Federal agents yanked 411 card skimmers off checkout machines, gas pumps, and ATMs across 2025, and they estimate the effort stopped thieves from stealing more than $428 million. The U.S. Secret Service ran the operation with local police. The number that should get your attention is not the arrests. It is how ordinary the hiding spots turned out to be.
Agents inspected nearly 60,000 payment terminals at more than 9,000 businesses. The FBI estimates that skimming costs financial institutions and consumers more than $1 billion each year. The device that does it can be thin enough to sit unseen inside the card slot.
The Fake Keypad That Sits Right On Top
The trick police keep warning about is an overlay. Criminals build a fake front for a card reader or keypad that looks exactly like the real thing, then snap it over the machine you are about to use. Pennsylvania State Police Trooper Kalee Barnhart explained the two main styles. A skimmer can sit over the reader as a fake front or hide inside it, which is why the FBI tells people not to trust a visual check. A shimmer is the thin version that slides into the card slot to read the chip. Both take only seconds to install and seconds to pull back out.
Once your card goes in, the device copies the data off the magnetic stripe or the chip. Thieves grab that stolen info later over Bluetooth, off a tiny SD card, or by coming back and prying the whole thing loose. Some setups add a pinhole camera aimed at the keypad so they catch your PIN while they are at it.
The Managers Who Swore They Already Checked
Managers at some of the visited stores told agents they had already inspected their own terminals, according to Michael Peck, an assistant special agent in charge in the Secret Service criminal investigative division. Agents found skimmers anyway, often within seconds of walking in.
The persistence is the part that stands out. In some towns, scammers returned within days, sometimes within hours, of a police visit to plant brand-new devices. The one thing that changed was that owners now knew what to look for, so they caught the replacements fast.
It Moved Way Past The Gas Pump
Gas pumps used to be the classic skimmer spot because nobody is standing there watching, and many older pumps use the same standardized locks. That reputation is out of date. Grocery self-checkouts have become a favorite. Andrei Daniel Fagaras admitted to placing skimmers at ten Kroger stores across West Virginia in June 2024, hitting self-checkout registers in Clarksburg, Morgantown, Huntington, and more. Prosecutors put the intended fraud across the whole case at roughly $250,000.
Skimmers have also popped up inside a Hannaford supermarket in Chelmsford, Massachusetts, where police found a hidden camera on the ATM set up to record PINs. Boston police put out an alert this year noting the devices are turning up at pharmacies, grocery stores and gas stations across the state. Self-checkout is easy pickings for a simple reason. You stand there alone. No cashier watches the terminal, so a crook can install a device in a blink and your bad swipe goes unnoticed.
The ATM In The Corner Store Is The Real Danger
Here is a stat that flips what most people assume. Reviewing 2025, FICO found that 90% of debit card compromises happened somewhere other than a bank ATM. The rest of the map is free-standing machines and terminals sitting in convenience stores, gas stations and other high-traffic spots. Those are the ones to steer clear of.
Police keep pushing the same advice for a reason. Use an ATM inside an actual bank, in a well-lit indoor spot, ideally near a visible security camera. Criminals hunt for the easy, unwatched machines. A cash dispenser wedged in a dim corner of a gas station is exactly the target they want.
A Real Cashier Won’t Save You Either
Do not assume a human at the register keeps you safe. A commercial fraud specialist in Lubbock, Texas warned that these crews are quick enough to plant a device on a staffed lane the second a cashier turns their head. Three Romanian nationals were arrested this summer after investigators tied them to skimmers in Lubbock, San Angelo, Abilene, and Amarillo, all connected to a larger transnational crime group.
Kasie Davis of the Lubbock Police Department was blunt about your chances of catching it by eye. Unless you are trained to identify a skimmer, she said, it is really hard for the average individual to spot one. That is why the pros stopped telling people to look for a specific device. There isn’t one.
Who Gets Targeted, And When
Criminals are not random about timing. They aim at EBT accounts, the cards that carry food benefits, and they schedule their fraudulent withdrawals around the monthly dates when those benefits land. That is deliberate targeting of people who can least afford the loss. A Houston shopper named Savannah Dansby found out the hard way ahead of Memorial Day weekend. Swiping her food benefits card at a southwest Houston grocery store, she felt something grab the card. “That’s when I found out it was a skimmer,” she said. She pulled, and the whole fake front came off in her hand.
In Pennsylvania, investigators charged two people who fixed an exact replica terminal over a 7-Eleven card reader in Milton. It sat there for days before employees noticed, and the stolen accounts got used at BJ’s Wholesale and Sam’s Club across two states. EBT holders can lock their card through the free ConnectEBT app when they are not using it, and change the PIN regularly, especially ahead of the monthly payment date. Neither of the two charged in Milton has been convicted.
The Five-Second Shake Test
The single easiest thing you can do costs nothing. Before you insert or swipe, grab the card reader and give it a wiggle. “Reach up there and shake it, and if it’s shaking, something is going on,” one expert put it. A legitimate reader is bolted down tight. An overlay or a loose add-on will rattle, shift, or feel crooked.
While you are at it, scan for parts that bulge, colors that do not quite match, a keypad that feels thicker or spongier than usual, or a card slot that fights you on the first try. A gentle tug is fine. Trooper Barnhart stressed the word gentle. If anything moves, walk away, and tell the store or call the police.
Why Your Phone Beats The Crooks
Tap-to-pay is the closest thing to skimmer-proof there is. Pay with a phone wallet and the terminal gets a token tied to your device instead of your actual card number, and every tap adds a one-time code on top, so your real digits never touch the compromised reader. Pennsylvania State Police Trooper Kalee Barnhart put it plainly. Criminals, she said, have not figured out how to steal information using Apple Pay or Google Pay.
Fraud specialists rank your options in order. A tap with a phone wallet is the best defense. Chip is next. Swiping the magnetic stripe is the worst, because that stripe is exactly what most skimmers are built to copy. At a gas pump, running a debit card as credit lets you skip typing a PIN, which keeps it away from any hidden camera.
What You Actually Owe If You Get Hit
The rules are more forgiving than most people think, and they lean in favor of credit cards. Under federal law, your maximum liability on a fraudulent credit card charge is $50, and it drops to $0 if you report it before the card is used. Vermont Attorney General Charity Clark points shoppers toward credit for the consumer protections built into it. You can start a chargeback and get the money back.
Debit is where the details matter, and skimming falls under a friendlier rule than most people expect. The $50 and $500 tiers everyone quotes apply when the card itself is lost or stolen. In a skimming case the card never leaves your pocket and only the number is copied, and the FTC says you owe nothing for transactions you did not authorize as long as you report them within 60 calendar days of the statement being sent. That clock runs from the statement, not from the day the theft happened. Check your statements often and flag anything strange the moment you see it.
Cops Now Have Gadgets That Sniff Them Out
Some departments stopped trusting the naked eye. A police department in Pottsville, Arkansas bought detection tools called Skim Scan and Skim Swipe after someone tampered with the card readers at a local Dollar General. An officer inserts or swipes the tool into a reader, and it lights up green in seconds if the machine is clean. Stores that pass get a “Safe Business Partner” plaque for the window.
The chief’s point was that modern skimmers hide inside the reader, where you cannot see, feel, or jiggle them loose. There is one strange upside when a skimmer does turn up. Police can pull the data straight off the recovered device to figure out exactly when it was planted, then match that against store camera footage to identify the person who put it there.
