A Quebec carrier was billed for diesel in Arkansas and Nevada. Its trucks had never been to either state. The card was never stolen, never lost, and never left the company’s possession.
That is the shape of the problem now. Our August analysis of three prosecutions that took months to surface ended on the point that the mismatch between a route and a transaction sat in the data the whole time. The cases reported since then say something harder. In most of them, every credential check passed.
- Ontario police allege fleet cards were cloned and distributed to drivers, with charges billed to companies whose cards never moved
- A driver arrested in California was carrying more than 80 fraudulent access cards, in a vehicle modified to hold large volumes of fuel
- One Canadian operator has been hit three times through different providers, losing more than $160,000
- An Indiana employer proved 44 unauthorised transactions by showing where its vehicles actually were, four months after the first charge
- Suppliers are now validating transactions against vehicle location, fuel type and tank level rather than card and PIN alone
Valid cards, transactions that never happened
Cloned cards and pump skimmers
Peel Regional Police in Ontario allege suspects cloned fleet cards and handed them to drivers at a Mississauga filling station. The drivers paid for discounted diesel directly while the charges landed on the accounts of the companies whose card data had been copied. Officers seized cloned cards, phones, a laptop and a card-skimming device. A second investigation days later involved more than $2,200 of diesel across four trucks. Truck News reported both cases in July.
California shows the same method with the hardware still attached. Chino Police arrested a man at a petrol station in Colton carrying more than 80 fraudulent access cards, driving a vehicle modified to store large volumes of fuel, after finding a skimming device on a pump. NBC Los Angeles covered the arrest in May.
Charges in states the trucks never entered
ADL Transport, based in Coaticook, Quebec, found diesel purchases on its statements from Arkansas and Nevada. The last transaction the company treats as legitimate was in Springfield, Vermont, in April 2023. The recent charges came to roughly US$5,000, and ADL absorbed the loss itself.
Another Quebec carrier, Groupe TYT, spotted fraudulent transactions early enough to recover them under its supplier’s reimbursement policy. WRS Pro-Transport has been targeted three separate times through different providers, losing more than $160,000 over the years. Three operators, three outcomes, and the difference was largely how quickly anyone looked.
The card nobody switched off
The simplest version needs no technique at all. Evansville Police allege a former RailCrew Xpress employee made 44 unauthorised transactions worth $1,837 between April and July. She was dismissed on 16 July, the card was supposed to be deactivated, and nine transactions ran after that date. 14 News reported the charges in August.
Note how the company proved it. RailCrew Xpress established that at the time of each transaction, the vehicles she would have been driving were either parked at the depot or in use by someone else. That is vehicle location data doing the work, reconstructed by hand, months late.
Dave Graham of UFA Co-operative, who has watched this for fourteen years, puts most losses down to the same cause:
“It’s ultimately end-user card management.”
Cards kept by leavers. PINs written on the back. Limits never set. Accounts never closed.
Why fuel card fraud prevention keeps failing late
Credential checks pass every time
A cloned card presents valid credentials. So does a card that was never deactivated. So did the fictitious merchant accounts in the West Virginia case we covered in August, where the charges cleared without a litre of diesel changing hands.
Authentication asks whether the card is real. It cannot ask whether the purchase makes sense. That second question is the only one that would have caught any of these, and traditionally nobody asks it until reconciliation, which is weeks later and sometimes months.
Who absorbs the loss
The commercial exposure is worse than the fraud figure suggests. Reimbursement terms vary sharply between suppliers. Some refund fraudulent transactions if they are reported inside a set window. Others hold the customer liable whenever valid credentials were used, regardless of whether the physical card ever left the depot. ADL absorbed its loss. Groupe TYT did not. Same country, same year, different contract.
Anyone comparing fuel card providers on pence per litre alone is pricing one variable and ignoring a larger one.
Checking the transaction against the vehicle
Suppliers are moving to context, not credentials
The market has started to shift. Petro-Canada introduced one-time passcodes across more than 300 Petro-Pass cardlock sites, sent by text and expiring after fifteen minutes, so a cloned card alone is not enough. UFA offers geofencing, transaction volume caps, time-of-day limits and per-driver monitoring. WEX recommends daily transaction limits, approved merchant restrictions and routine deactivation of dormant cards.
Motive went further, releasing controls that compare each transaction against vehicle location, fuel type and tank level. A purchase logged hundreds of miles from the truck can be flagged or declined outright. So can a volume larger than the tank will hold.
The underlying change is what the system is being asked. Not whether the card is valid, but whether this purchase is consistent with what this vehicle was doing at that moment.
What a connected fleet can do now
Every case above was found in a statement, an audit or a police file. In each one the disqualifying signal existed at the point of sale. The truck was in Vermont, not Nevada. The van was parked at the depot. The route had no reason to require refuelling away from the company’s own facility.
Connecting payment authorisation to live vehicle data closes that window and removes the argument along with it. When location, mileage and tank capacity validate the transaction before it clears, there is no disputed line item, no reimbursement claim and no reconciliation cycle to wait through. Our work on in-vehicle payments and fleet fraud prevention covers how that authorisation layer works, and our research on exaggerated fuel claims covers the self-reported side of the same gap.
Stop checking the card. Check the vehicle.
See how FleetWallet3 validates every transaction against live vehicle data before the payment clears.
