Fraud Intel · Signal report · Data through early 2026
A card skimmer costs a criminal a few hundred dollars and a few seconds to install. It can sit unnoticed inside an ATM, a gas pump or a store terminal for days, quietly copying every card that passes through it. And after a brief dip in 2024, the data shows skimming climbing again. In 2025 the number of separate skimming attacks nearly doubled.
U.S. debit cards compromised by skimming in 2025, up 5% on 2024, according to FICO.
FICO issued 3,200+ compromised-card reports in 2025, a 90% jump in compromise events.
From roughly 34,000 compromised cards in 2021 to more than 243,000 in 2025.
The FBI's estimate of what skimming costs U.S. consumers and banks annually.
The numbers: five years of skimming
FICO's Card Alert Service tracks debit cards caught up in skimming attacks and alerts the banks that issued them. Its year-by-year counts show how fast the problem has grown:
| Year | Compromised debit cards | Change | Trend |
|---|---|---|---|
| 2021 | ~34,000 | Baseline | |
| 2022 | 161,000+ | +368% | |
| 2023 | 315,000+ | +96% | |
| 2024 | 231,000+ | −27% | |
| 2025 | 243,000+ | +5% |
The 2024 dip looked like good news, but it hid a warning sign. In the second half of that year, compromised cards rose 30% and the number of compromise events rose 46% compared with the first half. That momentum carried into 2025. FICO issued more than 3,200 compromised-card reports, a 90% year-over-year increase in compromise events, across more than 3,500 financial institutions.
The first two months of 2026 showed fewer compromise events and cards than the same period of 2025. Analysts have not called it a turning point. Skimming has gone quiet before, only to come back stronger.
Anatomy of a modern skimmer
The clunky fake card readers of a decade ago are giving way to devices that are smaller, hidden deeper and harder to spot:
| Device | Where it hides | What it steals |
|---|---|---|
| Overlay skimmerCLASSIC | A fake bezel or keypad fitted over the real one on an ATM, pump or terminal. | Magnetic-stripe data and, with a fake keypad, your PIN. |
| Deep-insert skimmerINSIDE THE SLOT | A wafer-thin reader pushed deep inside the card slot, invisible from outside. | Magnetic-stripe data from every inserted card. |
| ShimmerCHIP READER | A paper-thin circuit that sits between the card's chip and the terminal's contacts. | Static chip data that can be used to build a magnetic-stripe clone. |
| Internal pump skimmerGAS STATIONS | Wired inside a fuel dispenser, often opened with widely available master keys. | Card data, and PINs when debit cards are used at the pump. |
| Pinhole cameraPIN CAPTURE | A tiny camera aimed at the keypad, hidden in a light bar or brochure holder. | Video of your PIN as you type it. |
Many of these devices now transmit stolen data over Bluetooth, so criminals can collect it from a nearby car without going back to the machine.
Why skimming keeps coming back
Skimming survives for one reason: most cards still carry data that works for anyone who copies it.XINTCARD FRAUD INTEL
1. The magnetic stripe never left
Chip cards made in-store fraud much harder, but almost every card still has a magnetic stripe for backward compatibility. A stripe holds the same static data every time it is swiped. Copy it once and you can write it onto a blank card. Shimmers exploit the same weakness: they harvest static data that criminals then use where stripe transactions are still accepted.
2. Attackers go where inspections are rare
FICO found that around 90% of 2025 compromise locations involved non-bank ATMs: the standalone machines in convenience stores, bars and gas stations. Bank ATMs are inspected often. A freestanding kiosk may go days or weeks without anyone checking it.
3. Debit cards lead straight to your money
Skimmers target debit cards because a debit card and its PIN unlock cash. ATM withdrawals with a cloned card take money directly out of a checking account. Rent, bills and groceries come out of that same account.
