The fuel e-sticker: how do we stop fuel siphoning?

On 1 November Egypt’s Ministry of Petroleum started a one-month trial in Port Said of a system that tracks fuel through each car’s electronic traffic sticker. Stations read the sticker to log every fill-up, and one stated goal is spotting unusual consumption. The ministry says it won’t limit quantities or touch prices.

I got a strange but fair question: what if someone fills the tank, siphons the fuel out, sells it and comes back to fill up again? Then the sticker becomes a way to profit instead of a control.

In this article I propose a simple solution, then test it with a security mindset: how could it be fooled, and how do we close each gap?

The proposed solution: sticker + odometer

Two steps: scan the sticker to identify the car, and photograph the odometer to see how far it has driven since the last refuel.

The system knows the car’s model and its typical consumption, so it calculates the expected amount:

L_expected = (km_now − km_last) ÷ 100 × L100

Here L100 is the model’s consumption in litres per 100 km.

Example: a car that uses 8 litres per 100 km has driven only 50 km and asks for 40 litres. The expected amount is about 4 litres, so the gap is large and worth a review.

A more accurate check is cumulative across several refuels, because drivers don’t always fill the tank. The total fuel a car has taken should never exceed what it actually burned by more than one tank’s capacity.

The car is refuelled either way. An anomaly is simply logged for a later human review.

Threats and controls

Any control system will attract people trying to game it. These are the most likely attacks, each with its matching control. No single control is enough on its own (defence in depth).

1. Fuel siphoning

The driver fills the tank, drains and sells the fuel, then comes back to refuel. The control is a cumulative comparison of fuel dispensed against distance driven.

2. Spoofed or replayed photo

Someone submits an old odometer photo or an edited one. So the photo is a live capture from the station’s device only, with a signed timestamp and device ID. No uploads from the driver’s phone.

3. Sticker transfer or cloning

A parked car’s sticker gets used on another car. Automatic plate reading (ANPR) matched to the sticker stops this, along with a tamper-evident sticker that breaks when removed.

4. Odometer tampering

The odometer is tampered with so the distance looks longer or shorter. Any reading lower than the previous one triggers an instant alert. A siphoner needs the opposite, though: a higher reading to justify the fuel. So a jump too big for the time since the last refuel, like 2,000 km in two days, is flagged for review too.

5. Insider threat

A station attendant records a fake reading for a bribe. Every transaction is tied to the attendant’s identity and device, with anomaly detection per attendant and station, and an append-only audit log.

This is the most dangerous gap, because the attendant controls both the device and the camera. Technology alone can’t stop it, but it ties every transaction to a specific person. An attendant whose pattern differs from their colleagues’ will stand out quickly.

6. Double dipping

The driver refuels at several stations within a short time. The answer is one central record per car, visible to every station in real time.

Flag, don’t block

The system flags unusual cases for review. It does not block refuelling automatically.

The reason is false positives: a broken odometer, a long road trip, or a car that spends hours in traffic and burns more than average. Automatic blocking would punish innocent drivers and create queues.

• Every transaction gets a risk score instead of a yes/no decision.
• The final call is made by a person (human in the loop), and action follows a repeated pattern, not a single event.
• A car with a broken odometer is registered as a special case with a grace period to fix it.

Privacy

The system needs the number, not the photo, so it shouldn’t keep what it doesn’t need (data minimisation):

• Photo: the reading is extracted, then the photo is deleted, unless it is flagged and kept for review only.
• Stored: sticker number, odometer reading, amount, station and time. No tracking of the car’s location outside stations.
• Access: encrypted data, least-privilege permissions, and a log of everyone who views a car’s records.
• Retention: a fixed, published retention period, after which old records are deleted.

Conclusion

“Sticker scan + odometer photo” is a simple idea. Its real value is in the security details around it: who takes the photo, how we prove it’s genuine, and what we do when something looks off. The idea is simple, but the devil is always in the security.

See a gap I missed? Let me know.

This is my personal take on solving the problem, not a description of the official system or how it is built.