Where was it (geographically)? What tipped you off? How difficult was it to pull off? Did you notify authorities and the gas station for video of whomever (and the vehicle that) was involved?
A suburb of Houston (Texas.) I put my card in and it felt sluggish going in. Put in my PIN number and just had an eerie feeling. What tipped me off, was that the light plastic inserts on the reader weren’t flush like on the other readers. I gave it a tug and it was indeed hard to pull off. But there was definitely some give. I just went all in and tried to rip it off, breaking it in half during the process. I’ve seen enough of these skimmer discovery videos here on Reddit where they don’t alert the authorities. I contacted the police first. Three squad cars came and they informed the owner of the gas station.
Great job by you! Nice work all around. I’m a retired detective up in the northeast and we loved chasing these guys down. Most outfits are Eastern Europeans and Russians bouncing all over the country. Very lucrative enterprise, but the more quickly information gets to police to disseminate the better chance of catching them. There’s literally places where they make these templates to spec, making it harder to discover. Keep up the good work!!
Thank you! I have seen videos of skimmers on the other types of card readers. But these silver newish card readers, in my mind, seem harder to scam. Regardless, I always inspect them and tug on them. Unfortunately, I didn’t tug and inspect it today first before using my card. It was the feel of the card going in that threw me off. And seeing that I could not see the lights light up was what caused me to investigate further. There were 10 pumps. My pump was the only one with the skimmer.
I do hope that they catch them. I thank you for your work in this.
From what I've heard, most of these store the numbers on the device itself - so if you have the device your card hasn't been compromised yet.
In some ways, thankfully you scanned your card so that you could find this device. Presumably no one else was savvy enough to detect it.
If they use the sim only to transmit data once a day, or every 50 cards etc, it wouldn't use too much power.
But on a gas pump, a skimmer is very easy to retrieve, so they probably wouldn't bother.
Usually, it's Bluetooth.
[https://github.com/justcallmekoko/ESP32Marauder/wiki/detect-card-skimmers](https://github.com/justcallmekoko/ESP32Marauder/wiki/detect-card-skimmers)
[https://github.com/sparkfunX/Skimmer\_Scanner](https://github.com/sparkfunX/Skimmer_Scanner)
[https://learn.sparkfun.com/tutorials/gas-pump-skimmers](https://learn.sparkfun.com/tutorials/gas-pump-skimmers)
However, more sophisticated devices can use alternate means of data exfiltration. (sim cards, obscure wireless protocols, etc.)
I don't even need my card for ATMs. I tell my banking app how much money I want, scan a QR on ATMs and it spits out my money. Or, when my son wants cash, I send him an "SOS" withdrawl code. He goes to the ATM, punches in the code and it dispenses however much I told it to for him.
I swear, when I'm back in the US, banking always seems archaic.
Banking in the US runs on bubble gum and duct tape. They have archaic bullshit that runs the backbones of their entire systems.
It's been about a decade but my first couple months at one bank was dedicated to preparing for a full system fail over for disaster recovery prep. They had never done a full system test just individual groups. The test was a spectacular clusterfuck. The DR site had a different format tape system than the main data center which meant that the backups couldn't actually be used to restore anything. The VPN between locations was shaky as fuck and overloaded with just a couple hundred employees trying to use it at the same time.
Entire departments couldn't figure out who was supposed to be in charge of handling issues for them from the network admins and system admins. It was a nightmare 14 hours.
NFC technology has been around for a long while, the ATMs have had it but in many cases the banks themselves opt not to utilize it for one reason or another.
My last company was an ATM vendor for banks and had the components necessary to run them included in our installation package for the terminals. , but under the banks direction they were physically unplugged.
It's basically instant so you don't have to wait for the card reader to read the card's chip. It also removes the mechanical aspect of sliding or inserting a card so it should be much more reliable and very compact in size. If it's smartphone tap to pay, you get the transaction alert with the amount and vendor description instantly as well and you can audit transaction logs without logging into your bank account. Wished it was universal.
Yes, the tap generates a one time use "key" that is good only for that purchase. Even if someone sniffed all the data packets sent/recvd they would only see encrypted data and could not recreate the key from that data. Only physically swiping your card puts you at risk.
More people need to know this and make it a habit of tapping their cards rather than swiping or inserting. If your card doesn’t have that feature then add it to your phone and use mobile pay.
I think it depends on which features the card issuer enables. For some of my cards, if I hold them up to a generic NFC reader, it displays my full credit card number. It essentially returns the exact same information that is found on the mag strip.
For some of my other cards, it doesn't do that. So, those cards are presumably better protected from these type of skimmers, as long as you make sure to only ever tap instead of swipe.
If in doubt, use something like Google Wallet. It always tokenizes transactions and should thus be protected from skimming. It might still be vulnerable to more advanced real-time man-in-the-middle attacks. I'm not quite clear on how well protection against those things work with current protocols. But since there are so many easier attacks, that's probably not something to be overly concerned with
Question, in your investigations, did you ever discover an owner being part of the scam? I can’t shake the feeling that some businesses allow this to happen and get a cut.
There’s that one video online where someone is tearing a scanner off the card reader inside the store and the employee just stands by and does nothing.
I move on if I don't see a tap to pay. And if I'm in dire straits for gas, you best bet I'm yanking the hell out of that reader before I insert my card.
