Elaborate credit card fraud leaves many victims across Inland Northwest

One month ago today, three men walked into a Wal-Mart in Post Falls and attempted to buy in-store gift cards using a series of credit cards. Store managers grew suspicious and called police.

That set off an investigation by local and federal authorities of a sophisticated scheme to steal credit card numbers from gas station customers, siphon funds from those accounts and launder the money through the purchase of retail gift cards.

The Florida-based suspects fled, and the Post Falls Police Department and the U.S. Secret Service are still identifying victims across the Inland Northwest. Potentially hundreds of account numbers were stolen from residents in the Spokane, Post Falls and Coeur d’Alene areas.

“A lot of people were compromised. We still don’t know the full scope of this,” Post Falls police Detective Neil Uhrig said.

The thieves broke into a pair of gas pumps at an Exxon station near Interstate 90 and installed skimming devices that collect customers’ credit card and debit card numbers.

This method has been used for years around the U.S. using inexpensive equipment easily purchased online, investigators say. Skimming crews also have been discovered this fall in Michigan, Iowa, Nebraska, Texas and other states. Many of the suspects are from Florida.

Post Falls police questioned two of the men at the Wal-Mart on Mullan Avenue. They had Florida drivers’ licenses and said they were Cuban immigrants here on vacation.

“As we figured out what they were doing, we got warrants for those two males,” Uhrig said. “And we are under the impression they fled back to Florida.”

The suspects were in a self-checkout stand at the store, “running card after card after card,” he said.

Police confiscated 99 inactivated Visa gift cards the men had on them, as well as 30 more cards that had been activated.

“We didn’t have a clue what we had going on,” Uhrig said. “We just had them with a ton of these cards.”

A forensic investigation revealed the 30 activated gift cards had been reprogrammed with stolen credit card numbers. Investigators began working with banks and credit unions in the region to identify the victims and try to pinpoint when and where their cards had been compromised.

Soon a common point of use emerged: the Jifi Stop Exxon at Spokane Street and Seventh Avenue. Uhrig went to the station and opened the front panels on the pumps. He found the small skimmers wired to card readers on two pumps.

“Basically day and night it’s saving card numbers as you’re getting gas,” he said.

“You can only imagine, if that’s been on there for just a month, how many people were getting gas at the pump in a month: hundreds.”

The Jifi Stop scoured security footage and found video from early October showing the thieves breaking into a pump one night. One man went inside the store to make a purchase, possibly to distract the clerk, as the other unlocked the pump door. They were in and out in under two minutes, Uhrig said.

“They’re very good at what they do. It’s hard to see what they’re really doing,” he said.

Cloning cards

After some time, the thieves returned to regain access to the pump and download the stolen data. Police don’t know when the crew first penetrated the pumps in Post Falls.

“The best we can find out is it started sometime in August,” Uhrig said. “We don’t know the exact date. There’s a lot of planning that goes into this type of crime.”

The thieves then would encode the stolen numbers onto the magnetic strips of blank gift cards – the kind commonly sold at retail stores. Uhrig believes they probably stole bunches of these cards for the purpose of cloning them with the stolen credit and debit card numbers.

Then they would visit Wal-Mart stores to purchase Wal-Mart brand gift cards using the cloned cards, Uhrig said.

“So they don’t have to worry about maintaining custody of that stolen credit card number because they’ve already put the money on a different gift card,” he said. “So it’s just a way of kind of laundering money.”

With the new Wal-Mart gift cards, the thieves could buy merchandise and resell it online, or maybe return their purchases for refunds.

“We’re trying to figure out what the end game is, how they’re going to use that money,” Uhrig said.

Police recovered a couple of thousand dollars loaded onto gift cards at the Wal-Mart on Mullan, and they learned the suspects also used them at Wal-Mart stores in Hayden, Airway Heights and Spokane Valley. “They have been pretty much everywhere in this region,” Uhrig said.

The confiscated skimmers were turned over to the Secret Service for forensic analysis. Police hope the results will help identify everyone whose cards were compromised.

