Card skimmers are still draining accounts at gas pumps, and one tug can reveal them

A fuel pump can look normal while a hidden reader captures card data during an ordinary fill-up. Some devices sit over the real slot and may shift when pulled, making a quick physical check worthwhile. Other skimmers hide inside the cabinet, so the tug test is a useful screen rather than a guarantee of safety.

A skimmer copies data while the payment still works

The crime succeeds because the transaction often proceeds normally. A concealed device reads information from the magnetic stripe, while a false keypad or hidden camera may capture the PIN.

The FBI’s skimming guidance says criminals attach illegal readers to ATMs, point-of-sale terminals and fuel pumps. Stolen information can be encoded on another card or used for unauthorized purchases, depending on what data the criminal obtained.

Bluetooth or cellular components can transmit captured records without requiring the installer to return immediately. That makes a compromised pump valuable even when no criminal is visibly nearby.

A tug can expose an overlay

Before inserting a card, the reader can be compared with neighboring pumps. A crooked slot, mismatched color, unusual thickness, broken security seal or loose panel deserves attention.

The FTC recommends wiggling the card reader and keypad because overlays may move when the genuine hardware would remain firmly attached. A suspicious pump should not be used, and the station attendant should be notified.

Force is unnecessary. The purpose is to notice a loosely fitted shell, not to damage equipment. A solid reader can still be compromised internally, and a slightly flexible factory part is not proof of a crime.

The pump closest to the cashier may carry less opportunity

Criminals prefer equipment they can open or alter without attracting attention. Pumps in direct view of staff, cameras and passing customers may offer less privacy than units at the edge of a lot.

The U.S. Secret Service, which investigates access-device fraud, says inspection and modern payment technology are central to fighting skimming. Station operators can check tamper seals, locks and cabinet access while customers choose safer payment methods.

Contactless and chip payments reduce stripe exposure

Tapping a card or phone can avoid feeding the magnetic stripe through a compromised slot. Mobile wallets also substitute a transaction-specific token for the actual card number, limiting the value of intercepted data.

Paying inside is another option when the outdoor terminal appears damaged. Credit cards generally offer stronger dispute protection than debit cards, and using a debit card as credit avoids entering a PIN at the pump. These choices do not prevent every kind of fraud, but they reduce the information a skimmer can collect.

Fast alerts can stop a copied card from becoming a drained account

Transaction notifications reveal unauthorized purchases sooner than a monthly statement. Bank apps often allow a card to be locked immediately while a questionable charge is investigated.

Debit-card theft can remove money directly from a checking account, potentially interfering with bills before the dispute is resolved. Statements should be reviewed frequently, and unexpected small charges should not be ignored because criminals may test a card before attempting a larger purchase.

The physical check is one layer in a wider defense

A tug is memorable because it is simple, but the safest routine combines several steps: inspect the terminal, prefer tap or chip, shield the keypad, avoid remote pumps when another is available, and monitor the account afterward.

If a skimmer is suspected, photographs can document the terminal without touching or removing the device. Staff and police should handle it because the equipment may preserve fingerprints or digital evidence. The card issuer should be told which pump and station were used.

Gas-pump skimming persists because the hardware is public, transactions are frequent and customers are in a hurry. A few seconds of inspection can reveal crude overlays, while safer payment choices and account alerts cover the devices that no tug can expose.

Receipts can help connect a suspicious charge to a particular terminal and time. The pump number, station address and approximate transaction time give investigators and the station operator a narrower window for reviewing cameras and inspecting equipment. A generic report that only names the fuel brand may not identify the location because many stations are independently operated.

Security seals are indicators rather than proof. A torn, mismatched or numbered seal that differs from nearby pumps warrants a different terminal and a report to staff, but an intact sticker cannot reveal hardware installed behind the panel. Criminals can imitate seals, and legitimate maintenance can change their appearance.

Chip cards reduce counterfeit-card fraud when the terminal actually processes the chip, but fuel equipment has historically retained magnetic-stripe capability for compatibility. A terminal that repeatedly asks for a swipe after a failed chip read deserves caution. Paying inside through a staffed, visibly maintained reader can reduce exposure when outdoor equipment behaves unusually.

The response after suspected compromise should distinguish card data from account credentials. Replacing the card number can stop copied-card use, while a captured PIN or reused online password may require additional changes. The issuer can identify the correct scope and watch for attempts that follow the initial theft.

This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.

More from Morning Overview