A shopper in Norwalk, Connecticut walked up to a Dollar Tree register and went to pay with a tap of her credit card. The cashier told her the tap feature wasn’t working and she’d have to insert the card instead. She did. Less than a day later, her bank called to ask whether she was the one trying to run up charges on her account.
Police pulled the register apart and found a skimmer, a fake reader slipped over the real one, quietly copying card data from everyone who inserted a card into that slot. The tap failure wasn’t a glitch. Killing tap-to-pay is part of the setup, because it forces you toward the one payment method the thieves can actually steal.
That is the warning police departments across the country keep repeating. A skimmer is a small device criminals attach to a legitimate card reader. Your real payment still goes through. Nothing beeps, nothing errors out, the receipt prints fine. And a copy of your card number is already on its way to someone else.
When The Machine Suddenly Can’t Take A Tap
The Norwalk case is worth remembering because it flips the usual advice on its head. Most of us assume a hiccup at the register is just old, cranky equipment. Sometimes it is. But a reader that refuses your tap and insists you insert the card is exactly the situation a thief wants, and it should make you pause.
Skimmers grab the data off your card’s magnetic stripe when you swipe or insert. Tap-to-pay doesn’t use that stripe at all. So a well-placed overlay that blocks the contactless sensor does two jobs at once. It hides the tampering, and it herds every customer into the compromised slot.
Many of these overlays also hide something extra. A tiny camera aimed at the keypad, or a fake keypad laid right on top of the real buttons, records your PIN as you punch it in. That combination is what lets a crook drain a bank account or clone a card, not just make a few online purchases. It is why South Burlington police in Vermont tell people to shake the reader before they use it. If it wiggles, walk away.
It’s Not Just Gas Pumps Anymore
Gas pumps got all the attention for years because they sit outside, unattended, and thieves can pop them open in the dark. That is still true. But the readers inside your grocery store have become a favorite target, and shoppers are the ones catching them.
A Houston woman named Savannah Dansby went to pay for groceries at a Pyburns store on Fondren Road ahead of Memorial Day weekend. When she went to swipe her EBT card, something “snugged” it. She pulled on the device and the whole thing came off in her hand. That same week, federal investigators found more than a dozen skimmers across the Houston area during a single sweep.
The list of stores where these have turned up reads like a road trip. Two men were caught on camera installing a skimmer at a BB’s Grocery Outlet in Pennsylvania. Devices showed up at Weis Markets locations in Virginia, Maryland, and Pennsylvania. One was found at a Save-A-Lot in New Jersey, another at a Piggly Wiggly in South Carolina, and one on an ATM inside a Hannaford in Massachusetts that also had a camera pointed at the keypad. Anywhere there’s a card reader, there can be a skimmer on it.
Self-checkout is an easier mark than a staffed register. A thief needs a few seconds of privacy to snap the overlay on, and a busy self-checkout lane, where nobody is watching the machine, gives them exactly that. One person distracts a cashier while an accomplice works. It really can happen that fast.
The Numbers Behind The Warnings
This isn’t a scattered handful of cases. Over three days in June 2026, fourteen teams inspected nearly 4,000 payment terminals at 1,010 businesses across Brooklyn, the Bronx, Queens, and Manhattan. They pulled off 35 skimmers and estimated they stopped $36.5 million in fraud. The agent in charge called New York a target-rich environment because of its density of bodegas and small shops.
Zoom out and the scale gets harder to ignore. Across all of 2025, law enforcement removed more than 400 skimming devices and estimated they prevented over $428 million in losses. Officials believe a single skimmer left in place can rake in up to $1 million before anyone notices.
And it’s climbing. Skimming attacks jumped about 90% in 2025, rising from roughly 231,000 the year before to more than 243,000. The FBI puts the yearly cost to banks and shoppers north of a billion dollars.
Store owners are usually as blindsided as their customers. During one Boston operation, a bakery owner literally started crying when agents showed him a skimmer running in his shop. In case after case, mom-and-pop owners had no idea. One federal agent said in about 99.9% of these cases the business is shocked, because the crews doing this are good at it.
How To Spot One Before You Pay
Give the reader a five-second once-over. Look for anything that doesn’t match the rest of the machine. Bulging, raised, crooked, or off-color pieces are a red flag, and so is a card slot that looks chunkier than the body around it.
Touch it. Wiggle the card slot and press the keypad. A keypad that feels thick, spongy, or slightly raised can be a fake laid over the real one. If a part is loose or moves when you tug it, don’t put your card in. The Delaware State Police tell people to actually pull on the slot to check that it isn’t a shell.
Compare it to the machine next to it. Crooks rarely rig every terminal in a row, so a reader that looks different from its neighbors is telling you something. At the gas pump, check the security seal near the card slot. If it reads “void” or looks peeled and stuck back on, the pump has been opened. And pick a pump close to the building. Thieves want the one farthest from the attendant, where nobody is looking.
Tap, Don’t Swipe
The single best move you can make is to stop inserting and swiping whenever you can, and tap instead. Contactless cards and phone wallets like Apple Pay and Google Pay send a one-time token, not your actual card number, so there is nothing for a skimmer on the stripe to copy.
A product exec at the security firm Malwarebytes put it plainly, saying a digital wallet isn’t something a crook can easily hack the way they hack a physical reader. That is the whole reason the Norwalk skimmer was rigged to block tap in the first place. When you can’t tap, cover the keypad with your other hand while you enter your PIN. Even if your card data gets copied, a PIN nobody could see is a lot less useful to them.
At the ATM, stick to machines inside a bank lobby or a well-lit, busy indoor spot. Standalone machines tucked in dim corners are the ones criminals love, because they can install and collect gear without an audience.
What To Do If Your Card Gets Hit
Check your statements more often than you think you need to. Skimming is quiet by design, so the first sign is usually a charge you don’t recognize, not a broken machine. Report anything strange to your bank the moment you see it, then tell the store and file a complaint with the FBI’s Internet Crime Complaint Center at ic3.gov.
Paying with a credit card gives you more cover than debit. Under federal law, your maximum liability for unauthorized credit charges is capped at $50, and it’s zero if you report before the card is used. Debit is riskier. You’re on the hook for up to $500 if you wait past two business days, and possibly everything after 60 days. When a crook uses a stolen credit card, they’re spending the bank’s money. When they use your debit card, they’re pulling straight from your checking account.
Vermont’s attorney general points to the chargeback as the reason credit wins. If you’re scammed, you can dispute the charge and get your money back. That protection is built into the card. The best habit is still the boring one. Look before you pay, tap when you can, and treat a reader that suddenly can’t take a tap as a reason to keep your card in your pocket.
