Gas Station Security: Cameras, Lighting & Robbery Prevention

Why Gas Station Security Deserves a Dedicated Compliance Framework

Gas stations operate around the clock, handle cash, dispense flammable product, and serve customers in open, high-traffic environments. That combination makes the forecourt one of the more challenging security environments in retail. Robberies, drive-offs, skimmer installations, and fuel theft all carry direct financial losses—but inadequate security also creates OSHA exposure, insurance liability, and, in some jurisdictions, regulatory violations tied to lighting and camera requirements.

This guide walks through the physical security layers that matter most: camera systems, lighting, cash-handling environment, and employee protocols. For the active-threat and robbery-response training dimension, see our companion piece Gas Station Robbery Prevention & Active Threat Training, which covers employee response procedures in depth.

The Regulatory Landscape for Gas Station Security

No single federal regulation mandates a specific camera count or lumen level for fuel retail sites. Instead, security requirements come from several overlapping sources:

• OSHA General Duty Clause (Section 5(a)(1) of the OSH Act): Employers must provide a workplace free from recognized hazards likely to cause death or serious physical harm. OSHA has cited the General Duty Clause in cases where employers failed to address known workplace violence risks, including in retail environments.
• State and local ordinances: Many states and municipalities have enacted specific gas station security ordinances covering minimum lighting levels, camera resolution, and cash-handling limits. These vary widely—check with your state petroleum marketers association and local fire marshal or building department.
• Branded fuel agreements: Major oil company franchise agreements frequently include security standards as a condition of brand authorization. Failure to comply with a reasonable, materially significant franchise provision is a ground for termination or nonrenewal under the Petroleum Marketing Practices Act (15 U.S.C. 2802(b)(2)(A)), subject to the notice requirements of 15 U.S.C. 2804.
• Insurance carrier requirements: Commercial property and general liability underwriters increasingly require documented security programs as a condition of coverage or favorable premiums. Review your policy's loss-control addendum carefully.
• PCI DSS: Payment card security standards govern how cardholder data is protected at dispensers and the POS—a dimension that intersects with physical security at the pump. See our guide on PCI DSS v4.0.1 for Fuel Retailers for the payment-security side of this equation.

OSHA Penalty Exposure

Failing to address a recognized workplace violence hazard can result in a General Duty Clause citation. As of January 15, 2025, OSHA's maximum penalty for a serious violation is $16,550 per violation, while willful or repeated violations carry a maximum of $165,514 per violation and a minimum of $11,823 per violation (29 CFR 1903.15). Gas stations (NAICS 4471) are partially exempt from routine OSHA 300/300A/301 recordkeeping under 29 CFR 1904 Subpart B, Appendix A—but that exemption does not reduce penalty exposure for substantive safety violations, and fatality and hospitalization reporting under 29 CFR 1904.39 still applies.

Camera System Design: Coverage, Resolution, and Retention

Where Cameras Must Cover

A well-designed camera system for a fuel retail site should provide clear, overlapping coverage of every area where a crime could occur or evidence would be needed. At minimum, plan for:

Resolution and Image Quality

Camera resolution requirements in state ordinances are typically expressed as minimum pixel counts sufficient to identify a face at a specified distance. Many jurisdictions that have enacted gas station security ordinances require cameras capable of producing an image usable for law enforcement identification purposes. As a practical benchmark, systems capable of capturing a recognizable face at the distances typical of a convenience store counter or pump island generally require high-definition resolution. Consult your local ordinance and your insurance carrier's loss-control guidelines for the specific standard that applies to your site.

For forecourt video analytics and license plate recognition (LPR) deployments, the legal framework is more complex. Our article on Forecourt Video Analytics and LPR: Get the Law Right First covers state-by-state privacy law considerations in detail. Note that California Civil Code 1798.90.5 et seq. (Title 1.81.23) imposes security, policy-posting, and access-logging obligations on private ALPR end-users, while New Hampshire RSA 261:75-b restricts automated plate scanning to law enforcement—making a private forecourt LPR deployment there a matter requiring legal advice before installation.

Video Retention

State ordinances and insurance carriers typically specify a minimum retention period for recorded footage. Common requirements range from 30 to 90 days, though some jurisdictions specify longer periods for footage associated with an incident. Establish a written retention policy, document it, and ensure your system has sufficient storage to meet it. When an incident occurs, preserve relevant footage immediately—overwrite cycles can destroy evidence before law enforcement requests it.

System Integrity and Monitoring

• Cameras should record continuously, not only on motion triggers, during all operating hours.
• Use tamper-evident housings and mount cameras out of easy reach.
• Test recording and playback quality on a documented schedule—a camera that appears operational but is not recording is worse than no camera, because it creates a false sense of security.
• Store recordings on a network video recorder (NVR) or cloud system that is physically separate from the sales floor and not accessible to general staff.
• Consider remote monitoring services that can alert management or law enforcement to suspicious activity in real time.

