A hidden skimmer on a gas pump or ATM copies your card and PIN
Criminals attach thin overlay readers to gas pump card slots or ATM card readers, and pair them with pinhole cameras or keypad overlays to capture your PIN. Card data is used to make counterfeit cards or sold on dark-web markets. Summer 2026 surge reported by the Secret Service.
Also known as: gas pump card skimmer, ATM skimmer, fuel pump card reader scam, card shimmer, skimming device fraud
Already happened to you? Do this in the next few minutes
- 1 Call your bank or card's fraud line right now. Use the number on the back of your card — not any number from the message or caller. Ask them to stop or reverse the payment and freeze the account.
- 2 If you paid by gift card, wire, or an app (Zelle, Venmo, Cash App): contact that company immediately and report it as fraud. Acting fast sometimes recovers the money.
- 3 Report to the FBI at ic3.gov and the FTC at reportfraud.ftc.gov. The sooner, the better.
What to do right now
- 1 Use tap-to-pay or insert chip (EMV) whenever the terminal accepts it — contactless payments do not expose magnetic stripe data that skimmers capture
- 2 Wiggle the card reader firmly before inserting your card — a legitimate reader is fixed; a skimmer overlay will shift or feel loose
- 3 Cover the keypad with your free hand when entering your PIN, even if no camera is visible — it's a habit that defeats pinhole cameras
- 4 Prefer ATMs attached to bank branches over standalone kiosks; branches have more frequent inspection and tamper-evident tape
- 5 Inspect the pump's security tape seal around the door panel — if it reads 'VOID,' appears cut, or has been re-applied, go inside and pay or use another pump
- 6 Set up real-time transaction alerts with your bank so you see any charge the moment it posts
- 7 If you spot a suspected skimmer, do not use the machine — notify the gas station staff and local police, then report to the FTC at https://reportfraud.ftc.gov
- 8 If you were skimmed, call your bank immediately to freeze the card and dispute the charges; federal zero-liability rules apply to unauthorized debit and credit card use
- 9 Report to the FTC at https://reportfraud.ftc.gov and the FBI's IC3 at https://www.ic3.gov.
Red flags
- ⚠ The card reader feels loose, wiggles, or looks slightly misaligned with the machine's body
- ⚠ You notice a false keypad overlay — it may feel thicker or spongier than usual when pressing keys
- ⚠ A small adhesive mirror, brochure holder, or plastic strip appears above or beside the keypad where a pinhole camera could hide
- ⚠ The machine looks newer or shinier than surrounding hardware (scammers install well-made overlays)
- ⚠ Unauthorized charges appear on your account 24–48 hours after using a gas pump or ATM, often at retailers in a different state
- ⚠ The pump's security tape seal (often printed 'VOID' when broken) appears cut, peeled, or re-applied
Card skimmers are passive devices — they do nothing until you insert your card, and they give nothing away while they work. The only real defense is inspection before you swipe or insert, and real-time alerts so you know within minutes when a charge posts.
If you already have fraudulent charges: call your bank immediately (do not wait). Under federal law (Reg E for debit, Reg Z for credit), you are entitled to dispute unauthorized transactions. Acting within two business days limits your debit card liability to $50; waiting longer raises it to $500. Credit cards carry zero-liability in practice at all major issuers regardless of when you report.
Known variants
-
A shimmer — a paper-thin device inserted inside the chip card slot — reads EMV chip data as the card is inserted. Unlike overlay skimmers, shimmers are invisible from outside and cannot be detected by wiggling the reader. Data is used to clone the magnetic stripe of the card.
Last seen: 7/21/2026