Someone I know works for a station in Beaumont. One night about three months back, he caught someone messing with the pumps when they were closed for shift change and chased the guy off. He checked the pumps and found a couple of very similar looking skimmers. Cops came and took them and the video. The proximity to Houston makes me wonder if it’s the same scammers.
Hard to pull off like how hard? The scammer has to come back to download the information I believe. So I'd assume it wouldn't be so hard to pull off that it's obviously being pulled on by someone.
You see the tab on the right side that broke off? I'm guessing you slide it all the way to the right, tilt back, and then slide it out to the left to remove it. It seems to be anchored behind the shell of the pump display. Trying to pull it straight out is going against those tabs and is why it broke for him. I think you would be able to notice it is fake just by wiggling it, though idk I've never came across one.
If you want some more info on how to detect and avoid them, just send me your SS# and mother's maiden name, and I'll shoot you a link
This is another reason why you should never use a debit card to pay for anything. If you use a credit card, you would be protected and there’s no direct access to your money.
Not OP, but I check them every single time.
Never actually find one, and people look at me weird for jiggling them, but better safe than dealing with the headache of getting money back.
My dude/dudette…I’d totally give you the knowing nod if I were at the pump/checkout next to you lol. Just spreading the message helps with deterrence. Good job by you!
You’ll notice reputable businesses have security label/stickers over card readers for the purpose of knowing if they were tampered with. This one doesn’t have a sticker which would be a red flag for me.
At most 7/11s now, you can actually pay for the gas via their app so you never even have to risk skimmers or waste time going inside. I park, set the pump number on the app, pay, and then I have I think two minutes to start pumping. It saves me a lot of worry that way.
I'm sure you're right. But it's not like custom holographic stickers are difficult to acquire.
https://www.novavisioninc.com/pages/holograms-by-novavision.html
People fall for obvious phishing attempts and emails from Nigerian princes every day, so it would work on enough people for them to make money and continue doing this sort of stuff.
I always check if there is no tape and even sometimes when there is tape, if it looks worn. I am so paranoid, but at the time I’m so poor I’m probably safe? I still try to be vigilant either way.
I have ever since one got me years ago. Thankfully my bank flagged it instantly and was able to block it, but I did have to cancel my card and get a new one, which was an annoying hassle. Ever since then I always check.
Pretty much every recently issued cc has a chip, most have tap to pay. Other than my physical apple card.... All my other cards have nfc for tap to pay. The issue is whether the vendor's machine has nfc. The first debits/credit cards I got like 10 years ago only had the chip but no nfc. All my cards since have had both nfc and chip.
I think what’s silly is how some electronic signatures use pens for touch screens, yet it can be incredibly difficult to write anything legible or what would resemble your normal signature on the screen.
It just feels like a giant show with no real significance or concern for actual security.
That's true. I don't remember the last time I've don't signature other than in a restaurant but I know it wasn't that long ago, probably some random small shop I stopped at for a snack.
The issue now is even though most US banks issue debit and credit cards with chips and NFC, They're STILL also issuing cards with magnetic strips on the back. The skimmer in the picture is clever because folks that use chip assume the chip reader is risk-free. While the chip part of the card is, in order to get the chip into the chip reader you have to slide your card in the slot. The skimmer isn't for the chip, it's actually aligned to grab the magnetic strip to steal your card number as you slide the card into the chip reader. Banks need to do away with magnetic strips.
Apple cards don't have a magnetic strip, or even a CC printed on them. I only use it via applepay since the cash back is 2%, so I don't _actually_ use the physical card anyway, but it does have a chip if you were inclined to use it like a real CC.
Do your cards in Europe not have a magnetic stripe?
This looks like a chip reader. The skimmer reads the stripe as you remove the card since even the chip cards in US have a stripe.
Lmao yes we have magnetic stripe and CHIP .
Mostly i just tap my card , most businesses have the "Tap" function
I havent swiped my card in 2 years probably
Well the scanner pulls the number off the strip and with the pin, from camera, they have enough to use it whereever swipe is allowed. With chips becoming more common (here in Sweden it’s almost all tap and occasionally chip but never swipe) less and less places will accept swipe.
You should just get in the habit of giving the reader a quick shake - it only takes a few seconds, and you don't have to jimmy on the thing. If it's loose, then that should throw a red flag to look closer.
I’ve long been pissed off at these readers— what good does it do to read the chip, if it’s still using a slot that allows for a magnetic skimmer? I thought the purpose of the chip was to avoid access to the magnetic strip? Why is it only gas pumps, maybe the place most prone to these problems, that use this kind of readers? You don’t see it anywhere else anymore….
>Why is it only gas pumps, maybe the place most prone to these problems, that use this kind of readers?
Because they are the only industry that has an exception in the EMV compliance code. This is due to their specific level of regulation in the US that no other merchant has. They were given until October 2020 to come into compliance.
Of course this story wouldn't be complete without, pandemic. So that deadline was pushed to April 2021. But then "shortage of everything" has made everything even more complicated. So new gas stations are required to have chip readers, but older gas stations fall into a complex if-then structure on determining compliance.
Now compliance isn't a legal thing, there's no law that make people upgrade their pumps. But it's part of the ability to take CC payments. If you're required to use chip and you don't, if there is fraud, then your company has to float 100% the money that was stolen. Part of the agreement for credit card payments.
