(CBS News) - The price of gas continues to fall. AAA says the national average for regular has fallen to $3.73, down 21 cents in the past six weeks. But if you pay at the pump, thieves may be waiting for you, ready to skim the information off your bank card and siphon the money out of your account.
It's a scam called "skimming" and it costs the financial industry more than $350,000 a day, as CBS News correspondent Sharyl Attkisson reports.
Volunteer fireman Mark Young recently got out of the hospital after neck surgery, only to be dealt another blow when he checked his bank balance.
"I had $2,300 in the bank, and it said I only had $1,000 in there," Young said.
Surveillance video shows a man that police say is suspected of stealing Young's debit card number and going on a shopping spree. He allegedly used it four times in two days at Target, Wal-Mart and Macy's.
Detective Eric Landamia of the Lower Southampton Township Police says the trick was finding out how the thief had gotten Young's and other victims' numbers without actually stealing their cards. Police zeroed in on gas stations, where many people pay with their cards right at the pump.
So-called "skimming devices" can be bought legally online for around $200 dollars. They record card numbers on a memory chip.
Hacker and ex-convict Greg Evans, who owns his own security firm, showed CBS News how a crook can use a popsicle stick and superglue to attach the skimmer.
"The first thing we have to do is to make sure we're lining up the skimmer up here with the credit card so that it goes in evenly," Evans said. "See, this way the person doesn't even know when they're sliding their card in."
The customer thinks he's pumping his gas and everything is fine. In actuality, somebody just stole his credit card, Evans said.
Evans demonstrated how to install a rudimentary skimmer in a matter of minutes. The real scam artists can make the skimmer seamless and undetectable to customers. The skimmer can hold about 1,000 credit card numbers, Evans said.
The thief retrieves the skimmer and then downloads the data.
"I was really angry," Young said. "Very, very angry."
Police caught the suspect in Young's case, and are working to get his cooperation to help catch other alleged thieves.
There's no foolproof way to identify a gas pump that's been rigged with a skimmer. It's up to consumers to discover the theft and report it to police and the bank. If it's proven to be fraud, and reported quickly, all banks have a policy of refunding the money to you.
That's why Young tells others to check their accounts often. Even if your card's still in your wallet, someone could be enjoying a shopping spree at your expense.
