A wobbly card reader at the gas pump is the FBI’s top sign of a skimmer

The FBI’s own guidance on card skimming points to one simple physical test at the gas pump: a card reader that is loose, crooked, damaged or scratched, or a keypad that can be pulled or wiggled at the edges, is the clearest sign a skimming device has been installed underneath or over top of it. The bureau says skimming devices planted on fuel pumps, ATMs and point-of-sale terminals capture card data and record PIN entries, letting criminals clone cards or drain accounts without a customer ever realizing anything happened at the pump.

Fuel pumps present a harder detection problem than ATMs, because the devices used there are typically installed inside the machine rather than clipped over a visible reader. That difference in placement is why a physical check of the card slot and keypad matters more at a gas station than almost anywhere else a card gets swiped.

Fuel-pump skimmers are built to stay hidden inside the machine

According to the FBI’s skimming page, devices “illegally installed on or inside ATMs, point-of-sale terminals, or fuel pumps capture card data and record cardholders’ PIN entries.” At a fuel pump specifically, the bureau says a skimmer is “usually attached to the internal wiring of the machine and aren’t visible,” which is why the exterior of the reader itself, rather than any obvious add-on part, is what a driver actually has a chance of noticing.

That internal placement is also why the FBI’s advice leans on touch rather than sight: pulling at the edges of the keypad, and checking that the card slot is not “loose, crooked, damaged, or scratched,” catches signs of tampering that a glance from a few feet away would miss entirely. The bureau estimates skimming costs financial institutions and consumers more than $1 billion each year, a figure that has held roughly steady even as chip-enabled cards have made cloning a swiped magnetic stripe harder in other contexts.

A tamper seal and a wiggle test from the FTC

The Federal Trade Commission’s own gas-pump guidance adds a second physical check that many stations now support directly: a security seal placed across the pump panel that reads “VOID” if the panel has been opened, which is exactly the access point a criminal needs to wire a skimmer into a pump’s internals. Comparing a pump’s card reader to the one next to it at the same station can also expose a mismatched or bulkier reader that has been swapped or overlaid.

Beyond the visual check, the FTC recommends running a debit card as a credit transaction where possible, since that route skips PIN entry entirely and removes the immediate cash-account drain a compromised PIN allows. Paying inside the station rather than at the pump sidesteps the fuel-pump risk altogether, though it will not help anyone already running low on time at a rural interstate exit.

EBT cards face a version of the same problem

Skimmers do not only target credit and debit cards. USDA’s own guidance on stolen SNAP benefits describes criminals placing devices on ATMs or retailer card-swiping machines specifically to copy EBT card information, then creating counterfeit cards to buy food with stolen benefits — a version of the same crime aimed at cards that, unlike most bank cards today, still lack chip technology and remain easier to clone from a stripe alone. Congress required states in December 2022 to start tracking skimming-related SNAP theft, though USDA says it still does not have comprehensive nationwide data on how often it happens.

A federal program that once let states replace benefits stolen through card skimming covered thefts between October 2022 and December 2024, capped at either the amount actually stolen or two months of a household’s benefit allotment, whichever was smaller. That replacement authority sunset in December 2024, which means anyone whose EBT card gets skimmed today has fewer guaranteed options for getting stolen benefits back than someone in a comparable position two years earlier.

A real find in Kansas shows how long a skimmer can sit unnoticed

The gap between installation and discovery can run for weeks. In Salina, Kansas, police found a skimmer at a Flying J station only after a business reported fraudulent charges tied to fuel purchased there on February 13, an investigation that eventually traced back to the device itself. The Salina Police Department urged anyone who had used a potentially compromised pump within the previous month to monitor their accounts, underscoring how far back a single undetected skimmer can reach before anyone notices.

The FBI directs anyone who finds a suspected skimmer, or who spots unauthorized charges that might trace back to one, to file a report with the Internet Crime Complaint Center, which the bureau operates as the central federal intake point for cyber-enabled fraud. IC3’s own reporting shows losses from complaints filed through the center climbed from $4.2 billion in 2020 to $16.6 billion in 2024, a trend line that covers far more than skimming alone but reflects the same broader pattern: a wobbly card reader, checked before a card ever goes in, remains one of the few places an ordinary driver can catch the crime before it happens rather than after.

This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.

More from Morning Overview