Fleet fuel card security generally requires combining technology-based controls with clear policies and employee training to protect against fraud and unauthorized use. Fuel card fraud can result in significant financial losses, and prevention can be more effective than attempting to recover funds after theft occurs. According to the Association of Certified Fraud Examiners’ Occupational Fraud 2026: A Report to the Nations, the median loss per occupational fraud case was $104,000, and the typical scheme lasted 12 months before it was detected1. Effective security practices include implementing appropriate card controls, monitoring transactions, training employees on proper card usage, responding promptly to suspicious activity and regularly reviewing security measures. Exxon Mobil BusinessPro fleet cards provide built-in security features designed to help protect businesses, but maximizing protection typically requires combining these features with sound operational practices and oversight.
Ready to enhance security? Discover Exxon Mobil BusinessProTM program security features.
Implement Layered Purchase Restrictions
Effective security begins with implementing purchase restrictions to limit how fleet cards can be used. Multiple layers of restriction can make unauthorized use more difficult. Here are a few examples of how such restrictions can benefit your business:
- Merchant restrictions can limit cards to fuel-only merchants
- Transaction limits can cap individual purchase amounts
- Geographic restrictions can confine usage to operational areas
- Time-based controls can help prevent off-hours transactions
These restrictions can be used together to help reduce fraud exposure. Businesses should configure restrictions based on actual operational needs. All controls can be adjusted as necessary.
Require PIN Protection for All Transactions
PIN requirements add an important security layer by helping ensure card possession alone is insufficient to complete transactions. When PINs are required, stolen cards are generally less useful to thieves because completing purchases requires knowing the PIN. Businesses should establish policies requiring PIN use for all fuel card transactions and train employees never to share PINs or write them on cards. PIN protection can reduce the risk of successful fraud from lost or stolen cards and can be an effective control. In the Federal Reserve’s payments fraud study, the fraud rate by value for card-present PIN-authenticated payments was 3.99 basis points in 2015, less than one-third the 12.78 basis points recorded for card-present payments that did not require a PIN.2
Assign Cards to Specific Vehicles or Drivers
Card assignment helps create accountability by linking each transaction to a specific vehicle or driver. This can make it easier to detect unauthorized use because transaction patterns are expected to generally align with known vehicle locations and driver schedules. When cards are assigned specifically rather than shared across multiple vehicles, unusual activity can become more apparent. Card assignment also enables more precise purchase controls tailored to specific vehicle or driver requirements. The accountability created by fleet card assignment can help deter misuse because employees know their card activity is tracked individually.
Monitor Transactions and Respond to Alerts
Active monitoring is important for detecting fraud quickly and helping minimize losses. Businesses should configure real-time alerts for suspicious patterns such as multiple purchases in short timeframes, transactions at unusual locations, large purchases or off-hours activity. Prompt investigation of alerts helps determine whether transactions are legitimate or fraudulent. Quick response to alerts increases the chance that a business can deactivate compromised cards before significant losses occur. The faster fraud is detected and addressed, the less financial impact it typically has. The Association of Certified Fraud Examiners reports that schemes detected within six months carried a median loss of $40,000, while schemes that ran more than five years carried median losses exceeding $1.1 million.3
Businesses should configure real-time alerts for suspicious patterns such as multiple purchases in short timeframes, transactions at unusual locations, large purchases or off-hours activity.
Train Employees on Proper Card Handling
Employee training can be a critical security component. Drivers and other employees should understand how to handle fleet cards securely, why security measures are important, what constitutes unauthorized use and how to report lost or stolen cards immediately. Training should cover PIN protection, proper card storage, restrictions on sharing cards and consequences of policy violations. Regular refresher training helps maintain awareness and helps ensure new employees receive proper instruction. Well-trained employees can provide an additional layer of security. In the Association of Certified Fraud Examiners’ 2026 study, organizations that trained both staff-level employees and management reported a median fraud loss of $84,000 per case, compared with $150,000 at organizations without training.4
Drivers and other employees should understand how to handle fleet cards securely, why security measures are important, what constitutes unauthorized use and how to report lost or stolen cards immediately.
Establish Clear Reporting Procedures
Quick reporting of lost or stolen cards is important for helping limit fraud exposure. Businesses should establish clear procedures for employees to report missing cards immediately, provide 24/7 emergency reporting contact information, and designate personnel responsible for deactivating cards. The faster a lost card is reported and deactivated, the more a business can minimize the potential window for unauthorized use. Companies should make sure every driver understands how immediate reporting can reduce the risk of larger losses. Making reporting easy and available at all times can encourage prompt notification.
Conduct Regular Account Reviews
Periodic account reviews help identify security issues. Businesses should regularly review transaction reports for unusual patterns. Verifying card usage aligns with operational expectations, ensuring security settings remain appropriate, and confirming inactive cards have been deactivated are important steps that can help protect fleet resources. Regular reviews can also identify gradual changes in spending patterns. Such changes may indicate ongoing low-level fraud. Quarterly or monthly reviews, depending on fleet size, typically provide effective oversight without creating excessive administrative burden.
Deactivate Unused Cards Promptly
When fleet cards are no longer needed, they should be deactivated immediately to help reduce unnecessary exposure to fraud or misuse. When employees leave, vehicles are sold or cards are replaced, prompt deactivation can help prevent forgotten cards from being discovered and misused later. The Federal Trade Commission’s guide Protecting Personal Information advises businesses to have a procedure in place so that workers who leave no longer have access, terminating their passwords and collecting keys and identification cards as part of the check-out routine. Businesses should maintain inventories of active cards and regularly verify active cards have legitimate operational purposes. Deactivation should be part of standard procedures for employee termination and vehicle disposition. Maintaining tight control over card inventory can reduce potential security vulnerabilities.
Review and Update Security Practices Regularly
Security threats evolve, and protection measures should be reviewed regularly to help ensure they remain effective. When businesses perform such reviews they should:
- Evaluate whether current controls are working as intended
- Check whether new security features would add value
- Review policies and training to make sure they remain up to date
- Determine whether past incidents indicate areas for improvement
Annual security reviews, combined with reviews after any fraud incidents, help ensure protection measures keep pace with changing risks.
Compare Exxon Mobil fleet cards to understand the protection capabilities available for your fleet operations.
2. Board of Governors of the Federal Reserve System, “Changes in U.S. Payments Fraud from 2012 to 2016: Evidence from the Federal Reserve Payments Study,” October 2018, https://www.federalreserve.gov/publications/2018-payment-systems-fraud.htm.
3. Association of Certified Fraud Examiners, “Key Findings from Occupational Fraud 2026: A Report to the Nations,” ACFE Insights Blog, https://www.acfe.com/acfe-insights-blog/blog-detail?s=key-findings-report-to-the-nations-2026.
4. Association of Certified Fraud Examiners, “Key Findings from Occupational Fraud 2026: A Report to the Nations,” ACFE Insights Blog, https://www.acfe.com/acfe-insights-blog/blog-detail?s=key-findings-report-to-the-nations-2026.
