Petro-Canada has introduced a new one-time passcode requirement for commercial fuel purchases, adding an extra layer of security it says will help combat fuel card fraud across its Petro-Pass network.

As of June 2, drivers using Petro-Canada’s SuperPass fuel card at the company’s more than 300 Petro-Pass cardlock locations must enter a single-use passcode sent by text message before they can fuel.

The move is similar to multi-factor authentication used by banks and other online services and is intended to ensure only authorized drivers can complete transactions.

“At Petro-Canada, protecting our customers and their accounts is a top priority,” James McLean, head of Petro-Canada’s wholesale business, said in responses to questions from trucknews.com. “We implemented this change as part of our ongoing efforts to strengthen security and stay ahead of evolving fraud risks while continuing to provide a reliable commercial fueling experience for our customers.”

Under the new process, drivers insert their SuperPass card at the cardlock terminal and enter any required information, such as odometer readings. A one-time passcode is then sent by text message to the driver’s registered phone number. The driver enters the code at the terminal before proceeding to the fuel pump.

The code expires after 15 minutes and must be obtained each time a driver fuels. Drivers no longer need to remember a separate PIN, as the temporary code serves that purpose.

Petro-Canada says the system is designed to prevent unauthorized use of fuel cards, including cases involving stolen card information or card skimming.

“The only person who can use the code is the driver that’s fueling up, eliminating the risk of fraud or skimming,” the company says in materials provided to fleet customers.

Fleet concerns

The rollout may create challenges for some fleets, particularly those with policies restricting cellphone use during fueling operations.

Petro-Canada acknowledges some customers have raised concerns about no-phone policies. The company says drivers are only required to use their phones to retrieve the passcode before fueling begins.

“Drivers are asked to use their phones only to retrieve the one-time passcode before fueling begins, which happens at the payment terminal and not near the fueling pump,” McLean.

The system also requires fleets to maintain current cellphone numbers for drivers and register them through Petro-Canada’s SuperPass Online account management platform.

Questions have also been raised about the operation in areas with weak cellular coverage. Petro-Canada says it selected SMS-based authentication because text messages require only a basic cellular connection, and that it has not identified widespread connectivity issues at Petro-Pass locations.

If a driver does not receive a passcode, fleet managers can retrieve the active code through SuperPass Online and relay it to the driver. Drivers can also contact Petro-Canada customer support for assistance.

Mandatory for SuperPass users

Petro-Canada says the one-time passcode requirement is now mandatory for all SuperPass users fueling at Petro-Pass commercial locations. In short, ‘no phone, no fuel,’ the company warns in material sent to customers.

To enable the system, fleets must provide a driver’s name, phone number and SuperPass card number. Drivers must verify their enrollment before they can use passcodes.

The company says adoption has been strong since launch.

“Early adoption has already shown that most transactions are being completed using one-time passcodes, reinforcing that customers are adjusting well to this added layer of security,” McLean said.