Turn on payment alerts: a tug on the card reader can miss a skimmer

You are about to put your card into a fuel pump or a cash machine (ATM), and you have heard that you should give the reader a tug first. Many people suggest it, and the US Federal Trade Commission (FTC) describes the same check. It is worth doing. It cannot tell you the reader is clean.

A tug can catch a skimmer that is loose, but a reader that does not move may still be bad, so turn on a payment alert for every card you use, and pay by chip or tap where you can.

A skimmer is a device criminals fit to a card reader to copy what is on your card. The FTC says skimmers are illegal card readers attached to payment terminals, that they grab the data off the magnetic stripe without your knowledge, and that you will not know your information has been stolen until you get your statement or an overdraft notice. That last point is why a payment alert helps.

If a charge you did not make has already appeared, call the number on the back of your card now. The section “If a charge is not yours” says what else to do.

What a tug can and cannot tell you

In a 2018 consumer alert, the FTC tells drivers to look at the card reader and see whether it looks different from the others at the station, and to try to wiggle it before putting in a card. If it moves, tell the attendant and use a different pump. The same alert says many stations put a security seal over the pump’s panel, and the label reads “void” if the panel has been opened.

Officials say the check has limits. Los Angeles County’s Department of Consumer and Business Affairs said in 2023 that most skimmers at cash machines and shop terminals fit over the original reader, but at fuel stations they can also be hidden inside, behind the reader, and that skimmers are hard to detect because they are made to blend into the terminal. The Texas Department of Licensing and Regulation says skimmers are installed inside fuel pumps and in card readers. The Kansas Department of Agriculture says criminals have been breaking into pump cabinets to fit them, and that tape on a cabinet cannot stop a criminal but will show you if it was opened. The Pennsylvania State Police said in a 2022 bulletin that many skimmers are made to fit over the original card slot and PIN pad, that some criminals use 3D printers to make parts that hide a skimmer, and that devices called shimmers fit inside the machine and copy information from the chip. It said that, because skimmers are disguised so well, a victim may not realise their card information has been copied until they see unusual activity on the account or get a fraud notice from the card company. A tug on the outside tells you nothing about a device inside.

People discussing the tip raise the same limits. Some people say a skimmer can sit inside the card slot, so pulling on the outside does not move it. Some people warn that the seals on pump cabinets can be faked, so the seal is a check to make and not a guarantee.

So treat the tug as one cheap habit that can catch one kind of device. If a reader moves, looks different, or has a loose slot, do not use it.

What helps more

1. Switch on a payment alert for each card. Report Fraud, which takes fraud reports in England, Wales and Northern Ireland, says that if you have online banking or an app, you should set up notifications so one arrives whenever you make a payment, “so you know when it wasn’t you”. Los Angeles County’s department also lists alerts for bank and credit card transactions. With no app, Report Fraud says to check your bank statements regularly and to report any payment you do not recognise to your bank immediately. One person suggests an app that switches a debit card on and off, because you cannot know whether your card number was copied. If you do not have online banking, ask your bank what it offers.
2. Use tap or a phone wallet, or the chip. The Pennsylvania State Police says to use tap-to-pay or a phone wallet whenever possible, because those are very difficult for criminals to intercept, and to use the card’s magnetic stripe only as a last resort. Los Angeles County’s department says to use a chip card if you have one, and to use a contactless card or a phone to tap on a contactless terminal. Some people say chip readers make copied stripe data useless for in-person payments. The Kansas Department of Agriculture says a card is still open to misuse online or if it is swiped at a reader that has no chip, and the Pennsylvania State Police’s warning about shimmers is a reason not to treat the chip as a complete shield.
3. At a fuel pump, pay inside if you are worried. The FTC says that if you are really concerned about skimmers, pay inside rather than at the pump. The Texas Department of Licensing and Regulation says to choose a pump close to the building and in the clerk’s line of sight. Paying inside lowers the risk at the pump and does not remove it: the Kansas Department of Agriculture says thieves can also fit skimmers to cash machines and to the card reader at the counter.
4. In the US, if you use a debit card at a pump, do not type a PIN. The FTC says to run it as a credit card instead of entering a PIN, so the PIN is safe and the money is not taken from your account at once. The Texas Department of Licensing and Regulation goes further: it says to use a credit card or choose credit, and never to use a debit card.
5. Cover the keypad. The UK government’s fraud campaign says to stand close to a cash machine and cover the keypad with your wallet or your other hand, and not to let anyone distract you while you enter your PIN. Los Angeles County’s department says the same about covering the keypad, and says never to share your PIN with anyone.
6. Look at the machine, and if anything looks wrong, do not use it. The Pennsylvania State Police lists these signs of tampering at a fuel pump or cash machine: components that look or feel different from most of the machine, a broken tamper-resistant seal on the fuel pump, graphics that are not aligned correctly, machines side by side that look different, and buttons that do not work correctly or are hard to press. It says that if any of these seem to be the case, do not use that machine. Report Fraud says that if a cash machine looks unusual or has been tampered with, you should not use it and should report it to the bank as soon as possible. Los Angeles County’s department says that if a machine wiggles or seems loose, you should not swipe or insert your card, and should tell the business and the local police. If a cash machine keeps your card, Report Fraud says to tell your card company straight away, ideally by mobile phone while you are still in front of the machine, and to keep your card company’s 24-hour number saved in your phone.