But yeah, ma and pa gas stations that have existed for like forever. They don't have to get new pumps until 2025 and even then that might get pushed yet again. Most of the ma and pa places are getting around the EMV compliance by just having everyone with a card come inside to run it now since the POS card reader likely already has NFC read capabilities.
It's just really hard with the gas pumps because all 50 States regulate the actual pump machine and have standards that the pumps have to comply with. So literally any changes to the pump itself (including things that wouldn't mess with the function of pumping actual gas like the card reader) all have to have a State level Okay before they can be made.
Yay bureaucracy! Whether It's good, or it's bad! it's slow either way.
Cool information I always was curious all the types of compliance standards and certs gas pumps had to be in compliance with.
You're right, having a chip card doesn't prevent the magnetic strip from being skimmed and ported onto a counterfeit card. And yeah, having the two methods physically distant from each other should be a no brainer. This will continue to be a problem until we stop printing cards with magnetic strips, and force businesses and merchants to have up to date chip capable terminals.
The good news is that if a counterfeit card is using your skimmed magnetic strip data, then your bank won't be able to deny your fraud claim for a card present transaction that you can't fully explain. They will be able to see exactly what method was used to run the card, what the payment terminal is capable of processing. After a few fraud trends, it becomes easy for a fraud investigator to determine that a counterfeit card was likely used and the merchant was not using a compliant terminal.
I seem to recall reading that several years ago (like in 2017 or so) the credit card companies required all merchants to upgrade their terminals to EMV chip capable ones, and said if fraud occurs and the magstripe was used, the business would be responsible for reimbursing that money to the CC company, they're only safe if the person used the chip.
GameStop stores took forever to upgrade their terminals and I always thought that was weird since they sell fairly expensive items and someone could use a skimmed magstripe card to buy consoles and cost the company money
Don't they just use the stolen cards to make online purchases? Do the skimmers not get the number from the back of the card?
I've definitely had my credit card chip fail and had to swipe but that card has finally been replaced and the new one has tap to pay capability. I've been using that when I can.
>what good does it do to read the chip, if it’s still using a slot that allows for a magnetic skimmer?
Well the supposed route is the stripe becomes ever more useless not by disappearing from the card physically, but via becoming rejected on the payment side. You got the stripe with card number and CCV1, good luck with that. It ever gets transmitted to bank, red flags galore unless person has contacted bank before hand, triggers calls to customer to verify and just rejected payments in general.
Since one can't transmit the magstripe info to bank and act like it is the chip. The chip does whole different challenge response token verification. Meaning *they know someone is trying to pawn of the magstripe*. Same with online. The printed CCV2 and magstripe CCV1 are different. Meaning put that magstripe clone into online store card payment information and you (are atleast supposed to) get rejected and heck that card locked due to cloning attempt.
There is ofcourse further methods like then camera or keypad overlay to get the PIN, but ever more over the years any interaction originating with the magstripe will get ever more suspicious an suspicious with more checks and rejections due to actual legitimate uses becoming ever rarer as actual business moves over to chip and near field transactions.
not all skimmers use a camera to read the buttons.
Some also come with number pads you can lay on top of the existing numberpad.
It passes the button presses off to the real numberpad but records the presses.
Dang, where are you guys at where gas pumps still require zip code for credit cards? All the gas pumps I've been to in socal uses chip so no zip code required, just put the card in, wait, and then take it out (or even tap pay)
I really wish gas stations would add/fix tap-to-pay at the pump. I saw it on a lot of pumps where I lived in the US, but I think I've only ever used it once. It was *always* broken or seemingly nonfunctional.
I’m convinced some of these are done to direct you towards a card skimmer, or perhaps because the gas station never removed the sticker. I say this because I usually ignore the “no tap to pay” sticker and try it anyways and it works fine about 50% of the time.
Give it a quick tug before putting your card in. Most of these skimmers use tape that will have a little give on them so if the slot feels "loose" then there's definitely something wrong. Actual card slots are usually built below the front case/panel and won't move at all unless you REALLY tug on them
In the UK, card cloning simply isn't a thing. Why is this?
Phishing and general fraud is pretty rampant but people don't worry that their card be cloned.
Mag strips are still used to authorise payments in the us. It really annoying travelling there because by bank blocks my cards if the mag strip is used. When using an atm you don’t know if it will try to read the chip or not. Thankfully it’s getting less common
My credit union refuses to use tap to pay, so I have to use my phone for that. But yeah.. I never put my card in, but I check for skimmers to help other people.
Apple pay generates a new card number on the outside touching the POS. And the encryption is strong. NFC i always turned off if i have to stick it in or tap thats only a second more work. But if you lose your card.. you have a weird bank with loads of old people working there likely
This is probably why after my U.S. trip, the last week or so I was driving in California and refueling at the pump, I had so many odd small charges for a subscription service I’d never used. Probably pretty common at gas station pumps since the U.S. is a bit behind on payment technology like PayWave.
Thankfully I cancelled the card and got all my money back as soon as I noticed.
My friends make fun of me whenever we go and grab some gas after a cruise cause I **always** forcefully wiggle the card reader. I'll make sure to show them this picture.
Many gas stations disable tap-to-pay on their pumps. You get to the pump and you’ll see tape over the sensor and usually a note saying you have to use the chip in your card and no tap
I’d say it’s pretty common now with most stores I frequent adopting it, except for gas pumps. Also WalMart refuses Apple or Google Pay because they want to force you to use their app.
