Cloned Cards: What They Are and How Skimming Works

A cloned card is a fake payment card created from stolen card data. Criminals obtain this data through skimming, where devices illegally installed on ATMs, point-of-sale terminals, or fuel pumps capture card details and PIN entries[1]. They then use the cloned cards for unauthorised purchases or to steal from victims' accounts[1]. Skimming costs financial institutions and consumers more than $1 billion each year[1].

What Card Cloning Is and How It Happens

Card cloning is the creation of fake payment cards using stolen card data[1]. Criminals capture this data through skimming—a process in which devices are illegally installed on or inside ATMs, point-of-sale terminals, or fuel pumps to record card information and PIN entries[1]. Once criminals have this skimmed data, they use it to create fake payment cards and then make unauthorised purchases or steal from victims' accounts[1].

Skimming works because magnetic stripe cards store data in a format that can be read and copied. When you insert or swipe your card at a compromised terminal, the skimming device captures the magnetic stripe data. If the terminal includes a PIN pad, a hidden camera or overlay keypad records your PIN entry[1]. The criminal retrieves this captured data—either by returning to collect the device or through wireless transmission—and encodes it onto a blank card with a magnetic stripe. The result is a cloned card that works at any terminal accepting magnetic stripe transactions.

This is not a theoretical risk. Skimming costs financial institutions and consumers more than $1 billion each year, according to the FBI[1]. In December 2024, a two-day U.S. Secret Service operation in San Diego County inspected more than 800 point-of-sale terminals, gas pumps, and ATMs and recovered 21 skimming devices[2]. That operation alone prevented an estimated $63 million in potential losses[2]. The consistent recovery of skimming hardware from everyday retail locations, fuel stations, and ATMs confirms that card cloning is an active, large-scale threat.

The cloning process depends on access to magnetic stripe data. EMV chip technology was designed to prevent full card duplication, but skimming devices still capture stripe data from the same transaction[1]. Criminals then use that stripe data to create fake cards that work where magnetic stripe fallback is accepted or where chip verification is not enforced. This means chip-enabled cards reduce cloning risk but do not eliminate it entirely.

For a detailed explanation of how skimming hardware captures card data and what cloned cards look like, see Clone Card: How Skimming Works and How to Protect Your Card.

The Scale of Card Skimming: Recent Law Enforcement Operations

Card skimming is not a rare or declining threat. Three U.S. Secret Service operations conducted between April and December 2024 inspected over 5,450 point-of-sale terminals, gas pumps, and ATMs and recovered at least 39 skimming devices[2][3][4]. These operations prevented an estimated $69.7 million in potential losses[2][3][4]. The consistent recovery of active skimming hardware from everyday retail locations, fuel stations, and ATMs confirms that criminals continue to install devices at scale.

The December 2024 San Diego County operation provides the clearest picture of current skimming activity. Over two days, law enforcement inspected more than 800 point-of-sale terminals, gas pumps, and ATMs[2]. The operation recovered 21 skimming devices and prevented an estimated $63 million in potential losses[2]. This was a targeted sweep in a single county, not a nationwide operation. The number of devices recovered in such a short period indicates that skimming hardware is actively deployed and remains in place long enough for criminals to collect data from multiple victims.

Earlier in 2024, two additional operations demonstrated the geographic spread of skimming. In April, law enforcement visited more than 1,150 businesses in Clark County, Nevada, and recovered 18 skimming devices, preventing an estimated $5.4 million in potential losses[3]. In June, a separate operation inspected more than 3,500 point-of-sale terminals, gas pumps, and ATMs and prevented an estimated $1.3 million in potential losses[4]. Across these three operations, skimming devices were found in retail businesses, fuel stations, and ATM locations in multiple U.S. states.

These figures represent only the devices recovered during targeted sweeps. They do not account for skimming hardware that was not inspected, devices that were removed by criminals before law enforcement arrived, or internal skimmers that are invisible from the outside[1]. The actual number of active skimming devices at any given time is higher than the recovery totals.

For cardholders, these operations confirm that skimming is not confined to high-risk or isolated locations. The terminals inspected in 2024 were in everyday retail and fuel environments where people conduct routine transactions. The recovery of 21 devices from 800 terminals in San Diego County means that a measurable proportion of terminals in a single county had active skimming hardware installed during that period[2]. This is why physical inspection of terminals before each transaction and regular monitoring of account activity are necessary protective measures, not optional precautions.

