Picture a Saturday morning at a gas station. You pull up, slide your card into the pump, pump twelve gallons, and drive off. Nothing seems wrong. Weeks later, a charge shows up in a city you have never visited. That is the basic story behind card skimming, and this piece walks through how it works, what the public sources say, and where those sources stop.
How skimming devices capture card data
Skimming means criminals install hidden electronic devices that record cardholder information at ATMs and point-of-sale (POS) terminals. A POS terminal is just the checkout machine where you tap, insert, or swipe. According to the U.S. Secret Service, the device sits between your card and the machine's legitimate reader. So it copies your data as the card goes in or through.
On ATMs, these devices are typically inserted deep inside the card slot. The Secret Service says they are usually impossible to spot from the outside. That matters because many people believe they would notice a fake part. Often, you would not.
A common myth is that a chip card makes you immune. The Secret Service notes that skimming devices can be built to capture both magnetic stripe data and the card's EMV chip data. EMV is the chip standard used on most U.S. cards. If the terminal itself has been tampered with, the chip alone does not guarantee safety. The sources do not explain how chips reduce risk in practice, so check your card issuer for that.
Where skimming happens and why it matters
The Secret Service says skimming shows up often at popular merchants such as pharmacies, gas stations, and grocery stores. These are places where lots of people use cards quickly, sometimes at terminals nobody is watching closely.
The agency is the lead federal investigator of access device fraud, which touches consumers, businesses, and financial institutions. It says skimming costs victims hundreds of millions of dollars each year.
The agency also reported on a 2025 push. Working with law enforcement partners, it ran 22 operations in cities nationwide and visited more than 9,000 businesses. Teams removed 411 illegal skimming devices and inspected nearly 60,000 POS terminals, gas pumps, and ATMs. The Secret Service credits the effort with preventing an estimated $428.1 million in potential losses. Those numbers come from the agency itself, not an outside audit. Still, they give a sense of scale.
What criminals do with stolen card data
Once data is copied, it has to be turned into money. Per the Secret Service, criminals re-encode skimmed debit or credit card data onto other cards. Those copies are then used for unauthorized ATM withdrawals or high-end purchases.
Some groups skip that step and sell batches of stolen card data to others. That means a fraudulent charge can show up long after, and far from, the place your data was taken. It also makes the original source hard to trace. If your card is misused, you may never learn which terminal was the culprit.
Defenders keep trying. ATM companies build security features against skimmers, but criminals adapt. Think of it as a back-and-forth, not a problem that gets solved once.
Spotting tampering and choosing safer terminals
The Secret Service lists several signs of ATM tampering:
- Inoperable or broken lights
- Raised or loose PIN pads
- Loose edges or loose components
- Stickers in unusual places
If you see any of these, do not use the machine. Tell the business or bank that runs it.
Location helps too. The agency describes ATMs inside financial institutions, in interior bays with security cameras, or closest to the drive-up window as harder targets. That lowers exposure but does not erase it. The agency also advises shielding PIN entry with your other hand. The text we could read is cut off before its full guidance, so read the Secret Service skimming page directly. The FDIC also has a consumer page, Beware of ATM, Debit and Credit Card 'Skimming' Schemes, that expands on warning signs.
Card-not-present fraud and online skimming
Card-not-present fraud means a charge made without the physical card, such as an online, phone, or mail-order purchase. Here the sources run thin. None of them describe how it works in practice, so this article will not pretend otherwise.
One related threat is online skimming, sometimes called e-skimming. It happens on checkout pages instead of physical terminals. The PCI Security Standards Council, which sets payment data security standards, has published a joint bulletin on online skimming and an information supplement on payment page security. The text of both was not available to us, so we can only point to them. The Federal Trade Commission's fraud guidance is another place to look.
What the sources do not cover
Several practical questions are left open. The sources do not explain consumer liability limits, how to report fraud, or how to dispute an unauthorized charge. The OCC and FDIC billing pages in our set held only navigation text. A Kansas City Fed briefing was listed but could not be read, so nothing from it appears here.
The sources also do not say what to do after a suspected skimming incident, such as watching statements or asking for a new card. If you think your card is compromised, contact your issuer or bank using the number on the back of the card or on an official statement. For your rights and reporting steps, check the CFPB and FTC, or a qualified professional. This article is education only, not advice for your situation.
Please seek a professional. This article is general information, not financial, tax or insurance advice. Please seek a licensed financial, tax or insurance professional about your own situation.
