Gas-pump skimmers are often wired inside the pump where you cannot see them, the FBI says

The FBI says fuel-pump skimmers are usually attached to the internal wiring of the machine and are not visible from outside, which means a quick glance at the card slot catches only part of the problem. The devices capture card numbers and PIN entries at the pump, then hold the data for a later download or send it on wirelessly.

Tech news in one quick read: Get the most interesting stories in startups, tech and programming, each with a short TLDR, in one free daily email from TLDR.

Subscribe to TLDR free →

We may earn a commission if you sign up.

The bureau estimates that skimming costs financial institutions and consumers more than $1 billion a year across gas pumps, ATMs and store terminals. Criminals turn the captured data into counterfeit cards, which are then used for unauthorized purchases or withdrawals.

Internal Wiring Keeps Pump Skimmers Out of Sight

In its public guidance, the FBI’s page on skimming describes fuel-pump devices as “usually attached to the internal wiring of the machine and aren’t visible.” That placement matters because it defeats the advice most drivers have heard for years. Wiggling a card reader or checking for a bulky overlay works on freestanding ATMs, where a device can sit on top of the slot, but a skimmer clipped into the cabinet behind the locked panel gives no outward sign at all.

The same page explains that a pump skimmer stores what it captures so it can be collected later, or transmits it wirelessly, so the data does not have to be read at the pump itself. Pinhole cameras and keypad overlays, which the FBI lists for ATMs and point-of-sale terminals, can add the PIN to the stolen card number, and the page notes that fraudsters sometimes distract store clerks while installing point-of-sale devices, a job that takes only seconds. Pump cabinets present the same short window to anyone carrying the right key.

Inspectors Open the Pumps Customers Cannot

Because the devices live inside the cabinet, the people who find them are usually inspectors with a key. The Tennessee Department of Agriculture reported in October 2020 that five devices had turned up in user-interface compartments on fuel pumps over six weeks, and Commissioner Charlie Hatcher said inspectors from the department’s Weights and Measures section were “discovering credit card skimmers during routine gas pump inspections.” When one is found, the department takes the pump out of service and contacts local law enforcement.

Weights and Measures Administrator Ed Coleman noted in the same notice that neither consumers nor station owners can usually tell a skimmer has been installed. Stolen magnetic stripe data can still be used for fraud even at stations that have chip readers. Wisconsin’s 2016 sweep, covered by CBS 58, found that all of the state’s recent skimmers were internal, and Petroleum Inspector Mike Pappas said one could be installed in about 30 seconds with the proper keys. Sweeps do not always find anything. During Thanksgiving 2024, San Luis Obispo County inspectors examined 294 pumps at 34 stations and found no fraudulent devices, a reminder that a sweep can come back clean.

Pump Choice, Tap to Pay and PIN Habits Cut the Risk

The FBI’s guidance for gas pumps is practical rather than technical. Drivers are told to favor pumps closer to the store and within view of the attendant, since those are less often targeted, and to consider paying inside. Debit cards can be run as credit, or the keypad can be covered when a PIN is typed. The bureau also points to tap to pay, which it calls “more secure and less likely to be compromised” where both the card and the terminal support it.

California’s Agricultural Commissioner and Sealer Martin Settevendemie added a physical cue for the pump itself: broken or tampered security stickers. His county’s advice also includes paying cash, running debit as credit, and reporting anyone unaffiliated with the station who is unlocking pumps. Where a reader looks off, the FBI’s checklist for card readers still applies: look for anything loose, crooked, damaged or scratched, and avoid a reader that appears unusual. That check cannot see the internal wiring, but it can catch the overlay variety and the cases where a pump panel has been forced.

IC3 Reporting and Bank Contact After a Suspected Skimmer

The FBI’s steps for a suspected victim start with reporting the incident to the bureau’s Internet Crime Complaint Center, then contacting the bank or card issuer immediately. The page also advises changing the PIN if money remains in the account, checking whether the account offers a freeze or block option, and reviewing statements for unauthorized transactions. Transaction alerts and multi-factor authentication add early warning.

A card that an ATM refuses to return can also be a sign of tampering, and the FBI says to contact the bank right away in that case. Credit cards generally leave less exposure than debit cards, since a compromised debit card can reach the linked checking account directly.

Benefit cards face a harsher version of the same problem. The FBI notes that EBT card data has been a major target since at least 2021, that the cards are largely not chip-enabled, and that as of early 2024 no state’s EBT cards had an embedded chip. Cardholders generally have fewer protections than credit or debit users, so reimbursement may be partial or absent and can take weeks. The agency adds that state benefits agencies will not ask for cardholder PINs, which makes any message requesting one a red flag.

This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.