Financial Impact: Reported Losses from Card Fraud

Skimming costs financial institutions and consumers more than $1 billion each year, according to the FBI[1]. This is the documented annual cost of a single fraud method, not the total of all payment card fraud. The figure represents direct losses from unauthorised transactions made with cloned cards and the costs institutions incur to detect, investigate, and remediate skimming incidents.

In 2024, the FBI's Internet Crime Complaint Center received 12,876 complaints categorised as Credit Card/Check Fraud[5]. Reported losses for this category totalled $199,889,841[5]. This figure includes fraud types beyond skimming—such as card-not-present fraud, account takeover, and cheque fraud—so it does not represent skimming losses alone. However, it confirms that payment card fraud remains a significant source of reported financial harm.

To understand the scale of the problem, consider the broader context. Total complaints to the IC3 in 2024 reached 859,532 with reported losses of $16.6 billion, a 33 percent increase from 2023[5]. Credit Card/Check Fraud accounted for 1.5 percent of all complaints and 1.2 percent of total reported losses. This means card fraud is a measurable but relatively small portion of overall cybercrime losses reported to the FBI.

What these numbers mean for individual cardholders

The $1 billion annual skimming cost is distributed across financial institutions and millions of cardholders[1]. Most individual victims do not lose the full amount of an unauthorised transaction because card issuers typically offer zero liability policies for reported fraud. However, victims still face account disruption, the need to cancel and replace cards, and the time required to dispute charges and restore account access.

The IC3 data show that 12,876 people reported card fraud in 2024, but this represents only those who filed a complaint with the FBI[5]. Many victims report fraud directly to their card issuer or bank and do not file an IC3 complaint, so the actual number of affected cardholders is higher. The reported loss total of nearly $200 million also reflects only what victims chose to report to the IC3[5].

For context, the December 2024 San Diego operation prevented an estimated $63 million in potential losses by recovering 21 skimming devices[2]. This single two-day sweep in one county prevented losses equivalent to nearly one-third of the total card fraud losses reported to the IC3 for the entire year[5]. This comparison illustrates that skimming remains an active, large-scale threat and that law enforcement intervention can prevent significant financial harm before it reaches victims.

Your risk exposure depends on where and how you use your card. Terminals in unsupervised locations—such as outdoor ATMs and fuel pumps—are higher-risk targets for skimming hardware[1]. Regular monitoring of account activity and immediate reporting of unauthorised transactions limit your exposure to loss, even if your card data is captured by a skimmer.

Where Skimming Devices Are Found

Skimming devices are illegally installed on or inside ATMs, point-of-sale terminals, and fuel pumps[1]. These are the three primary locations where criminals place hardware to capture card data and record PIN entries. Law enforcement operations in 2024 confirm that all three environments remain active targets for skimming installations.

Between April and December 2024, U.S. Secret Service operations inspected more than 5,450 point-of-sale terminals, gas pumps, and ATMs across multiple operations[2][3][4]. The December 2024 San Diego County operation alone inspected more than 800 terminals in these categories over two days[2]. The April 2024 Clark County, Nevada operation visited more than 1,150 businesses[3]. The June 2024 operation inspected more than 3,500 terminals[4]. These inspection totals show that law enforcement prioritises these three terminal types because they are the documented locations where skimming hardware is consistently recovered.

ATMs

ATMs are frequent skimming targets because they process high volumes of transactions in unsupervised locations. Criminals install skimmers on the card slot and place hidden cameras or overlay keypads to record PIN entries[1]. Outdoor ATMs in poorly lit or isolated areas present higher risk because criminals can install and retrieve devices with less chance of detection.

The December 2024 San Diego operation inspected ATMs alongside point-of-sale terminals and gas pumps and recovered 21 skimming devices from the combined total of over 800 inspected locations[2]. The operation data do not specify how many devices were found on ATMs versus other terminal types, but ATMs were included in the inspection sweep.

Point-of-sale terminals

Point-of-sale terminals in retail businesses are another documented skimming location[1]. These terminals are often in supervised environments, but criminals install internal skimmers that are not visible from the outside. Retail staff may not notice compromised hardware unless they are trained to inspect terminals regularly.

The April 2024 Clark County operation visited more than 1,150 businesses and recovered 18 skimming devices[3]. This operation focused on retail locations where point-of-sale terminals are used. The recovery of devices from retail environments confirms that skimming is not limited to unsupervised or outdoor locations.

Fuel pumps and gas pumps

Fuel pumps are high-risk skimming locations because they are often unsupervised and located outdoors[1]. Criminals can open fuel pump panels to install internal skimmers that capture card data without visible external hardware. These internal devices are difficult to detect without opening the pump housing.