4. The map is shifting
In 2025, 70% of compromises were concentrated in ten states: New York, California, Massachusetts, Maryland, Virginia, Pennsylvania, New Jersey, Colorado, Texas and Illinois. New York overtook California for the first time. Skimming crews move to where defenses are weakest.
The hardest-hit: families on food assistance
No group shows the cost of stripe-based cards more clearly than people who receive SNAP food benefits. EBT cards never received the chips that bank cards got in the 2010s. Most still rely on magnetic-stripe technology that a skimmer can read in a single swipe.
- Criminals stole $470 million in SNAP benefits electronically in 2025, from more than 990,000 households, according to data from Propel reported by ProPublica.
- Federal authority to replace benefits stolen by skimming expired on December 20, 2024. Families who are skimmed after that date generally cannot get their benefits back.
- Chips work. California has nearly finished moving EBT cards to chips, and the governor's office says theft of food and cash benefits has fallen by as much as 83% in two years.
What actually stops skimming
Better skimmer detection helps, and so do more inspections. The U.S. Secret Service checked more than 123,000 terminals, pumps and ATMs over two years and found 637 skimming devices. But inspections only find skimmers after they have been installed. The lasting fix is to make the stolen data worthless.
| Defense | Why it works |
|---|---|
| Tap to pay | Contactless payments generate a one-time code and never touch a skimmer hidden in the card slot. |
| Chip-only cards | Without a magnetic stripe, there is no static stripe data to copy and no stripe to fall back to. |
| One-time cryptograms | Each payment is signed with a code that cannot be reused, so captured data is already expired. |
| Real-time verification | Checking every payment as it happens stops a cloned card before money leaves the account. |
This is the principle XintCard is built on. Our card is designed with no magnetic stripe, no static card number, and credentials sealed inside a secure chip that never hands them over. Every payment is designed to be verified in real time. A skimmer can sit in the slot all day, and there is nothing for it to read. Run the skimming attack yourself in our simulator and watch the difference.
Field guide: protect yourself today
- Tap instead of swipe or insert wherever you can, with your card or a phone wallet.
- Choose bank ATMs inside or attached to a branch over standalone machines.
- Inspect before you insert. Look for loose, crooked or mismatched parts, broken security seals on pumps, and tug gently on the card reader and keypad.
- Cover the keypad with your other hand when you type your PIN.
- At the pump, pay as credit or pay inside, so you never enter your debit PIN outdoors.
- Turn on alerts for every transaction, and check your account often.
- If a machine looks wrong, walk away and tell the business or your bank.
If you think you have been skimmed
- Call your bank or card issuer immediately, using the number on the back of your card, to lock it and dispute any unauthorized transactions. Acting fast matters: for debit cards, how much of a loss you can recover can depend on how quickly you report it.
- Change your PIN and ask for a new card number.
- Report the fraud to the Federal Trade Commission at reportfraud.ftc.gov, and tell the business where you used the card.
- For EBT cards, contact your state's EBT customer service right away to freeze the card and request a replacement.
The bottom line
Skimming has grown about sevenfold in four years because the cards in our wallets still carry data worth stealing. Inspections, alerts and public warnings help, but they treat the symptom. Remove the static data, verify every payment in real time, and the skimmer becomes a piece of plastic and wire with nothing to read. That is the future we are building. Join the XintCard early-access list to be first to carry it.
Sources
- FICO, "US Card Skimming Grew Nearly 5x in 2022", February 2023.
- FICO, "Debit Card Compromises Nearly Doubled in 2023", March 2024.
- FICO, "Debit Card Compromise in 2024: Events Up, Number of Compromised Cards Down", April 2025.
- TechTimes, "Card Skimmers Can't Hide in Verifone Terminals", July 2026, citing FICO Card Alert Service 2025 data and the FBI.
- AARP, "How to Avoid Card Skimmers at ATMs and on Payment Devices", May 2026.
- ProPublica, "Scammers Are Stealing Millions From Food Stamp Recipients. Congress Could Fix It — but Won't.", October 2026.
