A card swipe at the pump can take a few seconds, and that is all the time a hidden device needs to copy the card too. Skimmers planted on gas-station terminals and ATMs quietly capture the data on a card while a legitimate fill-up or withdrawal goes through, leaving no sign at the moment of the transaction. For retirees living on a fixed income, a drained checking account can arrive as a nasty surprise days later, long after the thief has moved on.
How skimmers and shimmers copy a card
A skimmer is an illegal card reader hidden on top of, or inside, a real payment terminal. It grabs the information stored on a card’s magnetic stripe as the card passes through, then stores or transmits it for a thief to clone or sell. A newer variant, the shimmer, is a paper-thin device tucked inside the slot to read chip cards. Some skimmers even use Bluetooth to beam stolen numbers to a criminal parked nearby, so no one has to return to the machine to collect the data.
The Federal Trade Commission warns that criminals attach these devices to gas pumps, ATMs, and other terminals, and that the stolen numbers are used to run up charges or make cash withdrawals, in its guidance on avoiding card skimming. Because the underlying transaction still completes normally, nothing on the screen or the receipt reveals that a second, hidden reader was in the loop. The most dangerous versions sit entirely inside a fuel pump, out of sight, which is one reason the location and payment method a person chooses can matter more than any visual check.
Free retirement updates: Scam calls targeting retirees change every week. Our free Retirement Shield newsletter flags the ones going around and the one tell that stops each. Sign up free.
The hidden camera that captures the PIN
Copying a debit card is only half the job; a thief also needs the PIN to pull cash. That is where a second piece of hardware comes in. The FTC notes that criminals may install a tiny pinhole camera aimed at the keypad, or slip a thin fake keypad overlay on top of the real one, to record each digit as it is typed. Together, a skimmer and a camera hand a thief everything needed to empty an account. A simple habit blunts it: covering the keypad with a free hand while entering a PIN blocks a hidden camera’s view. Choosing a credit card over a debit card avoids entering a PIN at the pump altogether, and credit cards generally carry stronger protections against fraudulent charges.
How to spot a tampered reader before swiping
The devices are built to blend in, but they often move. The FTC recommends wiggling the card reader before inserting a card; if it feels loose, shifts, or looks bulky compared with the machine next door, it may be a skimmer, and the terminal should be reported to an attendant, per the agency’s alert on skimming at the pump. A broken or peeling security seal over the pump panel is another warning sign, as is a keypad that sits higher, feels spongy, or differs in color from the rest of the machine.
The FBI offers a matching checklist and a few extra defenses: inspect the reader and keypad for anything loose, crooked, scratched, or held on with tape residue, favor pumps closer to the store and in the attendant’s view, and use an ATM inside a bank branch when possible, according to its skimming-prevention guidance. Tapping a card or a phone’s mobile wallet, rather than swiping or inserting, sidesteps the slot where many skimmers live. If a machine fails to return a card after a transaction or after a cancel, contacting the card issuer immediately can stop a thief before charges pile up.
The money angle sharpens for anyone drawing benefits onto a card. Thieves have increasingly skimmed government benefit cards, and stolen balances on those cards can be far harder to recover than a disputed credit-card charge, which is one more reason to shield the PIN and check balances often. Timing matters too: federal protections generally cap a cardholder’s liability for unauthorized debit-card charges, but the cap can climb the longer a fraudulent transaction goes unreported, so speed is not just prudent, it is financial. Turning on text or app alerts for every transaction converts a copied card into an immediate warning rather than a month-end shock, and reviewing statements line by line catches the small “test” charges thieves often run before draining an account.
The last line of defense costs nothing: reviewing bank and card statements regularly, setting up transaction alerts, and reporting an unfamiliar charge fast, since prompt disputes are what limit the damage when a copied card slips through. Skimming can also be reported to the FBI’s Internet Crime Complaint Center, and flagging a suspect pump or ATM to the station or bank helps get the device pulled before it reaches the next customer.
This article was created with AI assistance and was reviewed, edited, and fact-checked by The Financial Wire editorial team.
More Financial Reading
- How many CDs can you park at 1 bank? FDIC rules you must know
- Bank statements: how long to keep them and when to toss them
Warren Cohen is a finance writer based in Phoenix, Arizona, covering personal finance topics including credit, banking, and beginner investing. He earned his degree in business administration from Arizona State University and began his career working in consumer finance, where he gained direct experience with lending and credit systems. He now writes for personal finance websites and fintech platforms, focusing on clear, practical content that helps readers make informed financial decisions.
