# SAM-PAY: A Location-Based Authentication Method for Mobile Environments +
## 5 Service Exploiting the SAM-PAY Method for Mobile Authentication
### Traditional Refueling Service at Self-Service Gas Stations  
In small towns and rural areas, gas stations sometimes allow customers to pump gas first and pay afterward. Due to the higher incidence of crime in large urban areas, customers must generally pay before pumping fuel. To allow customers to perform payments, modern gas stations have pay-at-the-pump capabilities: in most cases, credit, debit, ATM cards, fuel cards, and fleet cards are accepted. Occasionally, a station will have a pay-at-the-pump-only period per day when attendants are not present, often at night, and some stations are pay-at-the-pump-only 24 h a day. The following steps are typically executed when a customer performs self-service at the gas station: the user inserts money (or a payment card supported by the fuel dispenser) in the fuel pump that incorporates a pay-at-the-pump device, such as a Point-Of-Sale (POS) device. Subsequently, the user selects a pump number  
Figure 4: Modified LDEA geo-encryption algorithm used in the SAM-PAY authentication method.  
Figure 3: Generation of LDEA-key, where (*) means multiplication.  
(if several pumps are serviced by the same fuel dispenser) and waits for the pump to be unlocked. In practice, in the case of payment with a card, the pay-at-the-pump device typically communicates with the server of the customer's bank (via a dedicated payment circuit) in order to check the eligibility of the customer, i.e., to check the availability of the amount required in the customer's bank account. Once the customer has finished using the fuel dispenser and if no error has occurred during the whole operation, a receipt is returned by the pay-at-the-pump device to the user.  
One of the most common frauds regarding fuel pumps is theft of credit or debit card data, as described in [69]. In this case, the thieves installed hard-to-detect electronic devices at the gas stations (also named skimming devices) in order to steal credit and debit card data. The skimming devices are typically small. They can be installed outside or inside the pump and are molded and painted to match the machine. Subsequently, the skimmed data are used to create cards used at the victims' expense. Skimming devices have been used for several years, most often at ATMs. Thieves increasingly target pumps because it is a cheap, easy way to steal credit and debit card information. With this method, the thieves managed, for example, to take more than $200,000 from up to 180 victims by stealing card data at a gas station in California (USA). Other types of fraud have been encountered, too. For example, in suburban Detroit, bandits climbed onto the roofs of at least seven gas stations and disabled satellites that send credit information [70]. The sabotage allowed drivers to fill tanks for hours at a time and steal millions in fuel simply by swiping plastic cards at the pump. The above paper also mentions another fraud scenario in which the thieves swapped card readers with their own to wirelessly send PINs and credit card numbers to a remote receiver. The scheme netted USD 4 million from 18,000 bank accounts. Credit and debit cards are the real honeypot for criminal bees because they typically carry key bank details that do not change over time. Thus, if an alternative payment method, such as using one-time codes (and restricted for use in a limited area), is used instead of the card itself, a card-cloning attack can be mitigated.