Friday's Missing Card: Stress-Testing Fuel-Card Controls Before Monday's Ledger

A fuel card reported missing at 16:20 on a Friday is not merely an administrative omission. Until it is frozen, it remains a purchasing instrument. For a UK van or HGV fleet, the gap between loss and effective block is a live cost window, and it often runs longer than managers assume because the depot is winding down, the provider's contact centre is busy and the first meaningful reconciliation does not happen until Monday.

The purpose of a 60-minute tabletop exercise is not to catch a driver out. It is to test the chain of controls that sits behind every card in the wallet: who can freeze it, how quickly, what the card is permitted to buy, how transactions are matched to vehicles, and how drivers are told what to do if the card turns up. Run the drill as a depot routine, record the findings and repeat it. Fuel-card security should be a tested process, not a paragraph in an induction pack.

Why Friday afternoon is the revealing test

Most fuel-card controls look adequate during a normal Tuesday. The test comes when a card goes missing at the end of the week, outside core office hours, with a weekend of unattended bunker sites and shift changes ahead. A card that is not frozen can be presented for diesel, AdBlue or other permitted products depending on its profile. If manual keying is allowed, the risk extends to ghost fills: transactions attributed to a vehicle or card without the vehicle being present, or without a credible match to telematics movement.

The warning signs are usually present in the data before a loss occurs. Look for fill volumes above a vehicle's tank capacity, repeated purchases at the same site within an implausible interval, transactions outside the driver's shift pattern, odometer readings that fall or jump, product codes that do not fit the vehicle, and cards used while the vehicle is off the road. These are not proof of fraud on their own. They are exceptions that should be closed, and they are exactly the exceptions a tabletop exercise should force into the open.

Set the scene before the clock starts

Appoint a facilitator and four or five participants: fleet manager, transport supervisor, finance or accounts payable, a driver liaison representative and, where possible, the person who administers the fuel-card portal. Gather the last 90 days of card transactions, the vehicle list with tank capacities, the shift roster, the card-control matrix and the provider's escalation contacts.

The scenario should be specific: a driver reports a card missing at 16:20 on a Friday after leaving the yard. The last confirmed use was a bunker fill at 15:40. The card has not been frozen. The driver is now off shift and cannot be reached for 30 minutes. The provider's online portal is available, but the administrator's approval token is in a desk drawer at another site. This is deliberately awkward, because real losses rarely arrive with clean paperwork.

The hour, minute by minute

Use the first ten minutes to establish facts without assigning blame. Which card, which vehicle, which driver, what time was the loss noticed, what was the last transaction, and has anyone tried to use it since? Record the answers in a simple incident log.

The next ten minutes test containment. The administrator should freeze the card through the provider portal and note the exact time and reference. If the portal is unavailable, the fallback should be a phone call with a documented reference. Check whether the card is part of a pooled or multi-card account and whether linked cards need review. Verify that the freeze actually prevents authorisation, rather than merely flagging the account for later review.

Minutes 20 to 35 test card-level controls. Can the provider restrict the card to diesel only, to specific sites, to certain hours or to a maximum transaction value? Is driver identification required? Are receipts mandatory? Does the telematics system raise an alert when a card transaction occurs without an ignition event? These questions turn the exercise from a paper chase into a control audit.

Minutes 35 to 50 calculate exposure. Use a simple, defensible formula rather than a worst-case guess: take the hours from loss to confirmed freeze, divide by the card's typical interval between fills, and multiply by its 95th-percentile transaction value. If the card can be keyed manually, add a multiplier for ghost-fill risk. For example, 65 hours to Monday morning, a fill roughly every 26 hours and a 95th-percentile value of £240 gives an indicative exposure of about £600. Round to the nearest £50, state the assumptions and keep the calculation with the incident log.

The final ten minutes assign actions. Who will brief drivers? Who will check weekend transactions? Who will review exceptions on Monday? Who owns the next drill? The exercise should end with named owners and dates, not a general commitment to be more careful.

Containment is a sequence, not a single click

A freeze is only one step. Confirm the card is blocked, request a stop on authorisations, and obtain a provider reference. Update the lost or stolen card register. Brief drivers with a short script: if the card is found, do not use it; hand it to the supervisor; do not share the PIN. Check whether the vehicle's telematics can flag unusual movement over the weekend. On Monday, match every transaction on the account against vehicle location, ignition data, tank capacity and the driver's shift.

Good card controls reduce the need for heroics. Product restrictions limit what can be bought. Site and time restrictions narrow where and when a card works. Driver identification and receipt capture create accountability. Volume caps and odometer prompts make anomalies visible. None of these replaces a freeze procedure, but together they shorten the period in which a lost card is useful to anyone else.

Make the drill a fixture

Run the exercise quarterly, or whenever the card administrator or provider changes. Track four measures: time from report to freeze, percentage of cards with product and time restrictions, reconciliation lag, and number of open exceptions older than seven days. A depot that can freeze a card within 15 minutes, explain its exposure and close weekend exceptions by Tuesday lunchtime is in a stronger position than one that relies on a monthly statement and a hopeful phone call.

The 60-minute drill will not eliminate fuel-card fraud. It will show where the process is slow, where authority is unclear and where the data cannot answer basic questions. That is a useful return for an hour, and a far cheaper lesson than discovering the gap through a Monday ledger full of fills that never happened.