When Philippe Laprise reviewed his company’s fuel card statements, the transactions didn’t make sense.

His Coaticook, Que.-based trucking company, ADL Transport, had been billed for diesel purchases in Arkansas and Nevada — states where none of the company’s trucks had been. The last transaction the company considers legitimate occurred Apr. 11, 2023, in Springfield, Vt. ADL says everything that followed was fraudulent.

The charges eventually totalled about US$5,000. Instead of being reimbursed, the company says it was left holding the bill.

“We’re the ones who absorbed the loss,” Laprise told transportroutier.ca. “It came straight out of our pockets.”

ADL’s experience isn’t unique.

Another Quebec carrier, Groupe TYT, detected fraudulent transactions on Harnois fuel cards earlier this year but recovered its losses because the fraud was reported quickly under the supplier’s reimbursement policy. WRS Pro-Transport, meanwhile, says it has been victimized three separate times through different fuel card providers, suffering more than $160,000 in losses over the years.

The differing outcomes highlight a growing concern: commercial fuel card fraud is not only becoming more sophisticated, but carriers may discover too late that not every fuel supplier handles fraud the same way.

As organized criminals find new ways to compromise fleet fuel cards, suppliers are responding with stronger authentication, tighter spending controls and technology that can identify suspicious transactions before a drop of diesel is pumped.

Organized theft

Fuel fraud has long since moved beyond the occasional stolen card.

Recent investigations by Peel Regional Police in Ontario illustrate how sophisticated the schemes have become.

In one case, police allege suspects cloned legitimate fleet fuel cards and distributed them to truck drivers at a Mississauga, Ont., fuel station. Drivers paid the suspects directly for discounted diesel while the fuel charges were billed to the trucking companies whose card information had been compromised. Officers seized cloned fuel cards, multiple cell phones, a laptop and a card-skimming device.

A second investigation days later resulted in another arrest after police allege fraudulent fuel cards were used to purchase more than $2,200 worth of diesel for four trucks.

Police warned that anyone knowingly purchasing suspiciously discounted fuel could face criminal charges.

The cases help explain why carriers sometimes discover fuel purchases hundreds or even thousands of miles from where their trucks actually operate. In many cases, the physical card never left the fleet’s possession. Instead, card information is believed to have been cloned and reused elsewhere.

An old problem with new attention

Dave Graham, quality and technical specialist for fuels and lubricants with UFA Co-operative, says fuel card theft is hardly new.

“I started with UFA 14 years ago, and 14 years ago we were having issues,” he told trucknews.com, recalling customers discovering overdue fuel charges that ultimately proved to be fraudulent.

What’s changed, he believes, is awareness.

With fuel accounting for roughly one-quarter of many fleets’ operating costs, carriers are paying much closer attention to suspicious transactions than they did a decade ago.

Some of the biggest losses, Graham says, still stem from surprisingly simple mistakes.

Employees leave a company but keep their fuel card. PIN numbers are written on the back of cards. Fleet managers forget to deactivate cards or place limits on them. Months later, someone notices a former employee has been filling pickups, portable tanks or other vehicles using an active fleet account.

“It’s ultimately end-user card management,” Graham said. “People just paying attention to their accounts. That’s the big one.”

Fighting fraud before it happens

Fuel suppliers are increasingly trying to stop fraud before it occurs rather than helping customers sort through disputed transactions afterward.

Petro-Canada recently introduced one-time passcodes for SuperPass users fueling at its more than 300 Petro-Pass cardlock locations across Canada.

Under the new system, drivers insert their fuel card as usual, but before they can begin fueling they receive a one-time PIN by text message that must be entered at the terminal. The code expires after 15 minutes and a new code is required for every transaction. Petro-Canada says the approach works much like multi-factor authentication used by banks and online retailers, helping ensure only the authorized driver can complete the purchase.

The move has generated mixed reactions among fleets. Some drivers object to providing personal cellphone numbers to their fuel supplier. Others question how the system works in areas with limited cellular service or where fleets prohibit cellphone use while fueling.

Petro-Canada says drivers only need to retrieve the code at the payment terminal before fueling begins and that text messaging was chosen because it requires only a basic cellular connection. Fleet managers can also retrieve active passcodes through the company’s online management portal if a driver doesn’t receive the text.

“Early adoption has already shown that most transactions are being completed using one-time passcodes, reinforcing that customers are adjusting well to this added layer of security,” James McLean, head of Petro-Canada’s wholesale business, told trucknews.com.

Finding the right balance between convenience and security is not easy, Graham acknowledged.

“You can either make things really super secure and then it’s not very user-friendly, especially for large fleets,” he said. “On the opposite end of the spectrum, security being so lax … then you’re running the risk of easier theft.”

Beyond passwords

One-time passcodes represent just one layer of protection.

Many fuel card providers now offer online account management tools that allow fleets to monitor transactions in real time, suspend or cancel cards immediately, set purchase limits, restrict cards to certain merchants or geographic areas, and receive notifications when unusual transactions occur.

“I would recommend fleet managers use every tool that they have accessible to them to be able to limit that possibility of theft.” – Dave Graham, UFA

UFA, for example, allows fleets to manage cards online, establish geofencing parameters, restrict transaction volumes, limit purchases within specific time periods and monitor activity by individual card or driver. Graham encourages fleets to use every tool available.

“I would recommend fleet managers use every tool that they have accessible to them to be able to limit that possibility of theft,” he said.

WEX recommends fleets go even further by limiting the number of daily transactions a card can perform, restricting purchases to approved merchants, implementing time-of-day controls, requiring trip number validation and regularly disabling unused cards.

Some providers are beginning to integrate fuel purchases with telematics.

Motive recently introduced AI-powered fraud controls that compare fuel transactions against vehicle location, fuel type and tank levels. A fuel purchase made hundreds of miles from the truck’s actual location, for example, can trigger an alert or be automatically declined. Other alerts can identify purchases involving the wrong fuel type or fuel volumes that exceed a vehicle’s expected capacity.

Rather than simply verifying that a card and PIN are valid, these systems ask whether the transaction itself makes sense.

Read the fine print

Technology alone won’t eliminate fuel fraud.

The experiences shared by carriers interviewed for this story also highlight the importance of understanding a provider’s fraud policies before signing up.

Some suppliers reimburse fraudulent transactions if they’re reported within a prescribed time frame. Others may determine the customer remains responsible if valid card credentials were used, regardless of whether the physical card was ever in the driver’s possession.

Graham recommends fleets ask prospective suppliers about more than fuel prices.

“What security steps or processes does that company have? Is there two-step verification? What kind of notifications does the company give the end user? How easy is it to contact someone if something goes south?” he said.

Those questions could make the difference between quickly stopping a fraudulent transaction and discovering weeks later that someone has been buying thousands of dollars worth of diesel on your account.

As criminals continue to evolve their methods, so too are the industry’s defenses. But the strongest protection may still be the simplest: monitoring fuel card activity regularly, using available security tools and acting immediately when something doesn’t look right.

• Transport Routier editor Steve Bouchard contributed to this report