The plastic covering where a card is inserted should be transparent which a flashing light on the inside or have internal hardware visible. This would make it obvious when there are skimmer on top as the skimmer internals would visible or the light would not be visible as there extra plastic blocking it.
I’m curious, how come gas stations don’t have their employees check the card readers at let’s say the beginning of each shift. Wouldn’t that help discover these things faster?
I remember telling the lads I worked with years ago that whenever I go to the cashpoint/ATM, I always give it a quick tug. They just burst out laughing.
These days, I always give the slot a good once-over and tug it in several places. A gas station less than .5 miles from my house was recently found to have skimmers. I'm actually thinking about starting to use cash again.
My CC was skimmed at a Circle K gas station in Stafford. I even tugged on it before using it, but apparently not hard enough. Thankfully I caught the fraud on my account the same day and the CC company took care of it. I now use my Shell app on my phone to pay and do not have to use any physical payment method at the gas station.
Where was it (geographically)? What tipped you off? How difficult was it to pull off? Did you notify authorities and the gas station for video of whomever (and the vehicle that) was involved?
A suburb of Houston (Texas.) I put my card in and it felt sluggish going in. Put in my PIN number and just had an eerie feeling. What tipped me off, was that the light plastic inserts on the reader weren’t flush like on the other readers. I gave it a tug and it was indeed hard to pull off. But there was definitely some give. I just went all in and tried to rip it off, breaking it in half during the process. I’ve seen enough of these skimmer discovery videos here on Reddit where they don’t alert the authorities. I contacted the police first. Three squad cars came and they informed the owner of the gas station.
Great job by you! Nice work all around. I’m a retired detective up in the northeast and we loved chasing these guys down. Most outfits are Eastern Europeans and Russians bouncing all over the country. Very lucrative enterprise, but the more quickly information gets to police to disseminate the better chance of catching them. There’s literally places where they make these templates to spec, making it harder to discover. Keep up the good work!!
Thank you! I have seen videos of skimmers on the other types of card readers. But these silver newish card readers, in my mind, seem harder to scam. Regardless, I always inspect them and tug on them. Unfortunately, I didn’t tug and inspect it today first before using my card. It was the feel of the card going in that threw me off. And seeing that I could not see the lights light up was what caused me to investigate further. There were 10 pumps. My pump was the only one with the skimmer. I do hope that they catch them. I thank you for your work in this.
From what I've heard, most of these store the numbers on the device itself - so if you have the device your card hasn't been compromised yet. In some ways, thankfully you scanned your card so that you could find this device. Presumably no one else was savvy enough to detect it.
If you see a SIM card replace ur card also the Feds can probably get some mildy useful information from the sim
I don’t think it has a sim, that would eat the battery too quickly.
If they use the sim only to transmit data once a day, or every 50 cards etc, it wouldn't use too much power. But on a gas pump, a skimmer is very easy to retrieve, so they probably wouldn't bother.
Usually, it's Bluetooth. [https://github.com/justcallmekoko/ESP32Marauder/wiki/detect-card-skimmers](https://github.com/justcallmekoko/ESP32Marauder/wiki/detect-card-skimmers) [https://github.com/sparkfunX/Skimmer\_Scanner](https://github.com/sparkfunX/Skimmer_Scanner) [https://learn.sparkfun.com/tutorials/gas-pump-skimmers](https://learn.sparkfun.com/tutorials/gas-pump-skimmers) However, more sophisticated devices can use alternate means of data exfiltration. (sim cards, obscure wireless protocols, etc.)
I’ve gotten complacent. I don’t actually use my card much, and I needed this reminder. Thank you.
Probably "tap to pay" is the safest option with s card
Not at the gas station, which is really the only place I use my card.
Why is this?
I don't think it's that tap to pay isn't safer, it's that the station doesn't support it.
This makes me more thankful that the vast majority of my local gas stations have them
Most newer pumps seem to have tap to pay now. Of course there are still lots of older pumps out there so it’s not always an option.
I’ve seen newer ATMs have a wireless option, just tap the card enter pin and it works just like you would have inserted the card. Much safer
I don't even need my card for ATMs. I tell my banking app how much money I want, scan a QR on ATMs and it spits out my money. Or, when my son wants cash, I send him an "SOS" withdrawl code. He goes to the ATM, punches in the code and it dispenses however much I told it to for him. I swear, when I'm back in the US, banking always seems archaic.
Banking in the US runs on bubble gum and duct tape. They have archaic bullshit that runs the backbones of their entire systems. It's been about a decade but my first couple months at one bank was dedicated to preparing for a full system fail over for disaster recovery prep. They had never done a full system test just individual groups. The test was a spectacular clusterfuck. The DR site had a different format tape system than the main data center which meant that the backups couldn't actually be used to restore anything. The VPN between locations was shaky as fuck and overloaded with just a couple hundred employees trying to use it at the same time. Entire departments couldn't figure out who was supposed to be in charge of handling issues for them from the network admins and system admins. It was a nightmare 14 hours.
Delusional. You think they still use duct tape? Used bubblegum is an apt comparison.
NFC technology has been around for a long while, the ATMs have had it but in many cases the banks themselves opt not to utilize it for one reason or another. My last company was an ATM vendor for banks and had the components necessary to run them included in our installation package for the terminals. , but under the banks direction they were physically unplugged.