Lighting: The First Line of Deterrence

Why Lighting Matters for Security and Compliance

Adequate lighting deters crime, improves camera image quality, reduces slip-and-fall risk, and is frequently required by local ordinance. Many municipalities that have enacted gas station security codes specify minimum foot-candle levels at the pump islands, parking areas, and store entrance. The Illuminating Engineering Society (IES) publishes recommended practice documents for fuel station lighting that are widely referenced by local codes and insurance underwriters.

Canopy lighting upgrades—particularly LED retrofits—simultaneously address security, energy cost, and maintenance frequency. For a detailed look at canopy lighting options and maintenance considerations, see our guide on Gas Station Canopy Maintenance and LED Upgrades.

Key Lighting Zones and Considerations

Practical Lighting Checklist

• Verify your local ordinance's minimum foot-candle requirement for each zone and document compliance with a photometric reading.
• Eliminate dark spots between the canopy edge and the parking area perimeter—these are common locations for loitering and approach concealment.
• Ensure lighting does not create glare that degrades camera image quality or blinds employees looking outward from the store.
• Replace burned-out fixtures within a defined timeframe (many operators use 24–48 hours as a standard); document replacements.
• Consider motion-activated lighting for low-traffic areas such as the rear of the building and tank access points.
• Review lighting after any landscaping changes that may create new shadows or obstructions.

Physical Security Measures at the Forecourt and Store

Dispenser and Pump Security

Skimmer installation on fuel dispensers is a persistent threat. Physical countermeasures include:

• Tamper-evident security tape or labels on dispenser cabinet doors, inspected on a regular schedule.
• High-security dispenser locks—standard cabinet locks are easily defeated with widely available keys.
• Bluetooth scanning of dispenser interiors on a documented schedule to detect wireless skimming devices.
• Dispenser cabinets with internal cameras or electronic intrusion sensors where supported by the equipment.

Outdoor payment terminals from manufacturers such as Gilbarco (FlexPay series) and Verifone (UX series) incorporate hardware security features designed to resist skimmer attachment. Ensure firmware is kept current and that any terminal showing signs of tampering is taken out of service immediately and reported to your acquiring bank and local law enforcement.

Store Layout and Cash Handling

Store design significantly affects robbery risk. Key principles include:

• Visibility: Keep window decals and merchandise displays below eye level so that employees inside can see the forecourt and passersby can see into the store. Many state ordinances specify a minimum clear-view zone on windows.
• Counter placement: Position the POS counter so the cashier has a clear sightline to the entrance and is not trapped in a corner.
• Safe placement: Use a time-delay safe for cash drops. Post signage indicating the safe is time-delayed—this is a proven deterrent. Limit the amount of cash in the register drawer at any time.
• Drop-safe discipline: Establish and enforce a maximum cash-in-drawer limit with documented drops. For a detailed cash-handling framework, see our guide on Cash Handling & Daily Reconciliation for Gas Stations.
• Panic buttons: Install silent alarm/panic buttons at the POS counter and, where feasible, at secondary locations. Ensure employees know how to activate them without escalating a confrontation.

Access Control

• Secure all non-public areas (office, stockroom, tank access) with keyed or electronic access control. Limit key distribution and document who holds keys.
• Rekey or reprogram access credentials when an employee with access departs.
• Install door chimes or electronic entry alerts on all non-public entry points.
• Ensure the office door can be locked from the inside and that employees have a secure location to retreat to if needed.

Staffing and Operational Security Practices

Shift Scheduling and Lone-Worker Risk

Overnight and early-morning shifts with a single employee present the highest robbery risk. Where local law or your branded agreement does not already require two-person staffing during high-risk hours, consider it as a risk-management measure. Where single staffing is unavoidable:

• Use a bullet-resistant transaction window or pass-through for overnight cash transactions where permitted by local building codes.
• Implement a check-in protocol—a manager or designated contact should verify employee safety at defined intervals during overnight shifts.
• Ensure the employee has a charged mobile phone and knows the direct non-emergency and emergency numbers for the local police precinct.

Employee Training

Security equipment is only as effective as the people operating the site. Training should cover:

• How to activate the panic alarm without drawing attention.
• What to do—and not do—during a robbery (comply, do not resist, observe and remember).
• How to preserve the crime scene and what information law enforcement will need.
• How to identify and report suspicious behavior before an incident occurs (loitering, repeated drive-bys, individuals photographing equipment).
• Skimmer awareness—what tampering looks like on a dispenser cabinet or payment terminal.

