ATM skimming — the theft of card data by a hidden device attached to or inside a cash machine, gas pump or checkout terminal — remains a large, active problem heading into 2026, and the newest hard numbers come from federal enforcement rather than from any single breach. The U.S. Secret Service says its 2025 outreach sweeps pulled 411 skimming devices out of nearly 60,000 inspected terminals, and it opened a fresh round of the same operation in January 2026.
The practical answer for most readers splits in two. If you carry a bank debit card, federal rules cap what you lose when you report quickly. If you carry an EBT card, the federal replacement program for stolen food benefits has expired, and in most states the money is simply gone.
Table of Contents
- What the 2025 and 2026 enforcement numbers actually show
- How big is the underlying problem, and is it growing?
- Who is worst affected — and why EBT holders lose the most
- What protection a bank debit or credit card actually gives you
- The limits of these numbers
- Frequently Asked Questions
What the 2025 and 2026 enforcement numbers actually show
Across 2025, the Secret Service ran 22 EBT-fraud and ATM-skimming outreach operations, visited more than 9,000 businesses, inspected close to 60,000 point-of-sale terminals, gas pumps and ATMs, and removed 411 devices. The agency put the prevented potential loss at more than $428.1 million in its January 2026 announcement. The geography matters more than the headline figure. Those operations covered Los Angeles, Washington D.C., Anchorage, Boston, Orlando, Charlotte, Buffalo, San Diego, New York City, San Antonio, Baltimore, Tampa, Atlanta, Savannah, Memphis, Miami and Pittsburgh.
That spread — Alaska to Florida, big metros and mid-size cities alike — is the clearest evidence that skimming is not a regional crime pattern. The 2026 campaign opened in late January with a multi-city operation in Cleveland, Cincinnati, Seattle and Denver, joined by USDA OIG, Homeland Security Investigations, GSA OIG, the FBI and the Colorado Bureau of Investigation. In Denver on Jan. 30 alone, agents visited 362 businesses, inspected more than 2,700 devices and pulled 19 skimmers, which the Secret Service tied to $19.79 million in estimated potential losses.
How big is the underlying problem, and is it growing?
Enforcement counts devices found. The broader loss estimate comes from the FBI, which puts skimming's cost to U.S. consumers and financial institutions at more than $1 billion a year, from hardware installed on or inside ATMs, checkout terminals and fuel pumps that captures card data while a camera or overlay records the PIN. Card-network data points the same direction.
FICO's Card Alert Service reported that the second half of 2024 brought a 30% rise in compromised debit cards and a 46% rise in compromise events over the first half of the year — and that the majority of compromises happened at non-bank ATMs, the free-standing machines in convenience stores and similar locations. That last detail is the single most actionable finding in this article. A bank-branch ATM sits under cameras, gets serviced regularly, and is harder to tamper with unobserved. The standalone machine next to the drinks cooler is where the compromises cluster.
Who is worst affected — and why EBT holders lose the most
The people with the least protection are SNAP recipients. Federal authority to replace skimmed SNAP benefits expired on Dec. 20, 2024 and has not been renewed, and states stopped accepting stolen-benefit claims as of Oct. 1, 2025, according to USDA's Food and Nutrition Service. Congressional Research Service background on the lapse covers how the replacement authority worked while it lasted.
EBT cards also sit outside the consumer protections that cover bank debit cards. That is the structural reason skimmed food benefits usually vanish permanently: there is no issuer obligation to make the household whole. Only a small number of states, including California and Maryland, fund replacement out of their own budgets. The mechanics make this worse. Most EBT cards still use a magnetic stripe rather than an EMV chip, which is exactly the technology a skimmer is built to read, and benefits land on a predictable monthly schedule that thieves can time. A household can lose an entire month of food money in minutes at a corner-store terminal.
What protection a bank debit or credit card actually gives you
For a bank-issued debit card, Regulation E sets the ceiling, and it is a sliding one tied entirely to how fast you report. Under 12 CFR 1005.6 as published by the CFPB, liability for unauthorized electronic transfers is capped at $50 if you report a lost or stolen access device within two business days, rises to $500 if you do not, and becomes unlimited for transfers occurring more than 60 days after the statement that showed the first bad charge. Read that as a deadline, not a guarantee.
The $50 cap is worth real money only if you notice the charge, and noticing requires actually reading statements or turning on transaction alerts. The 60-day cliff is absolute: past it, the rule stops helping. Steps that meaningfully reduce exposure:.
- Prefer bank-branch or in-lobby ATMs over free-standing machines in convenience stores and gas stations, where FICO found most compromises occur.
- Cover the keypad with your other hand — a skimmer captures the card, but a pinhole camera or overlay is what captures the PIN.
- Tug the card reader and check the panel around it before inserting; loose, mismatched or protruding parts are the classic sign.
- Turn on real-time transaction alerts so a compromise surfaces in hours, not at the next statement.
- Report an unauthorized debit transfer within two business days to stay inside the $50 cap, and never let it pass 60 days.
The limits of these numbers
The "$428.1 million prevented" figure is an estimate of potential loss from the devices removed — not measured consumer losses, and not money traced to victims. It is a projection of what those 411 skimmers might have taken had they kept running. The sampling limit cuts the other way and is the more important one.
Outreach operations inspect terminals only in the cities they visit, on the days they visit. That means the national total of installed skimmers is certainly higher than 411, so the figure simultaneously understates real exposure and overstates how precisely any of it can be quantified. Treat both the enforcement counts and the FBI's $1 billion annual estimate as order-of-magnitude indicators rather than a ledger.
Frequently Asked Questions
Does a chip card protect me from skimming?
It helps substantially, because a chip transaction generates a one-time code that a cloned magnetic stripe cannot reproduce. But most cards still carry a stripe as a fallback, and many EBT cards have no chip at all, which is part of why SNAP recipients are hit hardest.
If a skimmer is found at an ATM I used, will my bank contact me?
Sometimes, through the compromise-alert services banks subscribe to — FICO's Card Alert Service is one. Do not wait for it. Reporting within two business days is what preserves the $50 Regulation E cap.
Is skimming worse in certain cities?
The 2025 Secret Service operations spanned 17 metros from Anchorage to Miami, and the 2026 round added Cleveland, Cincinnati, Seattle and Denver. The device counts reflect where agents looked, not where skimming is concentrated.
You Might Also Like
- Cybersecurity — Credit Card Fraud News Guide 2026: What Happened, Who Is Affected, and Next Steps
- Cybersecurity Breach Guide 2026: What Happened, Who Is Affected, and Next Steps
- Genetic Data Breach Guide 2026: What Happened, Who Is Affected, and Next Steps