Savannah Dansby was buying groceries for Memorial Day weekend at a Pyburns on Fondren Road in southwest Houston when her card caught on something as she swiped. She tugged at the reader. The front of it came off in her hand.
What she was holding was a skimmer, a fake shell built to sit on top of a real payment terminal and copy card data from everyone who pays. “I kind of pulled down and then it popped off,” Dansby said. She told store employees, posted photos of the device on Nextdoor, and called Houston police the next day. Officers were dispatched to the store that Sunday, according to the call log. The week before her trip, the Secret Service announced investigators had found more than a dozen skimmers across the Houston area during a large scale operation.
411 Devices Came Off Real Terminals In 2025
The Secret Service ran 22 skimming operations in cities around the country in 2025, working with federal, state and local police. Agents and their partners visited more than 9,000 businesses, inspected nearly 60,000 point-of-sale terminals, gas pumps and ATMs, and removed 411 illegal skimming devices. The agency put the potential loss prevented at more than $428.1 million.
The cities on that list are not obscure. Los Angeles, Washington, D.C., Anchorage, Boston, Orlando, Charlotte, Buffalo, San Diego, New York City, San Antonio, Baltimore, Tampa, Atlanta, Savannah, Memphis, Miami and Pittsburgh all had operations, some of them more than one.
Store owners usually have no idea a device is sitting on their counter. Vincent Porter, a Secret Service financial analyst, helped plan the operations that found them.
Skimming costs U.S. financial institutions and consumers more than $1 billion a year, by the agency’s estimate.
The Grocery Checkout Is Now On The Map
Gas pumps still get most of the attention, but the supermarket lane has been racking up cases. Two men were caught on camera installing a skimmer at BB’s Grocery Outlet in Providence Township, Pennsylvania, in December of 2025. Devices turned up at three different Weis Markets locations in Virginia, Maryland and Pennsylvania between January and March of 2025, and at a Save-A-Lot in Pennsauken, New Jersey, that March.
The run kept going. A skimmer was found at Assi Plaza International Food Store in Montgomery Township, Pennsylvania, in May of 2025, and at a Piggly Wiggly in Camden, South Carolina, that June. In January of 2026, one showed up on an ATM inside a Hannaford Supermarket in Chelmsford, Massachusetts, with a camera attached to record PINs.
Warehouse clubs are not exempt. In one of the bigger western Pennsylvania cases, two men placed skimmers at self-checkouts inside Sam’s Club stores in Washington, Allegheny and Butler counties back in 2022. The amount stolen was never specified.
What The Thing Actually Is
Pennsylvania state police Trooper Kalee Barnhart describes skimmers as fake overlays that look almost identical to the real front of an ATM, a store terminal or a gas pump. Shimmers are the newer cousin, a thin piece slipped inside the card slot that reads the chip instead of the magnetic stripe. Both take seconds to install and seconds to pull back off.
Thieves collect the stolen data through Bluetooth, an SD card, or by coming back and taking the device. Barnhart says self-checkouts, gas pumps and ATMs are the prime targets, and that crooks put the devices wherever it is easiest, meaning out of camera range or in poor lighting. The stolen numbers get encoded onto blank cards with a magnetic stripe, or sold online.
Almost every setup includes some way to grab your PIN. South Burlington, Vermont, Deputy Police Chief Sean Briscoe said his department has worked these cases, and that the rigs come as hidden cameras aimed at the keypad or as full keypad overlays. Where does it happen? “So it’s normally gas pumps, ATMs, something that you’re having an interaction with a machine rather than a person,” Briscoe said.
Greg Marchildon, AARP Vermont’s state director, points out why the cases go cold so fast. There are no fingerprints and nothing left behind, because the device has already been removed and carried off by the time anyone notices the charges.
The Five-Second Look That Catches Most Of Them
Before you insert anything, look at the reader from a step back. The Corpus Christi Police Department’s advisory tells shoppers to check for parts that look loose, differently colored or unusually bulky, plus scratches, glue or odd marks around the card slot and anything extra stuck near the keypad. If it wiggles when you touch it, do not use it.
