Card skimming at ATMs and gas pumps: the 20-second check that protects your card

Most card fraud starts with a click. This one starts with hardware. Card skimming is the physical bugging of the machines you trust every week — ATMs, gas pumps, checkout terminals — with devices that copy your card data and record your PIN. The FBI, which keeps a standing page on the scheme, estimates skimming costs financial institutions and consumers “more than $1 billion each year.” And the hardware is everywhere: in 2025 alone, the U.S. Secret Service and its partners removed 411 illegal skimming devices during inspections of nearly 60,000 terminals nationwide, preventing an estimated $428.1 million in potential fraud losses (announced January 2026).

How the hardware works

The FBI describes skimming as devices illegally installed on or inside ATMs, point-of-sale terminals, or fuel pumps that capture card data and record PIN entries. Criminals then encode the stolen data onto fake cards and drain accounts. The toolkit has four main pieces:

Overlay skimmers — fake card readers that fit over the real slot. Often the only giveaway is that they sit slightly loose or proud of the machine.
Insert skimmers and shimmers — the chip-era upgrade. The Secret Service notes that ATM skimming devices are often inserted deep inside the card slot, where they are essentially impossible to spot from outside, and warns that some devices are built to capture data from a card’s EMV chip as well as the magnetic stripe. The thin chip-reading inserts are commonly called shimmers.
Pinhole cameras — tiny lenses hidden above or beside the keypad (the FDIC points out that a brochure holder on an ATM is a perfect hiding spot) that film your fingers typing the PIN.
Keypad overlays — dummy keypads glued over the real one that log every keystroke. They often look slightly too thick.

Gas pumps get a nastier variant: the FBI notes fuel-pump skimmers are usually wired inside the machine, invisible to the customer, storing data for later pickup or wireless transfer.

Where the risk concentrates

Skimmers need two things: time to install and low odds of being watched. That is why the risk piles up at outdoor, unattended terminals — standalone ATMs, after-hours vestibules, and the far pump row no attendant can see. The FBI’s advice maps the risk directly: indoor, well-lit ATMs are less vulnerable targets, and the pump closest to the store, in the attendant’s direct view, is less likely to be skimmed. The same hardware is also aimed at benefit cards — if you or someone you know uses SNAP, the stakes are higher and the rules differ, so read our guide to EBT skimming.

The 20-second inspection

This is a Lock the Front Door scam, and the front door here is the card slot:

Look for anything loose, crooked, damaged, or scratched — the FBI’s exact checklist — plus tape, glue residue, or mismatched colors and materials.
Wiggle the reader and the keypad. Real hardware is anchored; overlays flex, shift, or pop.
Compare with the machine next to it. Two pumps of the same model should look identical — a part that differs is a red flag.
Cover the keypad with your free hand every single time. This one habit defeats every pinhole camera ever hidden.

The safer ways to pay

Your payment choice changes your exposure more than any inspection:

Tap-to-pay and mobile wallets never expose the magstripe to the slot, and each tap sends a one-time transaction code a skimmer cannot reuse — mobile wallets go further, substituting a device-specific number for your real card number. The Secret Service recommends using tap-to-pay or chip whenever possible.
At the pump, run debit as credit. The Secret Service suggests it for one reason: no PIN entry means no PIN to steal. A skimmed card number without its PIN cannot be used at an ATM.
Credit beats debit at risky terminals. Skimmed credit means fighting over the bank’s money — federal law caps unauthorized-charge liability at $50, and issuers commonly waive it. Skimmed debit means your checking account is drained while you dispute, and the FDIC notes the $50 cap only holds if you report within two business days of discovering the loss. The full rundown by payment method is in how to get your money back.

Then watch the account, not the machine: turn on transaction alerts for every card, and scan statements weekly — skimming rings often test with small charges before going big.

