Card skimmers hidden on gas pumps have a giveaway you can spot in five seconds

A thin piece of plastic and metal, often no larger than a phone case, is behind one of the most persistent forms of payment fraud at the pump. Criminals attach these devices, known as skimmers, directly over or inside a gas station’s card reader, where they silently copy a card’s data the instant a driver pays for fuel. The equipment is cheap to build, easy to hide, and frequently goes unnoticed for weeks because a compromised card keeps working normally the whole time. Consumer protection agencies say most drivers can catch the warning signs in the time it takes to fill a tank, provided they know exactly where to look.

How a Skimmer Hijacks the Magnetic Stripe

Skimming is the theft of a card’s information during what looks like an entirely normal transaction, and a gas pump reader is one of the easiest places to install one because pumps sit outside, largely unattended, for hours at a stretch. According to Wikipedia’s overview of credit card fraud, thieves can steal card data using methods as crude as photocopying a receipt or as sophisticated as installing a small electronic device that swipes and stores the account numbers, names and expiration dates of hundreds of victims before it is ever removed. A skimmer fitted over or inside a gas pump’s card slot reads the magnetic stripe the instant a driver inserts a card, and because the pump still dispenses fuel normally, most drivers have no way of knowing anything happened until a bank statement or a fraud alert arrives days or weeks later. Broader card-fraud figures show how common the underlying problem has become: one industry survey cited on the same page found about half of all Americans have had a fraudulent charge appear on a credit or debit card, and more than 127 million people in the US have been victimized by card theft at least once. The same overview notes that cards issued in Europe and Canada mostly carry EMV chips requiring a four-to-six-digit PIN at checkout, a step that makes cloning a physical card far harder than lifting data from a magnetic stripe, which is exactly why gas pumps, many of which took years longer than sit-down retailers to require chip readers, remained an attractive target for stripe-based skimmers even after chip technology became standard elsewhere.

The Tamper-Evident Seal Meant to Expose a Break-In

Fuel retailers have responded by adding security seals over the cabinet panel that houses a pump’s internals, and the Federal Trade Commission’s consumer guidance explains what that seal is designed to reveal. If a criminal pries open the panel to plant a skimmer inside the wiring, the label is built to display the word “void” once broken, signaling that the compartment has been opened since the seal was applied. The FTC’s guidance, illustrated with side-by-side photos supplied by an industry trade group and Canadian police, also shows that skimmers clipped externally over a card reader can look subtly different from the factory-installed slot beside them: slightly thicker, a different shade of plastic, or a seam that does not quite match the rest of the housing. Because the seal only proves the panel itself was not opened, it does nothing to catch a skimmer clipped over the outside of a reader rather than wired in behind it, which is why the agency pairs the seal check with a second, separate inspection of the reader slot itself.

The Five-Second Wiggle Test

The agency’s central piece of advice takes only seconds to perform. Before inserting a card, a driver can grab the card reader itself and give it a firm wiggle. A factory-installed reader is bolted down and will not move; an external skimmer clipped or glued over it often will, and any give at all is a signal to alert the station attendant and use a different pump. The FTC also recommends comparing the reader against neighboring pumps at the same station, since a mismatched color or an oddly bulky slot often stands out once someone knows to look for it. Paying with a mobile wallet app instead of a physical card sidesteps the reader altogether, since those transactions rely on a tokenized, one-time code rather than the card’s actual magnetic stripe or chip data, which means even a compromised reader has nothing usable to capture.

Why Running a Debit Card as Credit Limits the Damage

Even when a skimmer goes undetected, the payment method chosen at the pump changes how much exposure a driver faces. Running a debit card through the credit option rather than entering a PIN keeps that PIN out of a skimmer’s reach and avoids an immediate deduction from a checking account while any dispute is investigated. Paying inside at the register instead of at the pump removes the outdoor reader from the equation entirely, and monitoring statements regularly remains one of the fastest ways to catch a fraudulent charge before it multiplies into repeated withdrawals, a pattern skimmer operators frequently rely on by making several smaller charges across multiple stations rather than one large purchase likely to trigger a bank’s fraud alerts. Federal law also limits a cardholder’s liability once a compromised card or account number is reported, though how quickly that happens can still determine how much of the loss gets reversed. A stolen physical card generally caps a cardholder’s liability at $50 if it is reported within 60 days of the statement showing the fraudulent charge, and if only the account number was copied by a skimmer while the physical card never left a driver’s wallet, federal rules typically leave the cardholder with zero liability at all, provided the charge is disputed promptly once it is spotted.

This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.

More from Morning Overview