Tapping at the gas pump may save you from becoming a victim of theft.
getty
Thinking about taking a road trip this summer? It’s not just gas prices that you need to keep an eye on: gas pump card skimmers can also take a bite out of your finances. According to the Federal Bureau of Investigation (FBI), card skimming costs financial institutions and consumers more than $1 billion each year.
What Is a Gas Pump Card Skimmer and How Does It Work?
A gas pump card skimmer is a hidden device that steals payment card data when you pay for your gas. It may be attached over the card reader, hidden behind the pump face, wired into the pump’s internal electronics, or paired with a tiny camera or keypad overlay to capture your personal identification number, or PIN.
It may not always be easy to spot. Gas pump skimmers may be attached to internal wiring and not visible from the outside. Another option is that a skimmer may sit inside the pump and store card data for later pickup or wireless transmission. That’s one reason swiping can be riskier than using a chip, tap-to-pay, or a mobile wallet.
It usually takes only a few seconds to install external skimmers, while internal devices may require more time and access to the pump cabinet.
In one case, thieves in Utah installed Bluetooth-enabled card skimming equipment on the motherboards at the pumps, and then returned within Bluetooth range to download card data, including credit card numbers, names, and zip codes. They were then able to use the data to create duplicate cloned cards encoded with the same data as the customers’ authentic credit or debit cards. After making the cloned cards, the thieves tested them with small transactions—typically $1—to identify which debit and credit cards could be used for larger purchases and cash withdrawals. Six defendants were ultimately found guilty and sentenced for their roles in the scheme.
Are There Other Card Skimmers?
Gas pumps aren’t the only places that you’ll find card skimmers. Thieves can also install skimmers on ATMs, vending machines, parking meters, and other payment terminals where you swipe, insert, or tap a card. The basic idea, however, is the same—to capture payment information, and in some cases, a hidden camera or keypad overlay can capture your personal identification number, or PIN.
What Can a Thief With a Skimmer Do With Your Card Information?
What the Utah thieves did was not unusual. A card skimmer can give criminals enough information to create cloned or counterfeit cards and make unauthorized purchases like for fuel, gift cards, or electronics using your credit or debit card. If they manage to capture your PIN, too, they can use the information to drain money from your bank account. And even if they don’t use the information to steal immediately from you, they can sell the card data in criminal marketplaces (typically found on the web) or pair the card data with other information for additional identity-fraud attempts.
How Can You Protect Yourself From Card Skimmers?
There isn’t a single public database ranking states by gas pump skimmer cases alone, but broader card-skimming data shows the problem is concentrated in a handful of states. According to the Fair Isaac Corporation—best known as FICO—California led the country in skimming event locations in 2023. But in 2025, New York surpassed California for the highest incidence of card-skimming compromise activity. In 2025, 70% of these compromises occurred in just 10 states: New York, California, Massachusetts, Maryland, Virginia, Pennsylvania, New Jersey, Colorado, Texas, and Illinois.
So what can you do? There are a few ways that you can protect yourself at the pump:
- Compare pumps before you swipe. The card reader, keypad, tap-to-pay area, screen trim, and pump door should match those at the other pumps and stations. If the reader at your pump is a different color, or has mismatched plastic, odd seams, or an extra overlay, consider moving on.
- Physically inspect the reader. Before inserting or swiping your card, take a look. Consider tugging or wiggling the reader and keypad. If it moves, report it and use a different pump.
- Check the pump panel and security seal. If the pump cabinet appears open, damaged, or misaligned, or if the security tape reads “void,” skip it. The Federal Trade Commission (FTC), a federal agency tasked with protecting consumers from deceptive or unfair business practices, explains that many stations use security seals on cabinet panels, which means that the opened panels may display a void label.
- Look for hidden cameras or keypad overlays. According to the FBI, a camera may be hidden above the keypad, near the screen, under a brochure holder, or in a small, drill-like opening. The FBI also warns that keypad overlays can record keystrokes and that visual inconsistencies in the keypad may indicate a foreign device. If you need to enter a PIN, use the same advice that your mother gave you: cover the keypad with your hand while you type.
- Prefer pumps near the store. Pumps close to the cashier and in view of attendants are less attractive targets to thieves because they’re harder to tamper with and not be caught. The FBI specifically recommends choosing pumps closer to the store and in direct view of the attendant.
- Use tap-to-pay or mobile wallet when available. Tap or contactless payments are typically safer than swiping because they do not expose magnetic stripe data. And, when possible, use a credit card or mobile wallet at the pump instead of a debit card.
What To Do If You Think Your Card Was Skimmed
If you think you’ve been a victim of card skimming, contact your bank immediately. Tell them what happened and then take steps to mitigate the damage. That can include freezing or locking the card, disputing unauthorized charges, and requesting a new card number. If you used a debit card, be sure to change your PIN. No matter whether you used a credit or debit card, you’ll want to turn on transaction alerts and carefully review recent and pending transactions.
The FTC says that reporting quickly matters since your liability depends on the type of card—and your timing.
For credit cards, the burden of loss is typically on the card issuer. If you report the card lost or stolen before it is used, you cannot be held responsible for unauthorized charges. And, federal law generally caps your liability at $50 if your card is lost or stolen.
Debit cards can be more painful because the money is immediately gone from your account. According to the Consumer Financial Protection Bureau (CFPB), if you notify your bank within two business days after discovering the loss or theft, your liability is capped at the lesser of the unauthorized transactions or $50, and after two business days, you could be liable for up to $500. However, if the money has been removed from your account, you may have to wait until an investigation is made before you get reimbursed for your loss.
Because of the timing issues, typically, for everyday fraud protection, credit cards are usually safer than debit cards.
Finally, don’t forget to report the suspicious pump to the station attendant and local police, and report the skimming incident to the FBI’s Internet Crime Complaint Center, commonly referred to as IC3.
Read the full article here