1. (a) A merchant that has an unattended payment terminal on a motor fuel dispenser at the merchant's place of business, and whose place of business meets the definition of a medium-risk place of business in accordance with subsection (b) of this section, shall implement the following additional practices to prevent the installation of a skimmer on dispensers at that place of business:

   1. (1) As soon as practical, but not later than 90 days after the date on which the merchant's place of business meets the definition of a medium-risk place of business, the merchant shall implement a program to electronically monitor motor fuel dispensers by installing an electronic monitoring device on each dispenser at the place of business with an unattended payment terminal that is not EMV compliant. The merchant's electronic monitoring program must meet the following criteria:

      1. (A) Whenever any door on the motor fuel dispenser is opened without authorization, the electronic monitoring device must:

         1. (i) Immediately shut down power to the dispenser or otherwise prevent the dispenser from dispensing fuel; and
         2. (ii) Sound an alarm that emits an audible alert continuously or at least every 30 seconds until deactivated by the merchant or send a notification to the merchant, including notification to the owner, an executive of the merchant, or someone with supervisory responsibility who has been designated by the owner or an executive of the merchant to receive such notifications;
      2. (B) The electronic monitoring device must create a log of every event (e.g., each time the device is armed, disarmed, triggered, etc.). Such log shall be retained for a minimum of 12 months after the end of the period for which the log was maintained and the merchant shall monitor the logs for suspicious activity, including, for example, that the device was disarmed at unexpected times, that certain employees disarmed the device on a recurring basis, or that the device lost power at unexpected times; and
      3. (C) After the electronic monitoring device has been triggered, the motor fuel dispenser shall remain inoperable until someone that has been properly trained in the identification and detection of skimmers in motor fuel dispensers has inspected the dispenser.
   2. (2) The merchant shall conduct, at least once a month, a thorough inspection of the interior of each motor fuel dispenser with an unattended payment terminal for evidence of tampering or that a skimmer has been installed. Such inspections shall be conducted by a qualified person who has been specifically trained in the identification and detection of skimmers in motor fuel dispensers.

   3. (3) The merchant shall maintain an annual log of all inspections conducted pursuant to paragraph (1)(C) or paragraph (2) of this section and shall retain such logs for a minimum of 12 months after the end of the calendar year for which the log was maintained. The log shall include:

      1. (A) the date and time of the inspection;
      2. (B) the name of person doing the inspection;
      3. (C) the name of the company with which the person doing the inspection is employed, if different from the merchant;
      4. (D) the person's service technician's license number, if applicable; and
      5. (E) an identification of the dispenser inspected.

2. (b) A merchant's place of business is defined as a medium-risk place of business if it meets the following criteria:

   1. (1) A merchant's place of business containing one to ten motor fuel dispensers shall be considered a medium-risk place of business if it has suffered a skimmer breach on more than two separate occasions in the previous 24 months at that place of business;
   2. (2) A merchant's place of business containing eleven to twenty motor fuel dispensers shall be considered a medium-risk place of business if it has suffered a skimmer breach on more than four separate occasions in the previous 24 months at that place of business; or
   3. (3) A merchant's place of business containing more than twenty motor fuel dispensers shall be considered a medium-risk place of business if it has suffered a skimmer breach on more than seven separate occasions in the previous 24 months at that place of business.

Source Note:The provisions of this §56.4 adopted to be effective April 1, 2021, 46 TexReg 147.