“We have seen skimmers here, but this one is kind of interesting, finding the skimmers in conjunction with suspects that have been identified by Post Falls,” said Greg Ligouri, resident agent in charge of the Secret Service office in Spokane.

The investigation remains active, Ligouri said, with local agencies working to identify potential suspects.

“There’s some indication that there may be some connection between what is going on over in Post Falls and what a couple of other local police departments are investigating,” he said.

Tighter security at the pump

The crime spurred Kerr Oil Co., owner of the targeted Jifi Stop and seven other stations in Kootenai County, to shore up its defenses.

“The first line of defense is installing these newer, higher-technical locks,” said Dave Patzer, general manager of Kerr Oil.

The old pump locks used universal keys that thieves all too easily obtained. The company is changing those out for more sophisticated locks specific to each store, Patzer said.

In addition, all pump doors now are sealed with tape imprinted with a unique numbering system. “We know they’re our seals by the unique sequencing of numbers that are on there,” Patzer said.

The company also started daily inspections of each pump and reoriented security cameras for better views, he said.

“We’re not trying to hide from it, certainly, and trying to encourage people to help us get these guys,” he said. “Because this affects everybody. It affects your card rates, it affects the amount of money that credit cards are charging to recoup their losses.”

As for why the thieves chose the Jifi Stop in Post Falls, Patzer said he believes they target stations with a high number of interstate travelers. That enables them to steal from people living across a large area, making it harder for banks and police to narrow down where the theft is occurring.

Another tactic is to use the stolen cards in the same area, making it less likely banks will detect fraudulent activity, officials said.

“It doesn’t set up an alert for the banks,” said Kootenai County sheriff’s Detective Shardell Ellis, who investigates fraud and computer crimes. “If you have a person who lives in Spokane using a credit card in Spokane, the bank’s not even going to bat an eye.”

A profitable racket

Thieves obtain stolen credit card numbers a variety of ways: stealing mail or breaking into cars; downloading skimming malware onto computers used by small businesses; buying bulk lists of stolen numbers online. It’s common for them to encode the numbers onto the magnetic strips of inactivated gift cards, then go shopping.

“What we see watching the surveillance … is they’ll have multiple cards in their possession, and they’ll just try card after card after card until they find one that works,” said Ellis, who is certified in financial crimes and digital evidence and teaches these subjects at the police academy.

It’s a profitable racket, she said.

“It used to be you’d physically rob a bank and you’d get $1,500. Now instead you can go and skim 100 credit cards and turn around and use those cards for $1,500 a pop,” she said. “And the penalties are nowhere near what it would be if you’d actually physically robbed the bank.”

Once the thieves load up gift cards using the stolen funds, they buy computers, tablets and other small electronics in high demand. Mexican crime syndicates are among the foreign architects of these schemes, Ellis said.

“A lot of these cartels, they will buy mass amounts of goods that can be easily resold. They’ll sell them on eBay or online marketplaces,” she said. “And the people at the top, it’s very low risk for them. They send out other people in the field to use these stolen credit cards, and they bring back the goods or money.”

More banks and credit unions, including Spokane Teachers Credit Union, are switching to cards containing microchips that create a unique code for each transaction, making it far more difficult to skim and clone the cards. Retailers quickly are adding chip readers to supplement the long-familiar magnetic strip readers.

“It will be a lot harder technology for them to duplicate,” Ellis said. “Right now with the magnetic strip, you can buy an encoder off of eBay for $150 and just input the information.”

Some credit cards, including those now being issued by STCU, also require a personal identification number, just like a debit card. If a merchant is set up for PIN purchases, a shopper with a PIN-equipped credit card must provide the PIN instead of signing for the purchase.

A recent shift in card-fraud liability is driving adoption of the newer chip-based technology. Merchants who haven’t upgraded their payment terminals to read these cards now must cover the cost of certain fraudulent transactions, relieving financial institutions from absorbing the losses.

Gas stations, however, have until 2017 to update card readers at the pumps.

Until then, cases such as the skimmers found in Post Falls help alert businesses and consumers to their vulnerabilities. But Ligouri noted, “Law enforcement finds a way to suppress the activity, and they come up with something new.”