Two ideas that do less than they sound

A Bluetooth scan

The Pennsylvania State Police’s 2022 bulletin says an unfamiliar Bluetooth device with a long string of random characters that is trying to connect to your phone could be a skimmer. One person who says they work in security, and that what they know comes from reading online, says most skimmers use no Bluetooth at all. This page could not check that. A scan that finds an odd device is a reason to use another machine, and a scan that finds nothing does not clear the reader.

A made-up PIN written on the card

Many people suggest writing a made-up PIN on the card, so a thief who tries it gets the card locked. Some people say it does little, because a thief can use the card details without any PIN. Report Fraud says someone who knows your card number, expiry date and security code can buy in your name online. None of the official pages read for this page suggests writing a PIN-like number on a card, so this page does not either.

If a charge is not yours

Call the number on the back of your card now, tell your bank or card company, and ask what they need from you. The FTC says to report a compromised card to your bank or card issuer. When a card is skimmed you usually still have it, and only its details were copied. For that case, in the US, the FTC says that you are not responsible for credit card charges you did not authorise. For an ATM or debit card, it says you are not responsible if you report within 60 calendar days after your statement is sent to you. After that, you could lose all the money taken from your account, and possibly more. If an ATM or debit card itself was lost or stolen, the FTC’s limits are different: what you can lose goes up if you report it more than 2 business days after you learn of it. For a lost or stolen credit card, it says the most you might be responsible for is $50. In the UK, Report Fraud says to report any payment you do not recognise to your bank immediately. There is a page here called Whose money is missing while the fraud is sorted out? about what happens next on a debit card and a credit card. If you were tricked into paying someone, the guide I paid a scammer, or think I’ve been scammed has the deadlines and what to say.

Then report it. In the US, the FTC runs ReportFraud.ftc.gov, where you can report a scam and get next steps; it says it cannot resolve your individual report. In England, Wales and Northern Ireland, Report Fraud takes reports online or on 0300 123 2040, and its website says that in Scotland you report through 101. If you saw a device on a machine, tell the staff and the police as well.

If your bank will not put it right, the Consumer Financial Protection Bureau takes complaints about banks in the US, and the Financial Ombudsman Service looks at them in the UK. In England and Wales, the Citizens Advice consumer helpline, 0808 223 1133, says its advisers can give advice on how to resolve a consumer problem and tell you the law that applies. In Scotland, Advice Direct Scotland is on 0808 800 9060. In Northern Ireland, Consumerline says you can ask it about your consumer rights on 0300 123 6262. This page cannot tell you what your bank owes you.

Who this page is not for

If someone you know used your card, or you shared your PIN, the steps are different and this page does not cover them. Ask your bank before you assume you are covered.

If the card is an EBT card for food or cash benefits, this page does not cover it. USDA says federal replacement of SNAP benefits stolen by skimming ended for thefts after 20 December 2024. Call the number on the back of the card, or your state’s benefits office, to report it and ask what help your state gives.

A taxi driver who says the card machine is broken is a different problem, and this page does not cover it. If you feel unsafe with anyone, call 911 in the US or 999 in the UK.

Outside the US and the UK, the rules and numbers differ. This page does not list them.