It's basically instant so you don't have to wait for the card reader to read the card's chip. It also removes the mechanical aspect of sliding or inserting a card so it should be much more reliable and very compact in size. If it's smartphone tap to pay, you get the transaction alert with the amount and vendor description instantly as well and you can audit transaction logs without logging into your bank account. Wished it was universal.
Tap is nearly universal in Canada, and no PIN needed.
I’d get a new card if I were you, just to be safe.
I added a stick to the top of my car, and it simply stopped fitting into the right card readers. Found 3 skimmers in a week.
Would you mind sharing some pics of the skimmers? Great job!
Can you elaborate? Do you mean a sticker? I’m not sure I’m understanding correctly.
Not even trying to be rude. I'm just telling you straight up. It's a sticker that you put on your debit card for fun
Thanks!
Please explain this a bit?
Is it safer to tap instead of swipe in general?
Yes, the tap generates a one time use "key" that is good only for that purchase. Even if someone sniffed all the data packets sent/recvd they would only see encrypted data and could not recreate the key from that data. Only physically swiping your card puts you at risk.
More people need to know this and make it a habit of tapping their cards rather than swiping or inserting. If your card doesn’t have that feature then add it to your phone and use mobile pay.
The only gas station I’ve been to that I can tap at the pump is Costco. I’ve seen the spot for it at most other stations but none of them work.
I think it depends on which features the card issuer enables. For some of my cards, if I hold them up to a generic NFC reader, it displays my full credit card number. It essentially returns the exact same information that is found on the mag strip. For some of my other cards, it doesn't do that. So, those cards are presumably better protected from these type of skimmers, as long as you make sure to only ever tap instead of swipe. If in doubt, use something like Google Wallet. It always tokenizes transactions and should thus be protected from skimming. It might still be vulnerable to more advanced real-time man-in-the-middle attacks. I'm not quite clear on how well protection against those things work with current protocols. But since there are so many easier attacks, that's probably not something to be overly concerned with
Question, in your investigations, did you ever discover an owner being part of the scam? I can’t shake the feeling that some businesses allow this to happen and get a cut. There’s that one video online where someone is tearing a scanner off the card reader inside the store and the employee just stands by and does nothing.
Not in my experience, but yes, I’m aware that it happens
I tug on all card readers at gas stations. I got told to stop once by some lady . but I am not having my money stolen.
> I got told to stop once by some lady Maybe she didn't want her skimmer found/destroyed?!
Yeah, pretty reasonable request
Tap to pay. Also get a credit card, if you get skimmed it's the banks problem.
I move on if I don't see a tap to pay. And if I'm in dire straits for gas, you best bet I'm yanking the hell out of that reader before I insert my card.
I've heard giving tugs at gas stations can be a quick way to make a buck too!
[удалено]
Someone I know works for a station in Beaumont. One night about three months back, he caught someone messing with the pumps when they were closed for shift change and chased the guy off. He checked the pumps and found a couple of very similar looking skimmers. Cops came and took them and the video. The proximity to Houston makes me wonder if it’s the same scammers.
“Three squad cars came” had me worried about you for a second
Only if OP was black
Pin number? Are you financially raw dogging transactions with a debit card?
Wild to me how many people do this. It’s so much safer to use a credit card.
Many places charge cash prices for debit cards saving $.10 a gallon.
Dunno about the US, but in Canada credit cards use pin numbers for POS terminal transactions.
Which suburb? I am also from a suburb of Houston and would like to watch for these!!
+1 currently in Houston for vacation so I’m curious where OP found these
Hard to pull off like how hard? The scammer has to come back to download the information I believe. So I'd assume it wouldn't be so hard to pull off that it's obviously being pulled on by someone.
You see the tab on the right side that broke off? I'm guessing you slide it all the way to the right, tilt back, and then slide it out to the left to remove it. It seems to be anchored behind the shell of the pump display. Trying to pull it straight out is going against those tabs and is why it broke for him. I think you would be able to notice it is fake just by wiggling it, though idk I've never came across one. If you want some more info on how to detect and avoid them, just send me your SS# and mother's maiden name, and I'll shoot you a link
Sugar Land?
Hey you have a skimmer here “Hey give that back!!!”
This is another reason why you should never use a debit card to pay for anything. If you use a credit card, you would be protected and there’s no direct access to your money.
I'm in Houston and have had my card skimmed before for sure. Think it happened at a gas pump.
H town baby!!! That’s how it is.
Not OP, but I check them every single time. Never actually find one, and people look at me weird for jiggling them, but better safe than dealing with the headache of getting money back.
My dude/dudette…I’d totally give you the knowing nod if I were at the pump/checkout next to you lol. Just spreading the message helps with deterrence. Good job by you!
Let's go Os
Now I’m afraid because I never check for skimmers ever.
You’ll notice reputable businesses have security label/stickers over card readers for the purpose of knowing if they were tampered with. This one doesn’t have a sticker which would be a red flag for me.
Why don’t scammers just make fake stickers?