Barnhart recommends a gentle tug on the reader, with the emphasis on gentle, and a scan for keypads that feel bulkier than they should or stickers in strange spots. If the machine is loose, call the local police department rather than the store’s 800 number.
Other tells: a reader that looks cracked or broken, a keypad that feels different under your fingers, added-on parts that do not match the rest of the housing, and a slot that will not take your card on the first try. At a gas station, the pump next to yours is a free reference point. If yours looks different, use the other one. Terminals that only accept a swipe of the magnetic stripe are the older, softer targets.
Tap. Just Tap.
Michael Peck, assistant special agent in charge in the Secret Service’s Criminal Investigative Division, told CBS News that tap-and-pay is “the best way to protect yourself as a consumer.” Contactless payments never put your stripe or your chip in contact with the compromised part of the machine.
Phone wallets are the stronger version of the same idea. “They’ve not figured out how to steal information using Apple Pay or Google Pay,” Barnhart said. Tap-to-pay on the physical card adds a layer too. And if you are pulling money out, an ATM inside a bank lobby beats a free-standing machine in a dim corner.
Why EBT Shoppers Get Hit The Hardest
Most government assistance cards still have to be swiped, with no chip and no tap option, which is exactly the weakness skimmers were built for. Seven states now issue chip EBT cards and six more are mid-rollout, but there is no federal deadline. Stores that advertise they accept those funds become targets, Porter said, and thieves time their fraudulent purchases around the monthly deposit dates.
Peck did the math out loud on what the 2025 haul would have meant. With monthly food benefits topping out between about $300 and $1,200 depending on household size, the $428.1 million in potential losses works out to hundreds of thousands of people who would have opened their accounts and found nothing there.
Recovery is brutal. Mary Bowen, a Los Angeles mother of six who relies on assistance, told CBS News her benefits were stolen and she could not pay rent or buy groceries, and had been eating food her friends gave her. Once the money is gone, the number of agencies involved in distributing it makes getting it back close to impossible.
Who Is Putting These On The Machines
Peck says organized groups from outside the country are behind the scheme, entering from Eastern Europe, Asia, and Central and South America, with many crossing the U.S.-Mexico border. One subject was apprehended after traveling down from Canada on a Jet Ski. CBS News counted 32 active federal probes spanning 15 states.
The payoff explains the effort. Officials believe a single skimmer can net up to $1 million in stolen funds, Porter told CBS News, and there is no way to know how long a device has been sitting on a machine before somebody spots it. During one California operation, law enforcement visited 328 businesses, inspected 1,749 devices, and seized 16 skimmers, which the Secret Service estimated prevented $16.6 million in losses.
They also come back. Porter said that within days, and sometimes hours, of agents teaching store owners what to look for, scammers had returned and installed new devices. The owners caught them, because by then they knew the signs.
Found One? Don’t Touch It, Report It
Police want the device left where it is and the machine left alone. Tell store personnel and call law enforcement. Corpus Christi’s non-emergency line for this is 361-886-2600. In Texas, you can also file a report with the Texas Department of Licensing and Regulation. A recovered skimmer is worth something to investigators: Barnhart says police can use the data on it to work out when it was placed and pull the surveillance video from that window.
Then check your own accounts. Barnhart’s one reliable test is not a physical inspection at all: keep track of your statements and make sure the purchases on them are yours. Turn on transaction alerts in your bank’s app so you hear about a charge the same day it happens.
Vermont Attorney General Charity Clark says paying with a credit card is a good defense because of the consumer protections built into it, including the ability to start a chargeback and get your money back if you are hit.
Our Take
Stop swiping. That is the whole verdict. The magnetic stripe is the part of your card that thieves can copy and reuse, and every skimmer on every gas pump and grocery self-checkout in the country exists to read it. Tap the card or tap the phone, and the overlay on the front of that terminal gets nothing.
When you have no choice but to insert, give the reader a light pull first and cover the keypad with your other hand. It costs you two seconds. A cashier’s lane is a better bet than the self-checkout at the far end of the store, because unattended machines are the easy ones, and the people who work a register every day tend to notice when their terminal suddenly looks wrong.
Nobody is inspecting these things for you at scale. Peck put it bluntly: managers tell agents they have already checked, the agents ask to look anyway, and they find a skimmer right away.
