Mistake 1: drive-offs without a readable plate
NACS estimates fuel drive-offs cost the convenience-store industry over $250 million a year, typically $5K to $20K in unrecovered fuel annually at a single high-traffic station. Most losses go unrecovered because the footage shows a vehicle but not a plate police can run. License plate recognition cameras at the pump-island entry and exit capture every plate, timestamp it, and store it in a searchable database.
Drive-offs don't go to zero, but they drop hard. Police work the cases when the plate is clean, and word spreads among repeat offenders that the station now reads plates. Prepay-required after dark paired with LPR by day closes most of the gap. LPR at the pump island runs $4K to $12K per station depending on layout.
Mistake 2: pump skimmers that nobody flags for weeks
A skimmer install takes 30 to 90 seconds by a person with a master key (the same key opens roughly 70 percent of pumps in the field). The skimmer captures mag-stripe and PIN data and sits inside the pump cabinet for days or weeks until retrieved. The merchant doesn't notice; the cardholders' banks do, eventually, and the Secret Service runs the case across multiple states.
The defenses that work: tamper-evident seals on every pump, regular weights-and-measures inspections, and AI analytics on the pump-island camera that flag the loiter pattern of a skimmer install (a person at a pump for 90 seconds without fueling). PCI-DSS Requirement 9 and Requirement 12 cover this. The free consultation checks whether existing coverage actually catches the install pattern.
Mistake 3: in-store theft the cameras saw but couldn't close
Beer runs, tobacco theft, lottery-ticket theft. The camera saw it, but the cooler-door 720p camera produced a face the night-shift cashier could recognize, not one police could identify, and nothing tied the clip to a plate from the lot camera. The case went into the unsolved pile.
The targeted fix: 1080p or 4K at the cooler door, tobacco wall, and front entrance, with an angle that catches the face on the way out. AI motion analytics that classify person versus vehicle and only alert on real events. LPR on the lot that ties the in-store clip to a vehicle. Police are far more responsive when the operator hands over a clip with a clean face and an LPR match, and word spreads.
Mistake 4: after-hours break-ins with no verification
The alarm trips at 3 AM, the monitoring center calls dispatch, and by the time police arrive the perpetrators are gone. False-alarm fines accumulate; many municipalities now charge $50 to $500 per false alarm after the first two or three of the year, and some have moved to verified-response policies where police won't respond without human verification.
The fix: monitored intrusion with video verification. The alarm trips, the agent pulls the live feed, confirms the threat in seconds, and dispatches with verified status. Police arrive faster because the call carries verification. Major intrusion and alarm-panel platforms all support video-verified intrusion. Operating cost is $50 to $200 per month per site.
Mistake 5: PCI-DSS exposure on the pumps themselves
Each gas pump is a payment terminal. PCI-DSS v4.0 Requirement 9 requires physical access controls at every point where cardholder data is handled: the pumps, the back-office where the POS lives, and any room with payment-processing equipment. Required controls: tamper-evident seals on pumps, camera coverage of the pump island and back-office, badge access on the back-office door, 90-day footage retention, and incident retrieval inside one business day.
Card-brand non-compliance fines run $5K to $100K per month, with merchant-bank surcharges on top. The audit catches the gaps before the QSA does. The fix is mostly retention configuration, camera placement, and a written incident-response workflow; the cameras you already own often pass once the documentation catches up. (Full upgrade cost bands are in the FAQ below.)