Card skimmers hidden on gas pumps and ATMs are draining accounts, and here’s the tell

Thieves have long exploited a weakness in everyday payment machines by attaching hidden devices that copy card data as people pay for gas or withdraw cash. These skimmers can sit on a pump or an ATM for days, silently capturing card numbers and PINs from everyone who uses the machine, and victims often do not realize anything is wrong until fraudulent charges appear on their statements.

What makes skimming insidious is that the transaction itself works normally. The pump dispenses fuel, the ATM dispenses cash, and nothing on the screen hints that a second, hidden device just harvested the card’s information. Because the theft is invisible at the moment it happens, the defense comes down to noticing the physical signs of tampering before inserting a card and watching accounts closely afterward.

How skimmers capture card data

A card skimmer is a small device designed to read and store the data on a card’s magnetic stripe. Criminals attach it over or inside a legitimate card reader, so that when a customer swipes or inserts a card, the information passes through the skimmer on its way to the real machine. Many setups pair the skimmer with a way to capture the PIN as well, such as a tiny pinhole camera aimed at the keypad or a fake keypad overlay that records keystrokes.

Once the criminals retrieve the stored data, they can clone cards or use the numbers for fraudulent purchases, draining accounts before the victim notices. Gas pumps and standalone ATMs are favored targets because they are often unattended, giving a thief time to install a device without being seen, and because they process a high volume of cards, maximizing the payoff from a single planted skimmer.

The physical tells at the pump and the ATM

The most reliable defense is a quick inspection before paying. A card slot or reader that looks bulky, crooked, or different from others on adjacent machines can indicate an overlay device. Parts that wiggle, feel loose, or seem to be attached with tape or glue are warning signs, since legitimate readers are securely built in. Gently pulling or pressing on the reader can reveal an add-on component that comes loose when a fixed one would not.

At gas pumps, many stations place tamper-evident seals over the panel that covers the internal wiring; a seal that is broken, torn, or shows the word “void” suggests the panel has been opened. Choosing a pump close to the attendant’s window, rather than one at the far end of the lot, reduces the odds of using a compromised machine, because skimmers are more often placed where a thief can work unobserved. At an ATM, covering the keypad with a hand while entering a PIN defeats a hidden camera even if a skimmer is present.

Why cash withdrawals and fuel stops are prime targets

Skimming concentrates where oversight is thin. Outdoor, self-service machines that operate around the clock give criminals the privacy to install and later collect their devices, and the steady stream of customers ensures a large haul. The same features that make pay-at-the-pump and standalone ATMs convenient, that they are fast, unstaffed, and everywhere, are what make them attractive to skimmer operators.

Paying inside with an attendant, using a machine in a well-lit and monitored location, or opting for a contactless or chip-based transaction where available can lower the risk, since these paths are harder to compromise than an exposed magnetic-stripe reader. None of these steps is foolproof, but each removes some of the opportunity skimmers rely on.

Catching the fraud early

Because a planted skimmer can steal data long before charges appear, the second line of defense is vigilance over accounts. The Federal Trade Commission’s consumer guidance emphasizes acting quickly when money goes missing, and reviewing bank and card statements frequently is the fastest way to spot unauthorized activity from a skimmed card. Setting up transaction alerts through a bank or card issuer can flag suspicious charges in near real time.

When fraud does occur, victims are urged to contact their bank or card issuer immediately to stop further losses and to report the theft. Fraud can be reported to the FTC at reportfraud.ftc.gov, which helps regulators track patterns and target the operations behind these schemes. Prompt reporting also strengthens a victim’s position in disputing fraudulent charges.

A low-tech threat that still works

Card skimming persists because it is cheap, hard to detect in the moment, and effective, exploiting ordinary machines that millions of people use without a second thought. The countermeasures are equally low-tech: a few seconds spent examining the reader before paying, a hand over the keypad, and regular attention to account statements. The single most useful habit is treating an unattended card reader with a moment of skepticism, because the tell is usually physical, and it is almost always visible to anyone who takes the time to look.

This article was researched and written with the assistance of AI and reviewed by an editor prior to publication.

More from Morning Overview