Tesco is exposing credit and debit cardholders to fraud because of delays in the rollout of chip-and-PIN technology at its pay-at-pump petrol stations, The Times has learnt.

Five years after chip and PIN was first introduced, Britain's biggest supermarket retailer is yet to adopt the technology - which is designed to protect customers from fraud - in all of its stations. It has failed to install chip-and-PIN readers at pumps in almost 10 per cent of stations that allow customers to fill up, pay and drive off without entering the shop.

Of about 430 forecourts across the country, there are 50 where fraudsters can simply put a cloned or stolen card into the machine at the pump without needing a pin number.

The discovery of the loophole will be an embarrassment to the chain, which owns about 5 per cent of petrol stations in the UK.

Vera Cottrell, personal finance campaigner at Which?, the consumer group, said: “It is unusual for a retailer of Tesco's size to have not consistently implemented chip and PIN across the board and to have taken such a long time to install it. We can't really understand why it has obviously proven so difficult.”

Although chip-and-PIN technology is not a legal requirement, most retailers have adopted it. Uptake of the card-readers increased from 2005, when stores became liable for losses because of fraudulent transactions made without the use of a personal identification number. Since then, the cost of this type of fraud has been borne largely by retailers, with card companies being able to demand that they pay up in cases in which fraud has been committed repeatedly in the same store.

Apacs, the payment industry association, said that while there were other famous retailers that did not require PINs from customers, including McDonald's, they are usually outlets that process only very low-value payments, usually for less than £10.

The maximum payment limit at a Tesco pay-at-pump is £59. Customers can make two payments a day, giving fraudsters the opportunity to steal £118 of petrol a day using one card.

A spokesman for Apacs said: “One can only imagine that Tesco must be experiencing fraud at these stations. If I were a fraudster, I would be all over it like a rash.”

One reader of The Times had £1,069 stolen from his account when a thief cloned his Co-op card and used it to pay for petrol at a pay-at-pump station in the Leicester area. Before the fraud was spotted, the thief made 19 transactions over ten days close to the maximum of £59 each time.

Although Tesco did not confirm the extent of fraud, nor say which stations still allowed customers to use cards without PINs, a spokesman said: “We aim to have installed chip and PIN in these remaining stations by mid-September, but it is just a huge operation to roll out chip and PIN and can involve a lot of inconvenience to customers if we have to refit pumps.”

It is not the first time that payment security loopholes have been uncovered at Tesco stores. The chain was first criticised for exposing customers to fraud in October 2006, when Which? highlighted the risk at Tesco's self-service tills, which required customers only to swipe their card to make a payment. The store has since installed chip-and-PIN readers at all tills.

The total cost to the industry from payments made fraudulently in petrol stations and forecourts came to £6 million in 2007, down from £15.1 million in 2003, before the launch of chip and PIN. There were 1.1 million cases of fraud last year, according to Apacs, with an average loss of £490 each time.

Times Recommends

• Lies and cover-up at MG Rover exposed by report
• High oil prices push manufacturing costs up
• Primark founder steps down as chief executive