Your driver swipes the company fuel card, fills the tank, and drives off. Nothing looks wrong. But a paper-thin device hidden inside that pump just copied your card's magnetic stripe, and by tonight a cloned copy of your card could be filling a hidden tank in the back of someone else's pickup — on your account. Fuel-card fraud now siphons off as much as one gallon in five at the worst-hit operations, and small fleets are the softest targets. Here is how the theft works, what it costs, and the layered controls that make criminals pick an easier victim.
How fuel-card fraud actually works
Most fleet fuel fraud falls into three buckets, and you need different defenses for each.
Skimmers and cloned cards
A skimmer is a device fitted over or inside a pump's card reader that copies the magnetic stripe data from every card swiped through it. Modern versions are nearly undetectable from the outside, and some transmit stolen card numbers over short-range wireless, so the thief never has to come back to retrieve the device. Pumps that have not been upgraded to chip readers are the most vulnerable because their readers leave plenty of room to hide the hardware.
Once your card number is captured, it gets encoded onto a blank card with a magnetic stripe — anything from a gift card to a hotel key — and that clone buys fuel that bills to your account. The FBI estimates that skimming across all card types costs financial institutions and consumers more than $1 billion every year, and the Secret Service reckons a single skimmer can generate as much as $1 million in stolen funds before it is found.
Bulk theft and resale
The most brazen operators do not bother with small purchases. They retrofit vans and pickups with hidden tanks and high-volume pumping rigs — sometimes little more sophisticated than a bladder tank in the cargo bed — then fill up on cloned fleet cards and resell the fuel at a steep discount. Diesel is the usual target because commercial trucks burn so much of it. These vehicles are deliberately unremarkable from the outside, which is exactly why pump-side vigilance matters: nobody fills a work van through the side cargo doors, and that wrongness is visible if anyone is looking.
Friendly fraud from inside
Not every loss comes from a stranger. Industry veterans use the term "friendly fraud" for misuse by authorized cardholders: filling a personal vehicle on the company card, buying snacks and merchandise as fuel-adjacent purchases, swapping cards between drivers so no transaction ties to a person, or rounding up with premium fuel the company never approved. Each incident is small, but across a fleet and a year it adds up to real money — and unlike external fraud, your card issuer will not absorb it.
What it really costs you
Put the numbers together and the exposure is startling:
- Fleet card managers report that up to 22 percent of fuel spend can be lost to fraud, with fuel-heavy industries such as construction running even higher.
- A fraud-prevention analysis widely cited in the industry estimates that a fleet spending $5 million a year on fuel could be losing up to $250,000 to internal and external fraud combined.
- Card compromise through skimming surged 77 percent in a single recent year, according to payment-data tracking — the attack is growing, not fading.
- The three worst states for fuel fraud are California, Texas, and Florida, thanks to high fuel volumes and long-haul corridors. But skimmers have been found in every region, and small local fleets get hit precisely because nobody expects them to be watching.
For a ten-truck operation, even a 5 percent leakage rate on fuel is the difference between a raise for your drivers and a year of standing still. Fuel is usually your largest variable cost, so fraud lands directly on the bottom line with no offsetting revenue.
Lock down the card itself
The cheapest and most effective layer is also the most neglected: the purchase controls your fuel-card program already offers. Most fleet managers leave cards on near-default settings, which is the equivalent of handing every driver a corporate credit card with no limit. Tighten each of these:
One card, one driver, one vehicle
Assign every card to a specific driver and require that driver's personal PIN at the pump. Never use a single shared PIN for the whole fleet — a shared PIN makes every transaction anonymous, which defeats the entire audit trail. Disable lost cards and ex-employee cards the same day, and audit the active card list quarterly. Cards for sold vehicles are a classic hole: the truck is gone, but the card keeps working.
Gallon, dollar, and product limits
Set per-transaction and per-day caps on gallons and dollars that match each vehicle's real tank size and duty cycle. A sedan with a 15-gallon tank should never authorize a 60-gallon fill. Restrict purchases to fuel only — or fuel plus the specific categories you allow, such as oil or tolls — and lock each card to the right fuel type so a diesel card cannot buy gasoline (or premium drinks at the truck stop). These limits turn a cloned card from an open tap into a thimble.
Time, day, and geography windows
If your crews work weekdays, block weekend transactions. If your routes stay in-state, block out-of-state purchases or at least require approval for them. Most programs let you restrict by state, ZIP code, merchant network, and even time of day. A transaction at 2 a.m. three states away from your territory should be declined at the pump, not discovered in next month's statement.
Real-time alerts
Turn on instant notifications for declined transactions, after-hours fueling, out-of-network purchases, and any fill above your normal gallon threshold. A declined-transaction alert is often the first sign that a clone of your card is being tested somewhere. Speed matters: the faster you freeze a compromised card, the fewer fraudulent gallons you buy.
Verify the transaction against the truck
Card controls answer "is this purchase allowed?" A stronger layer answers "did this truck actually take this fuel?" That cross-check is where the industry is moving fastest, and small fleets can now afford tools that were enterprise-only a few years ago.
