Fuel Card Skimming: How Fleets Catch Cloned Cards

Most fuel card fraud in the US does not start with a dishonest driver. It starts with a skimmer hidden inside a pump. A Comdata executive told FleetOwner in 2024 that skimming accounts for 80–90% of the fuel card fraud it sees. Fleets have reported losing $10,000 to $60,000 a month to cloned cards before they got it under control.

The skimmer is usually invisible, so you cannot reliably stop your drivers from using a compromised pump. What you can do is spot a cloned card within hours instead of at month-end. This guide covers how skimming works, what a cloned card looks like in your transaction data, and how to catch it.

How pump skimmers work

A skimmer copies the data on a card's magnetic stripe. There are three common types:

• Internal skimmers sit inside the pump cabinet, wired between the card reader and the pump's electronics. Researchers at UC San Diego found they can be installed in under 30 seconds with a pump master key. Many transmit the stolen data over Bluetooth, so thieves never have to return to the pump.
• Overlays fit over the card reader on the outside of the pump.
• Fake keypads and hidden cameras capture PINs and driver IDs typed at the pump.

With the stripe data and the PIN or driver ID, a thief can write the data onto a blank card and use it as your driver would.

Why fleet cards are a target

• Magnetic stripes are still common. Card networks moved fuel pump liability to chip cards in April 2021, but fleet card issuers were never required to move to chip. Many fleet cards, and many diesel lanes at truck stops, still run on magnetic stripe.
• High limits. A fleet card authorized for 150 gallons of diesel is worth far more to a thief than a consumer card.
• Prompts can be captured. Driver ID and odometer prompts help, but a fake keypad captures them along with the card data.
• Fuel is easy to resell. In a New Jersey case announced in January 2025, prosecutors charged 25 people with using skimmed card data to buy diesel that was resold to trucking companies, from vehicles fitted with auxiliary tanks.

What a cloned card looks like in your data

A cloned card is used by someone who is not driving your truck. That leaves a trail if you compare transactions with what the vehicle was doing:

• The vehicle was somewhere else. The card was used at a station the truck never visited. This is the strongest single signal.
• Fills in quick succession. Several large fills on one card in a few hours, often at different stations. WEX lists this as a sign a fraudster is trying to maximize a stolen card before it is shut off.
• More fuel than the tank can take. A 200-gallon fill on a truck with a 150-gallon tank, or a fill when telematics shows the tank was nearly full.
• No rise in the tank level. The card shows a fill, but the vehicle's fuel level did not go up.
• Wrong fuel type. Gasoline bought on a card assigned to a diesel truck.
• Odd hours. Fills overnight or on days the vehicle was parked.

A Relay Payments executive told Trucking Info that thieves typically get about three fills, around $450 each, before a card is stopped. Every hour between the first fraudulent fill and someone noticing costs money.

How to protect your fleet

At the pump

• Use the issuer's controls. Purchase limits, time-of-day limits, product restrictions, and site restrictions all reduce what a cloned card can do. Put idle cards on hold.
• Use stronger authorization where available. WEX offers dynamic prompts and location checks before authorization, and launched cardless single-use codes in September 2026. Comdata offers app-based card locking and proximity checks against the vehicle's GPS. These stop many cloned-card fills before they happen.
• Train drivers on the basics. The FTC advises checking that the pump's security seal is intact and does not read "void." Paying inside or using a mobile wallet avoids the card reader altogether.

In your data

Issuer controls are the first line of defense. They work at authorization, based on the rules you set. The second line is checking every transaction that got through against what the vehicle was actually doing, across every card you run. That catches the cloned card that passed a prompt, the fill at a site you never restricted, and the card on a program without location checks.

Do this daily, not monthly. If a cloned card is spotted after the first fill, you cancel one card. If it is spotted on the statement, you are disputing weeks of charges.

When you find one

1. Put the card on hold with the issuer immediately and request a replacement.
2. Pull every transaction on that card since the first suspicious fill.
3. Check whether other cards were used at the same station around the same time. One skimmer often catches several of your drivers.
4. Dispute the charges with your issuer and report the station.

For a full response plan, read what to do when you catch fuel fraud.

How Fleevo catches cloned cards

Fleevo checks every fuel card transaction against your telematics: was the vehicle at that station at that time, did its tank level rise by the amount purchased, does the volume fit the tank, and is it the right fuel type. A cloned card used miles from the truck is flagged with the full transaction detail, so your team can put the card on hold. You can add your own rules in plain English, such as "flag a second fill on the same card within two hours." Fleevo works across WEX, Voyager, EFS, Corpay, and 40 other fuel cards, and is an official partner of Samsara, Geotab, and Verizon Connect. Fleevo offers a free 3-month fuel audit, with the number back within 48 hours.

Book a demo, or read common fleet fuel fraud patterns and our guide to the best fuel card fraud detection software.

Fuel card skimming FAQs

How do I know if a fleet fuel card has been skimmed?

Look for transactions where the vehicle was not at the station, several large fills on one card in a short time, fills larger than the tank, or fills where the tank level did not rise. Comparing card transactions with telematics catches these automatically.

Are chip fleet cards safe from skimming?

Chip transactions are much harder to clone than magnetic stripe ones. But fleet card issuers were not required to move to chip, and many truck stop diesel lanes still read the stripe, so many fleet card transactions remain exposed.

Who pays for fraudulent fuel card transactions?

It depends on your issuer's terms and how quickly you report the fraud. Check your card agreement, report suspected fraud immediately, and keep records of every disputed transaction.

Can drivers spot a pump skimmer?

Sometimes. A broken security seal or a loose card reader is a warning sign. But internal skimmers are hidden inside the pump, so checking transactions against vehicle data is the more reliable defense.

How quickly do thieves use a cloned fuel card?

Fast. Thieves typically try to get several large fills in quickly before the card is cancelled, which is why daily checks matter.

Sources

• FleetOwner, Comdata on skimming share of fraud (2024): fleetowner.com
• Transport Topics, fleets and fuel card skimming (2024): ttnews.com
• Trucking Info, how trucking is fighting fuel card fraud (2024): truckinginfo.com
• UC San Diego, Bluetana: cseweb.ucsd.edu
• US Payments Forum, petroleum EMV FAQ: uspaymentsforum.org
• C-Store Decisions, fuel dispenser EMV deadline: cstoredecisions.com
• New Jersey Attorney General, diesel fuel theft charges (2025): njoag.gov
• WEX, how to combat fuel theft: wexinc.com
• WEX, cardless fuel payments (2026): wexinc.com
• FTC, card skimming at the gas pump: consumer.ftc.gov