Card Skimming: How to Spot Skimmers at Pumps and ATMs

You swipe your card at the gas pump, fill up and drive away. Days later, strange charges show up. That may be card skimming: a skimmer, a hidden card reader attached to the pump, may have copied your card. The FTC says you often won’t know your information was stolen until you get your statement or an overdraft notice.

For other card-related scams, see our guide to credit and debit card scams.

What is card skimming?

The FTC describes skimmers as illegal card readers attached to payment terminals. They grab the data from your credit or debit card’s magnetic stripe without your knowledge. Criminals then sell the stolen data or use it to buy things online.

Skimmers can be fitted to gas pumps, ATMs and other card readers. Some sit on top of the real reader. Others hide inside the machine.

How can you spot a skimmer?

The FTC’s tips for checking a gas pump before you pay:

1. Check the panel. Make sure the pump panel is closed and shows no signs of tampering. Many stations put security seals over the cabinet panel; if it has been opened, the label will read “VOID.”
2. Compare the card reader with the readers on the other pumps. Does it look different?
3. Wiggle it. Try to move the card reader before you insert your card. If it moves, tell the attendant and use a different pump.

The same instincts help at ATMs and store terminals: anything loose, bulky, mismatched or damaged is a reason to walk away.

What are safer ways to pay?

• Run a debit card as credit at the pump. The FTC says this keeps your PIN safe and means the money isn’t taken from your account immediately.
• Pay inside if you’re really concerned about skimmers.
• Turn on transaction alerts with your bank or card issuer, so you hear about charges as they happen.

What should you do if your card was skimmed?

1. Call your bank or card issuer right away using the number on the back of your card or on your statement. Report the card as compromised and ask for a new one.
2. Review recent transactions and dispute any you didn’t make.
3. Monitor your accounts. The FTC suggests checking your credit card and bank accounts regularly to spot unauthorized charges.

Speed matters. The FTC says federal law limits your liability if your credit, ATM or debit card is lost or stolen, but how much you’re responsible for may depend on how quickly you report it.

If thieves used your information for more than one card, for example to open new accounts, see our steps for identity theft. For more on bank and payment scams, see our guide to bank impersonation and Zelle scams. If you also clicked a link in a fake “fraud alert” text, follow our first-hour checklist after a scam, and see where to report a scam for other agencies.