Odometer prompts
Roughly 90 percent of U.S. fleet cards can require the driver to key in the odometer reading at the pump. Turn it on. Odometer data lets you compute miles per gallon per vehicle per fill, which is the single best fraud detector ever invented: a truck that suddenly gets 4 MPG either has a mechanical problem or is feeding someone else's tank. It also flags impossible sequences — an odometer reading lower than last week's fill means someone fat-fingered the entry or is covering a personal fill-up.
Telematics matching
The newest authorization systems compare each fuel transaction against live vehicle data before approving it: Is the truck actually at this station? Does the tank have room for this many gallons? Is this the right fuel type for this engine? A purchase attempted hundreds of miles from the truck's GPS position gets declined automatically, as does a 100-gallon fill into a tank that telemetry says is already three-quarters full. Major card programs launched AI-driven versions of this matching in 2026, combining their transaction networks with telematics feeds to score every purchase in real time.
One-time PINs and app-unlock cards
To defeat skimmers and shoulder-surfers entirely, some programs now issue single-use PINs through a driver app at fueling time, so a captured PIN is worthless minutes later. Others keep the card locked until the driver unlocks it from a phone app while parked at the merchant, verifying the vehicle's location against the station's coordinates. One telematics-linked card even backs verified transactions with a fraud guarantee of up to $250,000 per account — a sign of how confident issuers are in location-verified authorization. If your issuer offers any of these, enroll: they convert your biggest vulnerability, the static magnetic stripe, into a non-issue.
Train your drivers to be the sensor network
Technology catches fraud at authorization time, but your drivers are the only defense stationed at the pump. Make these habits part of onboarding and refresh them at least annually:
- Guard the card and the PIN. Store fuel cards out of sight, never leave them in an unattended cab, and never write the PIN on the card or keep it in the same wallet slot. No sharing cards between drivers, ever.
- Inspect before you swipe. Wiggle the card reader, look for overlays, mismatched colors, or anything loose around the PIN pad. Cover the pad with your free hand while entering the PIN — pinhole cameras are cheap and common.
- Practice delta analysis. Federal investigators teach a beautifully simple habit: ask what looks different. Which pump does not match the others? Who is filling a van through the side doors? Most fraud leaves a visible trace for someone who is looking for wrongness rather than looking at nothing.
- Report immediately. Give drivers a single number or channel for suspicious pumps, declined cards, and anything odd at a station — and make clear that reporting is always welcome, never punished. A skimmer reported today saves every fleet that uses that station tomorrow.
Reconcile fuel like you mean it
Here is where fraud prevention meets bookkeeping: the same records that catch theft are the records that keep your taxes and job costing honest. Build a weekly rhythm around them.
Track MPG per vehicle, every fill. Export transactions with gallons, odometer, driver, and location, and compute fuel economy per vehicle. Investigate any vehicle that drops more than 10 percent below its rolling average. This one report catches friendly fraud, mechanical problems, and cloned-card fills alike.
Review exception reports, not raw statements. Do not eyeball hundreds of line items. Instead, pull the exceptions your card program generates: after-hours fills, out-of-network purchases, gallons above tank capacity, duplicate same-day fills, and MPG outliers. Clear each exception with a note, the same way you would clear a bank reconciliation item.
Tie fuel to jobs and tax categories. If you run equipment off-road as well as on-road, separate taxable and nontaxable fuel from the start — that split is the backbone of fuel-tax credit claims and IFTA filings, and reconstructing it months later from a shoebox of receipts is how deductions die. Tagging each transaction to a vehicle, driver, and job at import time takes minutes and pays for itself at tax time and in every customer dispute about equipment costs.
If you want this discipline without the spreadsheet wrestling, pipe your card exports into real accounting: a plain-text ledger gives you version-controlled, auditable fuel records where every gallon ties to a vehicle and a job. The documentation walks through setting up commodity and cost-center tracking, and the dashboard views make per-vehicle burn rates visible at a glance.
When fraud hits anyway
Even good controls leak sometimes — the professionals trying to rob you do this full-time. What matters is response speed:
- Freeze first, investigate second. Lock the compromised card the moment an alert or driver report lands. Most issuers support instant card lock from a web portal or app.
- Preserve the paper trail. Save the transaction records, alerts, GPS logs, and any pump photos before anything auto-archives. Your dispute and any law enforcement report both run on this evidence.
- Dispute with your issuer promptly. Fleet card agreements have notification windows, just like credit cards. Report suspected fraud in writing and ask for provisional credit while the investigation runs.
- Report outward. File a police report for the jurisdiction where the fraudulent purchase occurred, and report skimmers to the station operator. Federal charges in skimming cases can include wire fraud, access-device fraud, and aggravated identity theft, with sentences running two to ten years depending on scale — but cases start with someone's report.
- Close the hole. Every incident is an audit finding. If a clone worked, which control failed — no gallon cap, no geo-block, no odometer check? Fix that control fleet-wide, not just on the burned card.
Fuel fraud is a volume business for criminals: they move on when your fleet costs more effort than the next one. Layered card controls, transaction-to-truck verification, trained drivers, and weekly reconciliation will not make you invincible, but they will make you the wrong target — and that is the whole game.
Keep Your Fuel Spending Under Control
Catching fuel fraud starts with knowing exactly where every gallon and every dollar goes. Beancount.io provides plain-text accounting that gives you complete transparency and control over your financial data — no black boxes, no vendor lock-in. Get started for free and see why developers and finance professionals are switching to plain-text accounting.