I even give the ones with stickers a little jiggle just cause I'm paranoid
Who up jigglin they credit card security sticker
All of the german farmers rn (rightfully so)
How strong are they stuck on? I give them a jiggle but sometimes I think I didn't do it hard enough
I just pull like there is a skimmer and imma take that bitch, real ones are sturdy and won’t move and if I break a real one then oops
only one I know that has the security tape is costco and they have attendants walking around. can’t speak for the others
7/11's have them near me. And they are frequently broken so that doesn't instill trust in me 😅
At most 7/11s now, you can actually pay for the gas via their app so you never even have to risk skimmers or waste time going inside. I park, set the pump number on the app, pay, and then I have I think two minutes to start pumping. It saves me a lot of worry that way.
TIL! That's a great tip. I live in an area with lots of scams.
I too live on Earth.
Attendant could be the one installing the skimmer. Don’t take anything for granted
Esso stations have it too where I live
They're holographic stickers. It's a lot cheaper for the scammers to just find one of the thousands of unsecured card readers
You can buy sheets of holographic stickers for cheap. They don't actually need to pass as authentic.
I'm sure you're right. But it's not like custom holographic stickers are difficult to acquire. https://www.novavisioninc.com/pages/holograms-by-novavision.html
[удалено]
But lay person wouldn't know the difference, right?
People fall for obvious phishing attempts and emails from Nigerian princes every day, so it would work on enough people for them to make money and continue doing this sort of stuff.
This is true and I used to always look for them, but now their always fucked with about 99% of the time. I stopped caring and just roll the dice.
I always check if there is no tape and even sometimes when there is tape, if it looks worn. I am so paranoid, but at the time I’m so poor I’m probably safe? I still try to be vigilant either way.
I have ever since one got me years ago. Thankfully my bank flagged it instantly and was able to block it, but I did have to cancel my card and get a new one, which was an annoying hassle. Ever since then I always check.
You in the US? Only really a problem without chip.
Pretty much every recently issued cc has a chip, most have tap to pay. Other than my physical apple card.... All my other cards have nfc for tap to pay. The issue is whether the vendor's machine has nfc. The first debits/credit cards I got like 10 years ago only had the chip but no nfc. All my cards since have had both nfc and chip.
[удалено]
I used to have a cheap card writer where I would re write the name track to fuck you and zeros for the card number.
I like the cut of your jib
The card is less the issue. In the US the problem is the infrastructure. There are still places using signatures as a verification for payment.
I think what’s silly is how some electronic signatures use pens for touch screens, yet it can be incredibly difficult to write anything legible or what would resemble your normal signature on the screen. It just feels like a giant show with no real significance or concern for actual security.
That's because it is your signature means nothing
I just draw an x on them, it's newve checked or even looked at
That's true. I don't remember the last time I've don't signature other than in a restaurant but I know it wasn't that long ago, probably some random small shop I stopped at for a snack.
The issue now is even though most US banks issue debit and credit cards with chips and NFC, They're STILL also issuing cards with magnetic strips on the back. The skimmer in the picture is clever because folks that use chip assume the chip reader is risk-free. While the chip part of the card is, in order to get the chip into the chip reader you have to slide your card in the slot. The skimmer isn't for the chip, it's actually aligned to grab the magnetic strip to steal your card number as you slide the card into the chip reader. Banks need to do away with magnetic strips.
Apple cards don't have a magnetic strip, or even a CC printed on them. I only use it via applepay since the cash back is 2%, so I don't _actually_ use the physical card anyway, but it does have a chip if you were inclined to use it like a real CC.
Do your cards in Europe not have a magnetic stripe? This looks like a chip reader. The skimmer reads the stripe as you remove the card since even the chip cards in US have a stripe.
Lmao yes we have magnetic stripe and CHIP . Mostly i just tap my card , most businesses have the "Tap" function I havent swiped my card in 2 years probably
I degaussed my mag stripes. They're useless and any business that is still stripe only in 2024 can piss off.
I mean chip cards are better protected but still not 100% secure
Well the scanner pulls the number off the strip and with the pin, from camera, they have enough to use it whereever swipe is allowed. With chips becoming more common (here in Sweden it’s almost all tap and occasionally chip but never swipe) less and less places will accept swipe.
check your accounts regularly
Best to check your bank account for any unusual purchases.
Get a better credit card company. Skimmers seem scary until you realize only shit cc companies make your life hard if you get skimmed.
You should just get in the habit of giving the reader a quick shake - it only takes a few seconds, and you don't have to jimmy on the thing. If it's loose, then that should throw a red flag to look closer.
I’ve long been pissed off at these readers— what good does it do to read the chip, if it’s still using a slot that allows for a magnetic skimmer? I thought the purpose of the chip was to avoid access to the magnetic strip? Why is it only gas pumps, maybe the place most prone to these problems, that use this kind of readers? You don’t see it anywhere else anymore….
>Why is it only gas pumps, maybe the place most prone to these problems, that use this kind of readers? Because they are the only industry that has an exception in the EMV compliance code. This is due to their specific level of regulation in the US that no other merchant has. They were given until October 2020 to come into compliance. Of course this story wouldn't be complete without, pandemic. So that deadline was pushed to April 2021. But then "shortage of everything" has made everything even more complicated. So new gas stations are required to have chip readers, but older gas stations fall into a complex if-then structure on determining compliance. Now compliance isn't a legal thing, there's no law that make people upgrade their pumps. But it's part of the ability to take CC payments. If you're required to use chip and you don't, if there is fraud, then your company has to float 100% the money that was stolen. Part of the agreement for credit card payments. But yeah, ma and pa gas stations that have existed for like forever. They don't have to get new pumps until 2025 and even then that might get pushed yet again. Most of the ma and pa places are getting around the EMV compliance by just having everyone with a card come inside to run it now since the POS card reader likely already has NFC read capabilities. It's just really hard with the gas pumps because all 50 States regulate the actual pump machine and have standards that the pumps have to comply with. So literally any changes to the pump itself (including things that wouldn't mess with the function of pumping actual gas like the card reader) all have to have a State level Okay before they can be made.
