Key takeaways:
- Prosecutors say two stolen fuel cards were used in 136 refuelling transactions.
- The diesel was reportedly dispensed into 84 vehicles, with total consumption reaching around 54,000 litres.
- The Croatian transport company’s losses were estimated at around €68,000.
- During the trial, the defendant named two alleged accomplices who reportedly worked for the affected company: one as a lorry driver and the other responsible for checking invoices.
- An expert says a PIN alone is not enough to protect a fuel card. Spending limits, transaction monitoring and segregated access rights are also essential.
136 transactions, 84 vehicles and 54,000 litres of diesel
The investigation began after a Croatian transport company reported that two of its fuel cards had been stolen.
In March 2026, Salzburg police initially reported at least 84 refuelling transactions and losses of almost €68,000. Further investigation suggested that the fraud was more extensive.
At a hearing before the Salzburg Regional Court, the prosecutor said the cards had been used 136 times between September 2025 and January 2026. The fuel was reportedly dispensed into 84 vehicles, with the total volume reaching around 54,000 litres of diesel.
According to evidence presented in court, the 29-year-old defendant reportedly offered diesel to other people at €1 per litre. The transactions at a filling station in Salzburg’s Gnigl district were paid for with the Croatian carrier’s cards, while the drivers handed cash to the person allegedly organising the scheme.
Some customers reportedly arrived with their vehicles as well as additional containers.
Investigation also focuses on company employees
The proceedings also highlighted a key risk for transport operators: the possibility of internal involvement.
The defendant said he passed the money collected from customers to people who, according to him, had supplied the stolen cards. When questioned, he named two alleged accomplices.
Information disclosed during the trial indicated that both individuals had worked for the Croatian company. One was reportedly a lorry driver, while the other was responsible for checking invoices.
The prosecutor announced further proceedings concerning the two individuals. For now, these remain allegations and statements that still need to be investigated. Their alleged responsibility has not been established by a final court judgment.
The defendant also reportedly admitted using around 2,500 litres of fuel for himself without paying for it.
A PIN alone cannot protect a carrier
The Salzburg case shows that the risk extends beyond the physical theft of a card.
Andrei Arkhutsik, Product Manager at E100, says:
With fuel cards, one of the biggest mistakes is assuming that a single safeguard, such as a PIN, a spending limit or locking the card, is enough to guarantee security. Risk can emerge at several different stages.
The basic rules are similar to those for bank cards. Drivers should not hand their fuel cards to other people, PINs should not be stored alongside the cards, and any loss should trigger an immediate response.
Companies also need a clear overview of which cards are active, which vehicles they are assigned to and who is authorised to use them.
Which refuelling transactions should raise concerns?
An unusual transaction is not automatically evidence of fraud. Several refuelling transactions on the same day or a higher-than-usual volume may be explained by genuine operational requirements.
The warning signs become more significant when several inconsistencies appear at the same time.
According to the expert, companies should pay particular attention to:
- multiple refuelling transactions within a very short period;
- an unusually large volume of fuel;
- a sudden change in how frequently a card is used;
- a transaction at a location that does not fit the planned route;
- a transaction recorded far from the lorry’s actual location.
Arkhutsik stresses:
An unusual event should trigger a review. It should not automatically lead to the conclusion that fraud has occurred.
That is why the transaction time and location should be compared with the card’s history, the planned route and the vehicle’s actual position.
Set card limits according to the lorry’s actual work
Correctly configuring fuel cards is one way to limit potential losses. Controls can cover the transaction value, the number of litres, the number of purchases, specific countries or even individual stations. They should not be set arbitrarily or left unchanged for years.
When setting limits, companies should consider tank capacity, the normal volume of each refuelling stop, usage frequency, regular routes and how the vehicle is actually used.
A limit that is too low can disrupt a driver’s work. One that is too high creates unnecessary scope for misuse.
Separating card administration and expense checks reduces risk
The Austrian case also draws attention to the risks created when too much control is concentrated in one person’s hands.
If one employee can request cards, change their settings, monitor transactions and later review the related expenses, there is almost no independent oversight.
Arkhutsik points out:
The same person could carry out a sensitive operation and then supervise it themselves.
The expert recommends separating at least three areas: requesting and configuring cards, monitoring transactions on a daily basis and settling expenses.
This does not necessarily require three separate employees. The important point is to have a second layer of control for the most sensitive operations.
Where possible, companies can also apply the four-eyes principle, requiring a second person to approve certain changes.
Review cards and permissions regularly
The list of active cards should not be reviewed only after an irregularity has been detected. The expert considers a full review of cards and permissions at least once every quarter a reasonable benchmark.
An immediate review is also advisable when an employee leaves, a driver changes assignment, a vehicle is sold or responsibilities are reassigned.
Among other checks, companies should confirm:
- whether each active card is still needed;
- whether it is assigned to the correct vehicle or user;
- whether cards linked to retired vehicles have been deactivated;
- whether employees still need all the permissions they have been given;
- who has administrative access to the card management system.
Suspicious refuelling? The first few minutes matter
When a company spots a transaction that may indicate unauthorised use, the first step should not be to spend hours reviewing the entire transaction history.
Arkhutsik says:
In this situation, it is not a matter of hours but of the first few minutes. The priority should be to prevent further transactions by temporarily blocking the card or the affected account.
The company should then preserve the information needed to establish what happened: the exact time and location of the refuelling, transaction and card details, the vehicle’s actual location and the history of previous transactions.
If user accounts may also have been compromised, permissions and system access should be reviewed as well.
The next step should be to contact the card issuer, check whether any other suspicious transactions have appeared and begin an investigation.
Fuel card risk goes beyond physical theft
The Salzburg case shows that fuel card security cannot stop at protecting the physical card and its PIN.
According to information presented during the proceedings, the stolen cards were allegedly used over several months. The proceedings also raised the possibility that people connected with the affected company itself may have been involved.
For carriers, this means prevention must cover three areas at once: user behaviour, card and permission settings, and the transaction data itself.
The larger the fleet, the harder it becomes to identify these patterns manually. Regular reviews, properly calibrated limits, alerts for unusual transactions and comparisons between refuelling locations and a lorry’s actual route can help expose a problem before dozens of unauthorised transactions accumulate.
