She Found a Gas Pump's Hidden Demo Mode - and Used It 510 Times

When a gas station software update rolls out, the engineers run their tests and move on. Nobody expects a customer to reverse-engineer the test mode from the forecourt - but that is exactly what Dawn Thompson did.

The Glitch Nobody Was Looking For

In November 2022, the Pump & Pantry station near West O Street and Sun Valley Boulevard in Lincoln, Nebraska received a routine software update to its fuel pump management system. The update introduced a bug: swiping a rewards card twice in succession put the pump into demo mode - a test state designed for engineers, in which gas flows freely without triggering any payment. Pump & Pantry's parent company, Bosselman Enterprise, had no idea the vulnerability existed.

510 Visits, Six Months, Zero Dollars

Thompson, 45, discovered the double-swipe trick and returned to the same station again and again. Between November 13, 2022 and June 1, 2023, she used the exploit 510 separate times - sometimes multiple visits in a single day. By the time the bug was quietly patched on June 1, 2023, she had pumped 7,413.59 gallons of fuel, at an average price of $3.758 per gallon, for a total loss to the station of $27,860.27.

Side Hustle

Thompson did not keep the trick entirely to herself. Police identified at least one other person who had used the card - a woman who told investigators Thompson let her fill up in exchange for cash, paying $500 for approximately $700 worth of fuel across ten visits. Thompson was effectively running a discount fuel operation out of a software bug.

The Investigation and Arrest

Investigators pieced together the transaction history through the rewards card logs, which recorded every swipe with a timestamp. After a months-long investigation, Thompson was arrested on March 6, 2024 and charged with one count of theft by unlawful taking over $5,000 - a felony under Nebraska law. The charge carries a potential prison sentence of up to five years.

What the Station Missed

The case raised pointed questions about how a demo mode that dispenses real fuel without payment was left active on a live pump for more than six months. Bosselman Enterprise has not publicly commented on how the vulnerability went undetected for so long. Thompson's rewards card logs were the very evidence that caught her - the same system that let her steal recorded every single transaction.