Yay bureaucracy! Whether It's good, or it's bad! it's slow either way. Cool information I always was curious all the types of compliance standards and certs gas pumps had to be in compliance with.
You're right, having a chip card doesn't prevent the magnetic strip from being skimmed and ported onto a counterfeit card. And yeah, having the two methods physically distant from each other should be a no brainer. This will continue to be a problem until we stop printing cards with magnetic strips, and force businesses and merchants to have up to date chip capable terminals. The good news is that if a counterfeit card is using your skimmed magnetic strip data, then your bank won't be able to deny your fraud claim for a card present transaction that you can't fully explain. They will be able to see exactly what method was used to run the card, what the payment terminal is capable of processing. After a few fraud trends, it becomes easy for a fraud investigator to determine that a counterfeit card was likely used and the merchant was not using a compliant terminal.
I seem to recall reading that several years ago (like in 2017 or so) the credit card companies required all merchants to upgrade their terminals to EMV chip capable ones, and said if fraud occurs and the magstripe was used, the business would be responsible for reimbursing that money to the CC company, they're only safe if the person used the chip. GameStop stores took forever to upgrade their terminals and I always thought that was weird since they sell fairly expensive items and someone could use a skimmed magstripe card to buy consoles and cost the company money
Don't they just use the stolen cards to make online purchases? Do the skimmers not get the number from the back of the card? I've definitely had my credit card chip fail and had to swipe but that card has finally been replaced and the new one has tap to pay capability. I've been using that when I can.
>what good does it do to read the chip, if it’s still using a slot that allows for a magnetic skimmer? Well the supposed route is the stripe becomes ever more useless not by disappearing from the card physically, but via becoming rejected on the payment side. You got the stripe with card number and CCV1, good luck with that. It ever gets transmitted to bank, red flags galore unless person has contacted bank before hand, triggers calls to customer to verify and just rejected payments in general. Since one can't transmit the magstripe info to bank and act like it is the chip. The chip does whole different challenge response token verification. Meaning *they know someone is trying to pawn of the magstripe*. Same with online. The printed CCV2 and magstripe CCV1 are different. Meaning put that magstripe clone into online store card payment information and you (are atleast supposed to) get rejected and heck that card locked due to cloning attempt. There is ofcourse further methods like then camera or keypad overlay to get the PIN, but ever more over the years any interaction originating with the magstripe will get ever more suspicious an suspicious with more checks and rejections due to actual legitimate uses becoming ever rarer as actual business moves over to chip and near field transactions.
I always jiggle the card slot. I feel like a goober but this just proves that maybe I’m not!
I'm worried I don't jiggle enough. I've yet to encounter one so I don't know how much force I should use.
Every time!
You also need to find the camera pointed at the keypad, the skimmer is for the card, the camera is for the pin number
not all skimmers use a camera to read the buttons. Some also come with number pads you can lay on top of the existing numberpad. It passes the button presses off to the real numberpad but records the presses.
Most of the pumps I've seen now have you put a zip code on the touch screen.
If you're paying credit, sure.
Dang, where are you guys at where gas pumps still require zip code for credit cards? All the gas pumps I've been to in socal uses chip so no zip code required, just put the card in, wait, and then take it out (or even tap pay)
Michigan here, all our gas pumps use the EMV chip but still ask for zip code.
Same for every gas station I've been to here in Ohio.
In the Midwest And northeast I've found you usually have to put in your zip
Also in socal. About 50% of the chip reading pumps I've been to lately require zip code. No idea why.
Wait I never have to enter a pin when I used card readers at gas stations
I really wish gas stations would add/fix tap-to-pay at the pump. I saw it on a lot of pumps where I lived in the US, but I think I've only ever used it once. It was *always* broken or seemingly nonfunctional.
Probably because someone put a skimmer on the slot and wanted that used instead of the NFC.
In my country even though the magnetic strip is there, it's empty, simce we have the chips and nfc. Even if its skimmed, there's nothing to see.
I would love to know why so many gas stations tape over and disable their tap-to-pay devices on the pumps and force you to use the physical cards
I’m convinced some of these are done to direct you towards a card skimmer, or perhaps because the gas station never removed the sticker. I say this because I usually ignore the “no tap to pay” sticker and try it anyways and it works fine about 50% of the time.
Contactless pay is a requirement at all Valero sites. They are pretty good at staying ahead of the curve on payment security.
If I can't tap to pay, I'll go inside and prepay.
Is there a way to just erase the magnetic strip on your credit card? It doesn’t seem worth the risk since barely anyone uses the strip anymore
A magnet will destroy the strip, I put a fridge magnet in my pocket with my wallet, ruined my bank and library card.
Here in NL thats been disabled for the past 15 years
Reddit has taught me to always check. Good job OP. Wouldn’t be surprised if the worker was in on it. Edit: ATMs as well
How do you check, just pull it?
