A merchant that has an unattended payment terminal on a motor fuel dispenser at the merchant's place of business shall implement the following practices to prevent the installation of a skimmer on the dispenser:

1. (1) The merchant shall implement and maintain written policies and procedures and shall conduct training as detailed in §56.2 of this title (relating to Policies, Procedures, and Training).
2. (2) For each motor fuel dispenser with an unattended payment terminal, the merchant shall affix to or install onto the exterior of each door that provides access to an interior portion of the motor fuel dispenser from which the payment terminal or any electronic component connected to the payment terminal may be accessed, a locking device that requires an access key unique to that place of business.

3. (3) The merchant shall maintain a forecourt maintenance log that documents all work performed on the forecourt within the calendar year. The merchant shall require every person working on or accessing a dispenser to perform maintenance to sign in and present appropriate identification before any work is done on a dispenser or a payment terminal on a dispenser. The merchant shall retain the forecourt maintenance log for a minimum of 12 months after the end of the calendar year for which the log was maintained. The maintenance log shall include at a minimum:

   1. (A) the name of the person working on or accessing the dispenser;
   2. (B) the name of the company with which the person is employed;
   3. (C) the person's service technician's license number, if applicable;
   4. (D) the time at which the person began maintenance on the dispenser;
   5. (E) the time at which the person finished maintenance on the dispenser; and
   6. (F) an identification of the dispenser or other equipment where work was performed.

4. (4) The merchant shall use tamper-evident security labels to restrict unauthorized access to any unattended payment terminal on a motor fuel dispenser that is not EMV compliant and that is not protected by an electronic monitoring device. The merchant's use of tamper-evident security labels shall meet the following requirements:

   1. (A) A tamper-evident security label must be placed over each panel opening that provides access to an interior portion of the dispenser from which the payment terminal or any electronic component connected to the payment terminal may be accessed;
   2. (B) Each tamper-evident security label shall contain a serial number. Each tamper-evident security label used within a 12-month period must have a different serial number; and
   3. (C) The merchant shall keep an annual log documenting the serial number of each currently installed label. Each time a label is changed, the merchant shall document the new serial number and reason for the change. The serial label log may be maintained electronically (e.g., through the use of a mobile application or software program). The merchant shall retain such logs for a minimum of 12 months after the end of the calendar year for which the log was maintained and shall regularly review the logs to ensure that they do not reveal a pattern of suspicious conduct.

5. (5) The merchant shall, at least daily, conduct a thorough inspection of the exterior of each motor fuel dispenser with an unattended payment terminal. In conducting such inspections, the merchant shall:

   1. (A) Inspect the exterior of each motor fuel dispenser for signs that the dispenser has been opened or tampered with, including, for example, by confirming all locks are secured, and that there are no signs of scratches, pry marks, drilled holes, or other indications that a door has been compromised;
   2. (B) Inspect the exterior of each motor fuel dispenser for signs of skimmers, shimmers, insert skimmers, overlay skimmers, hidden cameras, wireless antennas, new stickers or decals that might be hiding a hole, or other foreign objects;
   3. (C) If tamper-evident security labels are required by paragraph (4) of this section or are otherwise used by the merchant, inspect each serialized, tamper-evident label to ensure that the serial number matches the serial number log and that the label has not been cut or tampered with;
   4. (D) Maintain a current photograph of the merchant's motor fuel dispensers, and make the dispenser photograph easily accessible to employees inspecting dispensers so that they can use the photograph to identify unauthorized stickers, decals, leaflet holders, and other materials that may have been added to hide holes or other alterations made to a dispenser. If all of the merchant's motor fuel dispensers are substantially similar, the merchant is only required to maintain one photograph that can serve as an exemplar for all substantially similar dispensers;

   5. (E) Maintain an annual log of each inspection conducted and retain such log for a minimum of 12 months after the end of the calendar year for which the log was maintained. Such logs shall include:

      1. (i) the date and time of the inspection;
      2. (ii) the name of person who did the inspection; and
      3. (iii) an identification of the dispensers inspected; and
   6. (F) If an inspection reveals any sign that a motor fuel dispenser has been opened or tampered with or that a skimmer has been installed, disable the dispenser and take appropriate steps to prevent customers from inserting a payment card into the payment terminal until someone who has been properly trained in the identification and detection of skimmers in motor fuel dispensers has inspected the dispenser. The merchant shall maintain a current photograph of the interior of the dispenser that was taken at a time when the merchant is confident that there was no skimmer installed that can be used by the inspector to compare for unauthorized items installed inside the dispenser. If all of the merchant's motor fuel dispensers are substantially similar, the merchant is only required to maintain one photograph that can serve as an exemplar for all substantially similar dispensers.
6. (6) The merchant shall monitor its dispensers and payment terminals for high levels of invalid payment card read errors or other indications of problems accepting payment cards which may indicate the presence of a skimmer. If the merchant detects such suspicious behavior, or if the merchant is notified by a card brand, a payment processor, a financial institution, law enforcement, or the Center that the merchant's place of business or a dispenser at the merchant's place of business is a common point of purchase for fraudulent activity, the merchant shall take reasonable steps to investigate whether a skimmer has been installed on one of its dispensers. If a merchant receives or observes credible evidence that a skimmer has been installed on a specific motor fuel dispenser, the merchant shall immediately disable the suspected dispenser until someone who has been properly trained in the identification and detection of skimmers in motor fuel dispensers has inspected the dispenser.
7. (7) If disabling a motor fuel dispenser as required by paragraph (5)(F) or paragraph (6) of this section would cause a hardship on the merchant or substantially disrupt the merchant's business, the merchant may continue to allow the dispenser to operate but shall disable the payment terminal or take other steps to prevent customers from using the payment terminal or inserting a payment card into the payment terminal.

8. (8) The merchant shall maintain an annual log of all inspections conducted pursuant to paragraph (5)(F) or paragraph (6) of this section and shall retain such logs for a minimum of 12 months after the end of the calendar year for which the log was maintained. The log shall include:

   1. (A) the date and time of the inspection;
   2. (B) the name of person doing the inspection;
   3. (C) the name of the company with which the person doing the inspection is employed, if different from the merchant;
   4. (D) the person's service technician's license number, if applicable; and
   5. (E) an identification of the dispenser inspected.

Source Note:The provisions of this §56.3 adopted to be effective April 1, 2021, 46 TexReg 147.