How Credit Card Skimmers at Gas Pumps Are Stealing Your Money and Points

You pull into your regular gas station, swipe your card, pump your gas, and drive away. Nothing unusual. But a few days later your credit card statement shows a $400 charge at an electronics store you’ve never visited. Or your reward points balance drops by 10,000 miles. What happened? Odds are you encountered a skimmer — a small device criminals install inside or on top of a gas pump to steal your card’s magnetic stripe data and your PIN. This isn’t a rare, exotic crime. It happens every day at stations across the country, and it’s one of the most straightforward offline ripoffs targeting middle-class Americans. Here’s what you need to know and how to protect yourself.

Skimmers are physical gadgets that read the data from your card’s magnetic stripe when you swipe. Thieves can buy them online for a few hundred dollars or build them themselves. They hide them inside the pump’s card reader — often behind the factory faceplate — or attach a fake overlay that looks identical to the real slot. A tiny pinhole camera or a false keypad overlay captures your PIN. Once crooks collect a few dozen cards’ worth of data, they return, remove the device, and transfer the stolen information to blank cards or sell it on the dark web. Within hours, cloned cards are used at ATMs, retail stores, and online accounts.

Why should you care beyond the immediate financial loss? Because credit card point theft often follows. Many rewards programs — airline miles, hotel points, cash-back balances — are tied to your card account. If a thief has your card number and security code, they can log into your rewards portal using common credentials or simple password guessing. They redeem your hard-earned points for gift cards, merchandise, or even travel. Unlike fraudulent credit card charges, which federal law limits your liability to $50, reward points are often not protected the same way. Banks and airlines may refuse to restore them, arguing the points were “your property” and you failed to secure the account. After a skimming incident, you might get your money back but lose 50,000 miles you spent years accumulating.

Middle-class Americans between 45 and 64 are prime targets. You’re likely to own multiple cards, carry a rewards card, and use gas pumps regularly. You also tend to be less comfortable with contactless payments or mobile apps, so you swipe the old-fashioned way. Skimmers work best on magnetic stripes, which are still used by millions of gas pumps. Even newer pumps that accept chip cards may have fallback readers that process swiped data. Thieves know this. They target stations in busy suburban areas where customers are in a hurry and won’t inspect the pump.

How do you spot a skimmer? Look before you insert your card. The pump’s card reader should be flush with the surrounding panel. If it sticks out, feels loose, or wobbles, do not use it. Check the keypad — if it’s thicker than normal or the numbers feel squishy, it might be a PIN-capturing overlay. Some skimmers have small pinhole cameras mounted near the screen or the overhead light. Cover the keypad with your other hand when entering your PIN, even if nobody is nearby. Use pumps closest to the station building: they are less likely to be tampered with because they are in plain view of attendants. Prepay inside whenever possible — that avoids swiping at the pump altogether. And if you have the option, use a contactless payment method like tapping your phone or a contactless card. The tap transmits a one-time code that cannot be skimmed.

Beyond the pump itself, practice good account hygiene. Check your credit card and rewards statements at least once a week. Set up text or email alerts for every transaction above a low threshold — say $25. If you see a charge you don’t recognize, call your card issuer immediately. Many banks let you lock your card from the app. For reward points, use unique, strong passwords for each loyalty account, and enable two-factor authentication if offered. Consider not storing your points in an account linked directly to your credit card; instead, move them to a separate rewards portal that requires additional verification.

Skimming is not a high-tech hack. It’s old-fashioned theft using cheap hardware and a little patience. The gas station chain is not going to reimburse you for lost points, and the police rarely catch the perpetrators. That means your best defense is your own vigilance. Don’t assume a familiar station is safe. Don’t trust the pump because it looks clean. Slow down, inspect the reader, cover your PIN, and use contactless methods whenever possible. A few extra seconds at the pump can save you hundreds of dollars and thousands of points. That’s not paranoia. It’s just common sense for anyone who wants to keep their money and rewards where they belong — in your pocket, not a thief’s cloned card.