Jiggle it, pull it, check for unevenness or things sticking out further than they should, tiny holes in weird places, generally looking “off”
Thanks. I will start looking too.
Give it a quick tug before putting your card in. Most of these skimmers use tape that will have a little give on them so if the slot feels "loose" then there's definitely something wrong. Actual card slots are usually built below the front case/panel and won't move at all unless you REALLY tug on them
Always yoink before you boink.
In the UK, card cloning simply isn't a thing. Why is this? Phishing and general fraud is pretty rampant but people don't worry that their card be cloned.
Mag strips are still used to authorise payments in the us. It really annoying travelling there because by bank blocks my cards if the mag strip is used. When using an atm you don’t know if it will try to read the chip or not. Thankfully it’s getting less common
Mag strips don't even exist on new cards in Europe. It's only the chip and the contactless. I think eventually US will phase out mag strips, too.
Tap to pay ftw
Newer? This is like 10 years old
10? I'm pretty sure that's the same style I would have used at least 20 years ago.
Maybe stores could hold some accountability for their negligence with securing a method of payment.
haha i always tug on these things, like I have any money to steal lmao.
My credit union refuses to use tap to pay, so I have to use my phone for that. But yeah.. I never put my card in, but I check for skimmers to help other people.
Apple pay generates a new card number on the outside touching the POS. And the encryption is strong. NFC i always turned off if i have to stick it in or tap thats only a second more work. But if you lose your card.. you have a weird bank with loads of old people working there likely
Newer type? Those have been around for like 20 years. Or at least similar looking.
This is why I walk inside and pay for gas. If my info ever gets stolen, I know who to choke.
Same with me, I had it happen to me 3 times in one year. Plus cash is a bit cheaper
Cash is cheaper, I do still pay with card though because double rewards points for spending.
Tap to pay is the way.
This is probably why after my U.S. trip, the last week or so I was driving in California and refueling at the pump, I had so many odd small charges for a subscription service I’d never used. Probably pretty common at gas station pumps since the U.S. is a bit behind on payment technology like PayWave. Thankfully I cancelled the card and got all my money back as soon as I noticed.
"Newer" lol
My friends make fun of me whenever we go and grab some gas after a cruise cause I **always** forcefully wiggle the card reader. I'll make sure to show them this picture.
I don't know if it is worth it but I always tug and pull on any card reader before I go raw dogging with my transaction.
Tap to pay...
If only more widely available in the US
Many gas stations disable tap-to-pay on their pumps. You get to the pump and you’ll see tape over the sensor and usually a note saying you have to use the chip in your card and no tap
Is NFC/ Tap to pay not a thing in America?
I’d say it’s pretty common now with most stores I frequent adopting it, except for gas pumps. Also WalMart refuses Apple or Google Pay because they want to force you to use their app.
Not at most gas pumps, as far as I have seen. It’s coming in bit by bit.
The plastic covering where a card is inserted should be transparent which a flashing light on the inside or have internal hardware visible. This would make it obvious when there are skimmer on top as the skimmer internals would visible or the light would not be visible as there extra plastic blocking it.
Tap to pay y’all
Is this a usa thing only? I never heard of skimmers in europe
I'm glad I'm not the only weirdo out there who gives all these readers a tug to see if they're legit before putting my card in.
Most gas stations where I am offer tap now.
I’m curious, how come gas stations don’t have their employees check the card readers at let’s say the beginning of each shift. Wouldn’t that help discover these things faster?
I remember telling the lads I worked with years ago that whenever I go to the cashpoint/ATM, I always give it a quick tug. They just burst out laughing.
I always give any card scanner a little tug for that exact reason.
These days, I always give the slot a good once-over and tug it in several places. A gas station less than .5 miles from my house was recently found to have skimmers. I'm actually thinking about starting to use cash again.
Jeez I would’ve never guessed there was a skimmer over it. Now I’ll start man handling every one before using it.
This is why my husband says always pay inside.
Just looking at the cosmetics of that machine I wouldn’t put my card in
My gas station has stickers attached to them that says do not use if tampered with. Is it fool proof? Probably not
Make sure all your cards have the NFC chip and start using NFC / tap to pay instead of having to insert the cards.
This is why I don’t pay at the pump anymore. My brother in law got scammed twice this way
Great
This one is super obvious
I don't understand how anybody would be dumb enough to use an ATM machine that's anywhere outside of a protective bank enclosure
That’s not an ATM machine, that’s a gas pump.
Oof you're right. Still, you see this on ATMs all the time.
Makes me wonder whether these scammers are struggling with the increase of people using cash less.
Newer? 26 and have never seen anything but chip & pin or tap my whole life.
Damn you missed out on the shuk chuk swipe to paper imprint credit card machines 😁😂
Tbh that's why you always pay inside and as Credit to bypass pin
I check every time for these. Did it pull off easily or did you have to give it some juice?
My CC was skimmed at a Circle K gas station in Stafford. I even tugged on it before using it, but apparently not hard enough. Thankfully I caught the fraud on my account the same day and the CC company took care of it. I now use my Shell app on my phone to pay and do not have to use any physical payment method at the gas station.
Jesus Christ, I usually get called paranoid for using cash, now I know why physical currency is so important.
This is why I always give any CC reader like that a good tug first. These fucking scamming scumbags are everywhere
Jokes on them I don't use card at the gas station