Image 1 of 4
The Flying J in Lebec, CA is one of the sources of what appears to be a statewide credit card fraud scam which places charges on the accounts of those paying for gas at outside tanks. All of the fraudulent charges appear to be occurring at Pilot Flying J stores.
Image 2 of 4
This record was sent to us from Richard Kittel to show 24 fraudulant charges made to his card by three Pilot locations, mainly in the month of July, totalling about $2,800.
Image 3 of 4
In our check of local gasoline vendors, from Lebec, Frazier Park, Lake of the Woods to Pine Mountain Village, this is what we found: •76 station—Zip code required; •Chevron—Zip code required; •Shell—Zip code required; •Flying J—Zip code not required; •Don's Gas—Zip code not required; •Midway Gas—Zip code required; •Pine Mtn Auto—Zip code not required.
Image 4 of 4
If it is not reported, it never happened, said Sgt. James Anderson, head of fraud and burglary investigations at the Santa Clarita substation for the Los Angeles County Sheriff’s office. Kern County makes reporting easy. L.A. County Sheriff’s deputies stationed out of Gorman have offered to make an appointment to come take a report. Now it is up to the card holder to do their report, and to make records available to law enforcement when such frauds take place.
By Patric Hedlund
If you have used a credit card to buy gas at Flying J during the past year, it might be wise to check your statements carefully.
Within five days this month, four Mountain Community residents reported to The Mountain Enterprise independently that strings of fraudulent purchases had been made to their credit cards, charged at Pilot Flying J sites from Lebec to Castaic, Palm Springs to Thousand Palms. The thefts just from these four neighbors totalled about $9,000 this summer, and took place after each bought gas at the Flying J in Lebec.
Mitch Steenrod, the Chief Financial Officer for Pilot Flying J Travel Centers based in Knoxville, Tennessee, said in an interview Saturday, Sept. 8 that “the California Legislature” is responsible for a $400,000 loss each month to his company, one of the largest travel center chains in North America.
“A sophisticated credit card fraud operation is exploiting Pilot’s insistence on following state law,” Pilot’s CFO said. He added that Pilot has averaged the $400,000 monthly loss for about two years because credit card companies reimburse the card holder but deduct the payments from the vendor that accepts the card.
“[California’s law] was supposed to protect privacy,” Steenrod claimed, “but what it did was open a hole in the security checks we can use to protect consumers.” He told two reporters for The Mountain Enterprise that this state’s law prohibits Pilot from asking for zip codes at outdoor pumps.
Zip code at the pump
Because zip codes are not included in the data in the mag stripe on the back of credit cards, asking the purchaser to enter their zip code at the gas pump stops thieves, the industry says. If the zip code entered does not match that of the legal card owner, service is denied and the theft is stopped.
“California is the only state out of 46 in which we operate where this [fraud] is happening— and Pilot is the chain that is being hit, because we are following the law….California’s legislature is pretty messed up,” Steenrod said.
Well, not quite
Our research revealed that the state of California does, in fact, allow asking for zip codes from those who use credit cards for outdoor, self-serve transactions at the gas pump.
On October 9, 2011 Governor Jerry Brown signed California Assembly Bill 1219, an urgent measure to make it legal to require zip codes at outside, point-of-sale gas pumps. The law went into effect immediately. But—as unlikely as it seems—it appears Pilot Flying J’s corporate attorneys did not get that message.
Quick history
It is true that a California Supreme Court ruling in 2010 said that requesting zip codes for credit card purchases was contrary to the privacy provisions of California’s Song-Beverly Credit Card Act. But because the fraud danger was immediately understood regarding self-service card transactions, where personal identification such as a driver’s license could not be examined as it is at indoor cash registers, California legislators took action with Assembly Bill 1219. It creates an exemption for collecting zip codes when used solely for prevention of fraud, theft or identity theft, “to prevent potential disruption of gasoline station services throughout the state.”
Massive fraud unreported
But Flying J is not using that security option. A massive fraud operation may be exploiting the security hole at the 16 Pilot Flying J’s throughout California.
After The Mountain Enterprise verified thefts from mountain residents Heide Ploen and Richard Kittel, we were told of similar activity on the credit cards of William Fair and John Helliwell. Not one of these residents had reported the theft to local law enforcement.
These four local commuters represent a tiny sampling of the customers flowing into Flying J from the Interstate 5 freeway at the top of the Grapevine, where 77,000 vehicles pass by each day.
We estimate Flying J serves about a million passenger car customers a year in Lebec. Yet neither Los Angeles County Sheriff’s deputies in Santa Clarita nor Kern County Sheriff’s deputies in Frazier Park are currently receiving reports of fraud from Pilot Flying J customers. Why is that?
Customers who discover fraud on their statements call the credit card company first. The bank reverses the fraudulent charges, then bills the vendor— Pilot Flying J in this case.
Meanwhile, if law enforcement agencies request transaction records to try to investigate specific fraud events, VISA and other companies refuse to provide the records unless the consumer gets involved. But the consumers have moved on.
