountered this in Dewitt's sites, Decker discovered during his research that others had been hit by people accessing the internals and putting dispensers in standalone or maintenance mode using the plug-in keypad and default codes which unfortunately were not changed by the operator. To prevent this type of theft Decker removed all of the key pads and even the cables for the keypad connectors and, of course, the default codes were changed.
While it's possible to arm a dispenser to provide the security of an ATM, it's currently not practical given the impact on cost that would result. However, marketers and retailers in areas where this type of theft might be more common have a range of off-the-shelf and improvised solutions at their disposal.
"All fraud involving tampering requires access to the equipment, undetected altering of hardware, and knowledge of electronics, no matter what brand of dispenser is involved," said Kevin DeVinney, director dispensers & fleet systems, Gasboy. "Thieves are getting bolder, more sophisticated and more aggressive. Therefore, we encourage retailers to develop a comprehensive security plan, to institute careful procedures at the site."
The dispenser manufacturers provide a range of security enhancement kits and accessories the harden dispensers.
“We offer layered security options that really depend upon how much the station manager is willing to invest,” said Russell Haecker, global product manager, dispensers for Austin, texas-based Wayne. “These types of upgrades are much less of a concern when the economy is up and in fuel prices are down. Today, theft is a larger issue and people are willing to spend the extra dollars. The dispensers come with standard locks, but we have options to upgrade those to a T-bar lock we get from a local manufacturer in the U.S. If customers want, they can get individual keys and go a step further and order either passive or active security sensors.”
The company has taken physical security a step further with its new Helix dispenser line to be debuted at the NACS/PEI Show in October. “If you look at just the Helix in particular over the dispensers that we currently sell, you still have the same offerings, but in terms of physical design we've added improvements. For example, the payment drawer opens up similarly to modern ATMs, which makes it much more noticeable in the forecourt of somebody has the dispenser open. The frame that surrounds everything unlocks everything down as aluminum, which is a little bit more difficult to breach.”
A marketer can save some money and perhaps provide an even higher degree of security by fabricating some of the solutions Decker described in this and in part one of the article. For example, Decker's range of hardening solutions ran about $70 per dispenser. Hi alarm and shutoff kit cost $40 instead of $650. However, implementing that requires someone with Decker's imagination and practical fabricating skills. Also, the solutions are not Underwriters Laboratory approved.
Point of sale, back office and leak detection systems have to be tweaked and managed to make theft more detectable during the actual theft and immediately afterward. Tight inventory control can not only detect theft on the forecourt, but during fuel deliver and directly from the tank.
With the tank, the goal is to gain access to the fuel by parking an innocuous vehicle or trailer over the fill pipe and using a modern version of the Trojan horse. As noted in Part 1 of this article, the standard locks securing the fill pipes are not the most secure and some of the aftermarket upgrades can come up short to a determined thief. Decker ended up manufacturing metal covers that use vending machine locks. In the event of a breach, an effective tank gauge should be able to catch that massive loss of fuel if it’s set up for theft detection.
Excellent video security is similarly important to provide law enforcement with the evidence required to bring these thieves to justice.
"The biggest key is that you have to do something," Decker said. "Many many, many people do not do anything in even the simplest ways, such as putting up video cameras or tracking your inventory. You have to protect yourself or it will definitely come back to haunt you."
It's also critically important to provide adequate training to store managers and cashiers and maintenance personnel so that they can help identify theft that is in progress or that might have been recently committed. Decker notes the training should involve monitoring the POS screen for errors; monitoring dispensers for open panels; and monitoring dispensers for vehicles with extended stays.
Gilbarco offers the following recommendations for retailers to help secure their dispensers:
1. Periodically change the programming access (PIN) codes on the manager’s keypad.
2. For areas subject to high risk of theft, add special keys/locks to replace the standard locks.
3. Remove the manager’s keypads and cables from the dispensers and store them in the station or other safe Location.
4. Monitor and compare 'pump total' and 'station total' reports regularly on the store point of sale and tank monitor.
5. Maintain employee views of the fueling islands because thieves don’t like to be seen.
6. Be alert to any unit off-line message at the POS.
7. Be alert to service calls for dispensers that have been 'off-line,' which may indicate that fraud has occurred.
8. For units left powered during off hours, insure that power to the submerged turbine pumps (STP) is turned 'off.'
9. Inspect your site frequently, keeping watch for loose pump faces, doors, stray wires or other parts.
10. Be alert for abnormal traffic patterns on the forecourt.
11. Check the video security camera tape daily for suspicious activity at the pump.
12. Check the POS settings and change settings on any older POS that allows a “hot-authorization feature.”