Document all security training in employee records. For new hire onboarding, integrate security procedures into the orientation process from day one.

Technology Enhancements

Remote Monitoring and Video Verification

Cloud-connected camera systems allow management to review footage remotely and receive real-time alerts. Third-party video monitoring services can provide live intervention—contacting law enforcement or broadcasting a verbal warning through on-site speakers when suspicious activity is detected. This is particularly valuable for overnight hours when on-site staffing is minimal.

License Plate Recognition

LPR systems can automate drive-off detection and flag vehicles associated with prior incidents. Before deploying LPR, review the privacy law requirements in your state. California's Civil Code 1798.90.5 et seq. requires private ALPR operators to maintain reasonable security, post a usage policy, and log access to the data. New Hampshire RSA 261:75-b effectively prohibits private LPR operation. Other states have varying requirements—consult legal counsel before deployment.

Integrated Security and POS Systems

Modern site controllers can be configured to require prepayment or attendant authorization before fuel flows, eliminating drive-offs at the dispenser level. Integration between the POS, camera system, and dispenser can timestamp transactions against video footage, making incident investigation significantly faster.

Insurance and Documentation

Your security program is only as defensible as its documentation. Maintain records of:

• Camera installation, testing, and maintenance logs.
• Lighting inspection and replacement records.
• Employee security training completion records.
• Incident reports for all security events, including near-misses.
• Skimmer inspection logs for each dispenser.
• Access control key/credential issuance and return records.

Share your security program documentation with your insurance carrier's loss-control representative. A well-documented program can support favorable underwriting treatment and demonstrates due diligence if a claim or lawsuit arises.

Security Compliance Checklist

Camera System

• ☐ All pump islands, canopy perimeter, store interior, cash area, and tank access covered
• ☐ Resolution sufficient for face and license plate identification at relevant distances
• ☐ Continuous recording confirmed; playback tested on documented schedule
• ☐ Retention period meets local ordinance and insurance requirements
• ☐ NVR/cloud storage secured and access-controlled
• ☐ LPR privacy law compliance reviewed by legal counsel (if applicable)

Lighting

• ☐ Photometric readings documented for all zones against local ordinance minimums
• ☐ No dark spots between canopy edge and parking perimeter
• ☐ Burned-out fixtures replaced within defined timeframe; replacements logged
• ☐ Motion-activated lighting installed at rear of building and tank access
• ☐ Lighting reviewed after any landscaping changes

Physical Security

• ☐ High-security dispenser locks installed
• ☐ Tamper-evident tape on dispenser cabinets; inspected on schedule
• ☐ Bluetooth skimmer scans performed on documented schedule
• ☐ Time-delay safe installed; signage posted; cash-in-drawer limits enforced
• ☐ Panic buttons installed and tested; employees trained on activation
• ☐ Window clear-view zone maintained per local ordinance
• ☐ Non-public access points secured; key/credential log maintained

Staffing and Training

• ☐ Overnight staffing policy documented and reviewed against local requirements
• ☐ Check-in protocol in place for lone workers
• ☐ Security training completed and documented for all employees
• ☐ Incident reporting procedure posted and communicated

Next Steps

1. Audit your current system against this checklist within the next 30 days. Assign a responsible person for each gap identified.
2. Pull your local ordinance on gas station security requirements. Contact your state petroleum marketers association if you are unsure where to find it.
3. Review your branded agreement (if applicable) for security standards and compliance deadlines.
4. Schedule a loss-control visit with your insurance carrier. Many carriers offer this at no charge and will provide a written report you can use to prioritize upgrades.
5. Conduct a tabletop exercise with your management team covering robbery response, incident documentation, and law enforcement notification procedures.
6. Establish a recurring security audit schedule—quarterly at minimum—and document each review.
7. Consult legal counsel before deploying LPR or advanced video analytics to ensure compliance with your state's privacy laws.

Sources

• OSH Act Section 5(a)(1) — General Duty Clause (29 U.S.C. 654)
• 29 CFR 1903.15(d) — OSHA civil penalty schedule (as of January 15, 2025)
• 29 CFR 1904 Subpart B, Appendix A — OSHA recordkeeping partial exemption for NAICS 4471
• California Civil Code 1798.90.5 et seq. (Title 1.81.23) — Private ALPR requirements
• New Hampshire RSA 261:75-b — Automated number plate scanning restrictions
• 15 U.S.C. 2802(b)(2)(A) and 2804 — PMPA franchise termination grounds and notice
• Illuminating Engineering Society (IES) — Recommended Practice for Lighting of Exterior Environments (RP-33)
• PCI Security Standards Council — PCI DSS v4.0.1 (pcisecuritystandards.org)
• OSHA Workplace Violence Prevention resources (osha.gov)