UC San Diego

Embedded devices installed inside gas pumps allow criminals to steal millions each year. These devices, called skimmers, record unencrypted information transmitted by the pumps’ payment circuitry. Despite the monetary impact, no study of law enforcement skimmer recovery methodologies exists. This thesis presents the first such study. I discover that criminals often use Bluetooth to retrieve stolen card information. I also find that current investigative mechanisms are ineffective. These findings motivate the development of an Android application for skimmer detection, Bluetana. Bluetana leverages Bluetooth and crowd-sourced data collection to detect skimmers. This approach is effective: detecting 64 skimmers over two years.