Every fuel pump has a small hinged door where the receipt comes out. Nobody looks at it. On 18 March 2024, at a truck stop in Odessa, Texas, a camera watched a hand reach through one.
The hand was not fixing the printer. Surveillance video showed a suspect tampering with and removing an inline skimmer from the payment card reader inside the pump, part of an organised ring that investigators say used re-encoded stolen card data across multiple Texas filling stations from January to March 2024, according to reporting on the case. Every driver who paid at that pump in the weeks before had done nothing wrong. Card in, receipt out, drive away.
The federal cases tell the same story from the other end. Luis Edel Trujillo Pena, 29, of Miami, pleaded guilty on 6 December 2024 to conspiracy, wire fraud and aggravated identity theft as part of a multi-state gas pump skimming device and fuel theft ring, and the court ordered restitution to the victims defrauded.
Skimming was supposed to be a solved problem: chip cards, Chip and PIN, contactless. It is not. Across 2024 as a whole, US debit card compromise events and the number of compromised cards were both down on 2023, but inside that year the number of US debit cards compromised by skimming rose 30% in the second half against the first half, and skimming compromise events rose 46%. The physical checks in this article cost nothing and take a few seconds before your card leaves your hand, though what they catch is overlays and hidden cameras, not shims inside the slot and not fraud that never touches your card at all. Skimming is the last fraud you can still catch with your fingers.
What the 2024 numbers actually say
The direction depends on which number you look at. In the UK, total card fraud losses reached £572.6 million in 2024, up 3.9% from £551.3 million in 2023. In the US, the FTC logged 449,076 credit card fraud complaints in 2024, up 7.8% from 416,585 the year before. And in US debit card compromise, full-year 2024 compromise events and compromised card numbers were both down on 2023, with the 46% and 30% rises sitting inside the year, in the second half against the first.
An honest bound on all of this: skimming is not the biggest slice of the problem. Card Not Present fraud, where nobody touches your card at all, accounts for around 70% of UK card fraud losses and rose 11% year on year. Most stolen card money now moves through screens. Skimming is the minority share that happens at arm's length, in front of you, where a hand and 2 seconds of attention still change the outcome.
How a skimmer reads your card
The classic attack has two halves. A device attached to the cash machine records the details on your card's magnetic stripe, while a hidden miniature camera captures your PIN, the stolen data is then encoded onto a fake magnetic-stripe card and used at machines that have not upgraded to Chip and PIN, as UK Finance describes it. Neither half works alone. That is why the second half is the one you can beat with your free hand: cup it over the keypad while you type. It blocks the camera's view of your fingers, it costs nothing, and it breaks the pair.
The category has widened since. Skimming now covers surveillance devices, unsolicited emails and malicious code that capture and transmit cardholder data in real time from cash machines and checkout scanners, in Mastercard's description. And the locations are not the ones people picture. In New Jersey, reported skimming incidents rose 40% from 2022 to 2023, with physical skimmers found on cash machines and card readers at banks, pharmacies, and grocery and convenience stores across the state. The dodgy back-street machine is a comforting idea. It is also the wrong mental model.
So choose the machine rather than the neighbourhood: prefer a reader someone watches. Indoors is not immunity, given where those New Jersey devices turned up, but a skimmer still has to be fitted to the machine by hand, and a reader in a busy lobby is a harder place to do that unobserved than the pump furthest from the window.
Skimming is the last fraud you can still catch with your fingers.
Shimming: the chip does not save you
The move to EMV chip cards pushed criminals toward a newer technique, called shimming. A shim is a thin, card-sized device slid between the chip and the chip reader. It relays the commands passing between them, records the transaction information and stores it in flash memory for collection later, as Keysight sets out.
There is nothing to spot. A shim sits inside the slot, thinner than the card you are about to push in on top of it, and the machine behaves normally throughout. What that leaves you is a simple rule rather than a visual check: the slot is the risk. Any transaction that does not put your chip into a reader slot gives a shim nothing to relay.
The thief who has less reason to come back
The old weak point in skimming was collection. Somebody had to return to the machine, in daylight, on camera, and take the device off. Modern skimmers increasingly use Bluetooth or other wireless technology to send stolen card data remotely, reducing the criminal's need to physically retrieve the device and lowering the risk of detection, and some advanced skimmers capture PINs as well, according to the National Cybersecurity Alliance.
That changes the arithmetic of getting caught. A device that transmits what it reads gives the person who fitted it less reason to go back to the machine. In Odessa the collection still happened by hand, through the receipt door, and that is why there is footage of it at all.
What has not changed is the fitting. An overlay still has to be attached to the outside of a machine by hand, and an attached thing can be pulled. Grip the card slot and the keypad surround and tug before you pay: an overlay shifts, rattles or lifts at a corner, while a moulded fascia does not move at all. That is 2 seconds, and it works even when nobody ever comes back for the device.
Six free checks before you insert a card
Some of these have already appeared above. Here they are in one place, in the order you meet them at the machine.
- Tug the reader. Grip the card slot and the keypad surround and pull. A fitted plastic overlay shifts, rattles or lifts at a corner, a moulded fascia does not move at all. It takes 2 seconds and it happens before your card is out of your pocket.
- Cover the keypad. The stripe is only half the theft. The other half is a miniature camera watching your fingers, as UK Finance describes the method. One hand cupped over the pad blocks that view, and nobody has ever been charged for it.
- Look at the receipt door. In the Odessa footage, access came through that small hinged flap rather than the front panel of the pump. Loose hinges, fresh tape or a broken seal are reasons to use a different pump and mention it to the kiosk.
- Keep the chip out of the slot where you can. A shim only reads a card that has been inserted into a reader. Tapping, or paying at the counter, leaves the slot with nothing to relay.
- Prefer machines someone watches. Indoors is not immunity, given where New Jersey investigators found devices, but a skimmer still has to be fitted to the machine by hand. A reader in a busy lobby is a harder place to work unobserved than the pump furthest from the window.
- Read your statements weekly, starting with the small amounts. The Texas ring ran from January to March 2024 before the arrests, and drivers who paid at those pumps had no way of knowing at the time. Turn on your bank's transaction alerts if it offers them, that is usually the first thing to tell you.
Verdict: a card should be readable only when you choose
Skimming persists because it is patient and boring. The device asks your card a question, your card answers honestly, and nobody involved has any idea it happened until the money is gone. That is the whole crime: a card that had no way of refusing to be read.
So the defence is not vigilance in general. It is deciding, at each machine, who gets to read your card and when. Tug the reader. Cover the pad. Glance at the receipt door. Three moves, roughly 6 seconds, no cost, and they work on the physical version of this crime, the one that rose 46% in the second half of 2024 against the first half even as the full-year 2024 totals came in below 2023.