Card Skimmers: How to Spot a Tampered Gas Pump, ATM, or Card Reader

You stop for gas, slide your card into the pump, and drive away. Simple. But sometimes, that 10-second swipe can be enough for a criminal to copy your card's magnetic-stripe data.

Card skimmers are small, illegal devices that thieves attach to ATMs, gas pumps, and other card readers to secretly capture your payment data. They're built to be invisible. You may not notice until a fraudulent charge shows up.

The good news? You don't need to be a security expert to catch one. A few seconds of attention before you swipe can make all the difference.

What is a card skimmer?

A card skimmer is a counterfeit device placed over or inside a legitimate card reader. When you insert or swipe your card, the skimmer reads the data stored on your card's magnetic stripe, including your name, card number, and expiration date.

Criminals then use that information to make fraudulent purchases, clone your card, or sell your details on the dark web.

Some setups are more sophisticated. Thieves pair skimmers with tiny "pinhole" cameras aimed at the keypad to capture your PIN. Others use Bluetooth to transmit stolen data wirelessly, so thieves can collect it without reopening the machine. There are also ultra-thin devices called "shimmers" that slide inside chip-card slots and are usually hard to see from the outside.

The scale of the problem is real. The FBI estimates that skimming costs financial institutions and consumers more than $1 billion each year, and the Secret Service has repeated that figure.

Where do skimmers show up most?

Skimmers thrive anywhere that sees a high volume of transactions with minimal staff oversight. Gas pumps are a common target because, according to Florida inspectors, a device can be installed in under a minute. ATMs in convenience stores, parking garages, and tourist areas are also common spots.

Any machine where you insert, swipe, or dip a card is a potential target. That includes:

• Gas station pumps, especially those out of the attendant's view (the FBI advises choosing a pump close to the store and in direct view of the attendant)
• ATMs at standalone locations, airport terminals, or convenience stores
• Point-of-sale terminals at self-checkout lanes or low-traffic retail spots

Not all skimmers are equal. Some are crude overlays that a quick inspection will catch. Others are so well-made they're nearly indistinguishable from the real thing. What helps is knowing what to look for, even on the convincing ones.

How to spot a card skimmer before you swipe

These physical checks take less than 30 seconds. Build them into your routine every time you pay at a pump or ATM.

Check the security seal

Gas pumps often have a security seal over the panel where the card reader sits. If the seal is torn, peeled, or shows the word "VOID," someone has opened that panel. Use a different pump. The FTC advises checking that the panel is closed, with no sign of tampering and no "void" on the label. An intact seal doesn't guarantee the pump is safe, so keep checking the other signs below.

Wiggle the card reader

Give the card slot a firm but gentle tug. A legitimate card reader is solidly fixed to the machine. If it wobbles, gives, or feels like it's sitting on top of something, there's a good chance a skimmer overlay is in place. The FTC recommends this check. It can catch some overlays, but not skimmers installed inside the pump, which officials say often go undetected, so use it alongside the other checks and prefer a pump near the store.

Look for misalignment and color differences

Step back and look at the whole machine. Does the card reader match the rest of it in color and material? Is anything raised, bulging, or sitting slightly off-center? The Secret Service advises watching for parts that look different from the rest of the machine, such as loose or raised keypads. A mismatch in color or material is a reason to use another machine.

Peek inside the card slot

Look at the card slot before you insert your card. If anything looks jammed, bulky, or different from the other readers, don't use that machine. Devices inside the slot are usually hard to see from the outside, which is another reason to prefer tap-to-pay or chip over swiping.

Check the keypad

Keypad overlays are just as common as card slot skimmers. Press on the keypad. If it feels unusually thick, spongy, or loose, that's a warning sign. Also watch for a keypad that looks brand-new on a machine that otherwise shows wear. That mismatch can be a sign of an overlay.

Look for hidden cameras

Skimmers paired with cameras are meant to capture your PIN. Check above the card reader for small holes that might conceal a pinhole camera. Cover the keypad with your free hand when entering your PIN, even if you don't see anything suspicious. It's a simple habit that blocks any camera that might be watching.

Compare readers side by side

If you're at a gas station with multiple pumps, glance at the card readers on the others. They should all look identical. If one pump's reader looks different from the rest, skip it and report it to the attendant.

Tap, don't swipe

The Secret Service puts tap-to-pay first, chip second, and says to avoid swiping if you can. The FBI also says to tap instead of swiping or inserting at the pump if your card and the terminal allow it. Mobile wallets like Apple Pay and Google Pay use tokenization, so your real card number isn't shared with the merchant. Most skimmers capture magnetic-stripe data, so tapping gives them far less to work with.

If a machine doesn't support tap-to-pay, use chip-insert over swipe whenever possible. EMV chip transactions are harder to clone than magnetic stripe swipes. It's not foolproof against shimmers, but it meaningfully raises the difficulty for the thief.

What to do if your card was skimmed

You notice a charge you didn't make. Or you remember that last pump felt slightly off. Here's what to do right away.

1. Call your bank immediately. Report the suspicious charge and ask them to freeze or cancel your card. Ask for a new card and a new PIN, and follow up in writing to dispute the charges. Your bank can usually reverse fraudulent charges, depending on your card type and how quickly you report.
2. File a police report. Report the machine's location. This helps law enforcement investigate and can support a fraud claim with your bank. You can also report skimming to the FBI's IC3 at ic3.gov.
3. Report to the business. Tell the gas station, store, or ATM owner so they can check their machines and alert other customers. For gas pumps, you can also contact your state's pump-inspection office. Don't use that machine again.
4. Monitor your accounts closely. Watch for additional fraudulent transactions over the next few days. Set up real-time transaction alerts through your bank if you haven't already.
5. Consider a credit freeze if more than your card was exposed. A skimmer captures card data, not your Social Security number, but if your SSN or other personal information was also exposed, a freeze blocks new accounts from being opened in your name.

One important note: credit cards offer stronger fraud protections than debit cards under U.S. law. According to the FTC, your liability for unauthorized credit card charges is capped at $50, while debit card liability depends on how quickly you report: $50 within two business days, up to $500 within 60 days, and potentially more after that. A stolen debit PIN can also let thieves withdraw cash directly from your account, so if you have the choice, pay with credit.

Stay a step ahead

Card skimmers are a physical threat, but you're not powerless against them. The people who get hit hardest are usually the ones who never checked. The ones who don't get hit? They spent 20 seconds looking before they swiped.

Make it a habit at every gas pump and ATM: wiggle the reader, check the seal, cover your PIN. Use tap-to-pay when you can. And if something feels wrong, trust that instinct. There's always another pump.

Conclusion

Card skimmers rely on speed and routine. A few seconds of attention before you pay, plus a preference for tap or chip over swiping, makes you a harder target. If a charge shows up that you don't recognize, call your bank right away, ask for a new card and PIN, and tell the business so they can check the machine.

Guardio can't spot a skimmer on a gas pump, but it covers a related risk. Criminals also collect card details online through fake checkout and phishing pages. Browsing protection on your computer and phone blocks phishing and scam sites before they open and explains why, and Email Security flags phishing emails that get past the Gmail spam filter. No tool catches everything.

Get a free security scan with Guardio today and stay protected from phishing.