If you have been skimmed

Move to Freeze & Report:

Call the bank or card issuer immediately. Report the charges as unauthorized, kill the card, and get a reissue with a new number. For debit, this call starts the clock that preserves your $50 cap.
Dispute in writing and keep records of every unauthorized transaction.
Change the PIN on the new card — and on any other card that shares it.
Report it: local police (useful for the dispute file) and ic3.gov, the FBI’s reporting channel for skimming.
Protect the wider blast radius. A skimmed card is contained fraud, but if you reused the PIN or suspect more data walked, consider a free credit freeze and the checklist in what to do after a data breach.

For the full set of free defenses, see our defense moves — or test your eye on the 60-second quiz.

Warning signs

The card reader feels loose, wiggles, or sits crooked — or there are scratches, glue residue, or tape where the reader meets the machine.
The keypad looks unusually thick or feels spongy, or there is a tiny hole in the panel above it — the classic signs of a keypad overlay or pinhole camera.
Charges or ATM withdrawals you do not recognize appear days after you used an outdoor pump or standalone ATM — skimmed card data is often encoded onto a fake card and used somewhere far away.

Defense move — Lock the Front Door

Inspect before you insert. The FBI and Secret Service give the same checklist: look for anything loose, crooked, damaged, or scratched, and give the reader a quick wiggle. If anything seems off, walk away and use another machine.
Cover the keypad with your free hand every time you enter a PIN — a pinhole camera cannot record what it cannot see.
Prefer tap-to-pay or a mobile wallet; the Secret Service recommends tap or chip over the swipe. At the gas pump, run a debit card as credit so you never type your PIN — or just pay inside.
Pick harder targets: an indoor, well-lit ATM at a bank branch, or the pump closest to the store and in the attendant's direct view. The FBI notes these are less likely to be compromised.

Editor's note

Skimming is the rare scam with a defense you can do with your hands. No password hygiene, no judgment call about a stranger's story — just a twenty-second look and a wiggle before your card goes in. What finally made this automatic for me was learning that the Secret Service pulled 411 of these devices off American machines in one year — gas stations, corner stores, ATMs. The habit I'd teach anyone: tap when you can, wiggle when you can't, and cover the keypad like everyone is watching. Once, someone actually is.

Sources

Frequently asked

My card has a chip. Doesn't that make skimming impossible?

Harder, not impossible. The Secret Service warns that some skimming devices are built to capture data from a card's EMV chip as well as its magnetic stripe — thin insert devices commonly called shimmers sit inside the reader slot itself, where you cannot see them. Chip transactions are still far safer than swipes, because the chip generates a one-time code the magstripe cannot. Tap-to-pay and mobile wallets go a step further: nothing readable ever enters the slot. So the ladder is swipe (worst), insert chip (better), tap or phone (best).

Money was taken from my debit account. Will I get it back?

Usually yes — if you move fast. Under federal law (the FDIC cites the Electronic Fund Transfer Act), your maximum liability for an unauthorized debit transaction is $50 if you notify your bank within two business days of discovering the problem, and the cap rises sharply the longer you wait. Credit cards are more forgiving: liability for unauthorized charges is capped at $50 total, and most issuers waive even that. Either way, call the number on the back of the card the moment you spot a charge you did not make, and follow up with a written dispute.

I think I found a skimmer on a machine. What should I do?

Do not use the machine, and do not try to pull the device off — it is evidence, and skimming rings sometimes watch their hardware. Tell the store attendant, gas station manager, or bank branch so they can take the terminal out of service, and report it to local police. You can also file a report at ic3.gov, the FBI's Internet Crime Complaint Center, which the FBI lists as the reporting channel for skimming. If your card touched that machine, treat it as compromised: call your bank and request a replacement.

Ryon — Founder & Editor

Consumer-safety advocate · Scamblare

Scamblare researches scams every day so you don't have to. Every article is checked, claim by claim, against primary sources like the FTC and FBI IC3 under our published editorial standard. How we fact-check ›