All three 2024 Secret Service operations inspected gas pumps and fuel pumps[2][3][4]. The June 2024 operation inspected more than 3,500 point-of-sale terminals, gas pumps, and ATMs and prevented an estimated $1.3 million in potential losses[4]. Fuel stations remain a consistent focus for law enforcement skimming sweeps.

What this means for cardholders

Skimming devices are found in everyday transaction environments where you conduct routine purchases and withdrawals. The inspection totals from 2024 show that thousands of terminals across multiple states were checked for skimming hardware, and devices were recovered in all three categories[2][3][4]. Before each transaction, inspect the card slot and PIN pad for loose, misaligned, or unusual components. If the terminal is in an unsupervised location, consider using a different payment method or choosing a terminal in a more visible area.

For guidance on what to do if you suspect your card has been compromised, see What to Do If My Card Is Cloned.

Common Mistakes and Misconceptions

Assuming chip cards cannot be skimmed at all

Many cardholders believe EMV chip technology makes card cloning impossible. This is only partially true. The chip itself resists full duplication, but skimming devices still capture magnetic stripe data and PIN entries from the same transaction[1]. Criminals then use that stripe data to create fake cards that work where magnetic stripe fallback is accepted. The FBI confirms that skimmed data is used to create fake payment cards for unauthorised purchases[1]. So a chip card does not eliminate cloning risk; it reduces it only when the terminal rejects stripe fallback.

Conflating card cloning with card-not-present fraud

Some people describe any unauthorised online purchase as "card cloning." That is a different fraud type. Cloning requires a physical fake card created from stolen stripe data[1]. Card-not-present fraud uses stolen card numbers without any physical card. The distinction matters because the protective measures differ. Physical inspection of terminals helps against skimming, but it does nothing against online data breaches. Knowing which fraud occurred helps you respond correctly.

Believing skimming only happens at ATMs

The assumption that ATMs are the only skimming target is outdated. Skimming devices are illegally installed on or inside ATMs, point-of-sale terminals, and fuel pumps[1]. Law enforcement operations in 2024 inspected all three terminal types. In December 2024, a San Diego operation inspected more than 800 point-of-sale terminals, gas pumps, and ATMs and recovered 21 skimming devices[2]. Fuel pumps and retail terminals face the same risk as ATMs. Treat every card slot as a potential target.

Thinking skimming is a rare, isolated crime

Some cardholders assume skimming is too uncommon to worry about. The documented scale contradicts that. Skimming costs financial institutions and consumers more than $1 billion each year, according to the FBI[1]. In 2024, the FBI's Internet Crime Complaint Center received 12,876 complaints categorised as Credit Card/Check Fraud, with reported losses totalling $199,889,841[5]. Three U.S. Secret Service operations in 2024 inspected over 5,450 terminals and recovered at least 39 skimming devices[2][3][4]. This is a persistent, measurable threat, not an anomaly.

Assuming a clean-looking terminal is safe

Visual inspection is helpful, but it is not a guarantee. Internal skimming devices are installed inside the terminal and are invisible from the outside[1]. External overlays are designed to match the legitimate card reader, making them difficult to detect without close inspection. A terminal that looks normal may still contain a skimmer. This is why relying on appearance alone creates a false sense of security. Use terminals inside monitored locations and monitor your account activity regardless of how the terminal looks.

Believing skimming only affects debit cards or EBT cards

Some people think skimming targets only government benefit cards or debit cards. The FBI describes skimming as a threat to payment cards generally, installed on ATMs, point-of-sale terminals, and fuel pumps[1]. Credit cards with magnetic stripes are equally vulnerable to data capture. The December 2024 San Diego operation targeted EBT fraud specifically, but the skimming hardware recovered there works on any magnetic stripe card[2]. Any card swiped through a compromised reader can have its stripe data copied.

Conclusions

• Skimming is an active, measurable threat. The FBI estimates it costs financial institutions and consumers more than $1 billion each year[1].
• Criminals install skimming hardware on or inside ATMs, point-of-sale terminals, and fuel pumps to capture card data and PIN entries[1].
• Recovered skimmed data is used to create fake payment cards for unauthorised purchases or account theft[1].
• Law enforcement sweeps in 2024 inspected over 5,450 terminals and recovered at least 39 skimming devices across three operations[2][3][4].
• First action: inspect the card slot and keypad before each transaction, and monitor account activity regularly.

If your card details have already been compromised, start with What to Do If My Card Is Cloned.

Explore More on Card Security

Discover additional resources to stay informed about card safety.