Sergeant James Anderson, L.A. County Sheriff’s Santa Clarita substation burglary and fraud division supervisor said, “Being a victim is inconvenient. It can be time-consuming…but if you don’t report it…it never happened.”
Because Pilot Flying J is a privately-held company, we do not have access to their financial reports to verify the chief financial officer’s claim of $400,000 a month in fraudrelated losses. That would total $4.8 million in theft at the pump per year in their California stores.
“We are a customer-centric company,” CFO Steenrod said, “we are the most competitivelypriced gasoline offerer out there; we are a consumer-driven company.” He is concerned that the company is receiving “a financial hit and a reputation hit.”
He added that The Mountain Enterprise is the only newspaper that has inquired about this fraud which he said has been continuing at this volume for two years.
Caution
Of the seven gasoline vendors we sampled in the Lebec and Frazier Park area, four currently require the zip code safety check. Neither Flying J nor Pine Mountain Auto Center use that safeguard. Don’s Liquor and Gas Market recently dropped the zip code request—Mike Kahlil said he has a new credit card processor program that ‘scrambles’ card numbers. Pine Mountain Auto Center says they haven’t had this problem.
Pilot Flying J’s Steenrod said that customer credit card numbers are stolen with the help of accomplices—gas pump service technicians who sell pump cabinet keys to criminals. They then open the pumps to place devices inside which capture credit card numbers.
“Re-keying the pump requires using technicians again, which opens more exposure,” Steenrod said.
Sgt. Mark Brown of Kern County’s Frazier Park substation agrees: “I’ve been warning people about skimming devices on gas pump card receivers for years. They tend to be placed when the pumps are installed or serviced. They are not discovered until the account numbers have been stolen. The devices record a card’s number and [the thieves] load that stolen number onto blank cards, which are then sold nationwide [often through the internet].
“We all have to pay close attention to our bank accounts,” Brown said, “and be careful about where we use our cards. I rarely use my cards at an outside gas pump, and when I do, I carefully check the slot to make sure it doesn’t appear to be tampered with.”
Tough to prosecute
Brown said the report we showed him of illicit charges on Richard Kittel’s account illustrates another major problem with investigating this kind of ‘white collar’ crime.
Not seeing reports from card owners until months after fraudulent charges were made can make securing credible video evidence of the crime an almost impossible task.
The scam activity allegedly occurring at Pilot Flying J’s facilities are sometimes caught by credit card company algorithms that scan charges for unusual use patterns. But typically the illicit use is not confirmed until the customer’s next billing cycle. By the time customers see their statements and discover the thefts, the video records of those using the pumps where thefts occurred have been recycled and lost.
To link use of counterfeit cards with a string of specific charges made by specific individuals a month or two months in the past is a tough challenge for investigators—especially without speedy access to the financial transaction records that peg specific purchases to a specific tank at a specific location at a specific date and time.
Even if enough evidence could be gathered to file charges against those responsible, Kern County Deputy District Attorney Chris Staiger explained that prosecuting could be very costly for a local jurisdiction.
It would be expensive and complicated to gather the evidence Sgt. Anderson said, and “expensive to fly in the witnesses to verify for a jury that the records are valid for use as evidence in a trial,” Staiger said.
Worse, even after doing all that, a conviction in post- AB 109 California could be a hollow victory.
Assembly Bill 109 was signed into law in April, 2011 to clear out California’s overcrowded state prisons. AB 109 “realigns” how criminals convicted of crimes that do not entail sexual battery, violence, firearms or first degree burglary can be sentenced.
Even if it were proven that millions of dollars were stolen from Pilot Flying J, those convicted in California today would be likely to spend only a few months in a county jail, and would then be released.
Investigation by a joint task force combining local jurisdictions with FBI and Secret Service— and geared toward prosecution and sentencing under federal law—would make punishments more severe.
L.A. County’s Sgt. James Anderson says an interjurisdictional fraud task force exists. But with the “it never happened” reality being created by citizens’ failure to report such thefts, the scam is not showing up in law enforcement databases in a way that would justify allocation of the needed resources.
Mike Kahlil, owner of Don’s Liquor and Gas Market in Frazier Park, and Mitch Steenrod, speaking from the CFO’s office of Pilot Flying J’s corporate headquarters in Knoxville, both said that it is the credit card companies who could change the situation overnight.
“Why don’t they require that a credit card have a pin number, like an ATM?” Kahlil suggests. A credit card pin number would be more secure and unpredictable than a zip code, and might make wholesale white-collar fraud at the gas pump unprofitable, he added.
“This is big—bigger than California and even a country,” Kahlil said. “These cards are being used all over the world, in the Middle East, even Iran. Why aren’t the credit card companies responsible?”
To report credit card fraud
•L.A. County Sheriff 661-255-1121
•Kern County Sheriff 661-861-3110
•Kern County residents may also use www.kernsheriff.com click ‘online reporting’
—Gary Meyer provided additional reporting for this story
This is part of the September 14, 2012 online edition of The Mountain Enterprise.
Have an opinion on this matter? We'd like to hear from you.
