Here’s What Happens When Your Debit Card Gets Skimmed at a Gas Station

Image source: Getty Images

Most people don’t find out their debit card has been skimmed at the pump. They check their balance and wonder who spent $340 at a Walmart they’ve never been to.

By then, the money is already gone.

What skimming actually is

A skimmer is a small device criminals attach to the card reader on a gas pump. Most are designed to be nearly invisible and fit right over the legitimate card slot. Some of the newer ones are internal, placed inside the pump itself, which means you’d have no way of spotting one from the outside.

When you swipe or insert your card, the skimmer captures your card number and expiration date. If the pump has a camera hidden inside a fake keypad, like many do, it captures your PIN too.

The whole thing takes about two seconds.

What happens next

Once thieves have your card data, they either use it themselves or sell it. Card numbers stolen at gas stations can go for a few dollars each. The people who buy them typically move fast, making purchases before the victim or their bank notices anything.

With a debit card, this is especially painful. Because a debit card pulls directly from your checking account, unauthorized charges drain real money you were counting on.

One of the simplest ways to protect yourself is by using a credit card instead of a debit card to get gas. You can compare some of the best credit cards for gas and groceries right here, risk free.

Your liability depends on how fast you catch it

This is where the difference between debit card and credit card really matters.

Federal law limits your liability for unauthorized debit card charges, but the window is tight:

• If you report the loss before any unauthorized charges are made: $0 liability.
• If you report within two business days of learning about the fraud: your liability is capped at $50.
• If you report between two and 60 days after your statement shows the fraudulent charge: you could be on the hook for up to $500.
• After 60 days: you may be liable for the full amount.

Credit cards work differently. Under the Fair Credit Billing Act, your maximum liability for unauthorized charges is $50, and most major card issuers have brought that down to zero. The bigger difference is that with credit, you’re disputing a charge before you pay it. With debit, you’re trying to get your money back after it’s already left.

All of this made me stop using a debit card at the pump completely. If you want to start adding some extra security when you get gas and earn some rewards, compare some of the best credit cards available now.

What your bank will actually do

Most banks will open a fraud investigation once you report unauthorized charges. They’re required by law to provisionally credit your account within 10 business days while they look into it, though some do it faster.

The investigation itself can take up to 45 days, and in some cases up to 90 if the account is new or if the fraud involved a foreign transaction. During that window, your money may or may not be accessible depending on your bank’s policies.

If the bank concludes the transaction was authorized — meaning they don’t believe fraud occurred — they can reverse the provisional credit. You’d get a written notice and a limited time to appeal. It doesn’t happen often, but it happens.

The steps to take immediately

If you think your card has been skimmed:

1. Call your bank right now. Don’t wait until morning, don’t wait until you’re sure. Report the suspected fraud and ask them to freeze or cancel the card immediately. Most banks have 24/7 fraud lines.
2. Change your PIN. Even if you don’t know whether it was captured, assume it was.
3. Pull your account history. Go back at least a week and look for anything you don’t recognize. Focus on small charges, which thieves sometimes use to test whether a card is live before making larger purchases.
4. Set up transaction alerts. If you don’t already have text or email alerts for every transaction, set them up now. It’s probably the single most underused feature in personal banking.
5. File a police report. Banks sometimes require one for their investigation. It also creates a paper trail if you need to escalate.
6. Consider placing a fraud alert. A fraud alert through one of the major credit bureaus (Experian, Equifax, TransUnion) notifies lenders to take extra steps to verify your identity before opening new accounts. It’s free and lasts one year.

It’s up to you

You probably can’t tell from looking at a pump whether it’s been compromised. But you can control when you use a debit card and when you don’t, how quickly you check your account, and how fast you move once something looks wrong.

The people who recover from this fastest aren’t the ones who avoided fraud. They’re the ones who caught it early.

We’re firm believers in the Golden Rule, which is why editorial opinions are ours alone and have not been previously reviewed, approved, or endorsed by included advertisers.
Motley Fool Money does not cover all offers on the market. Editorial content from Motley Fool Money is separate from The Motley Fool editorial content and is created by a different analyst team.The Motley Fool has a disclosure policy.