US Card Skimming Grew Nearly 5x in 2022, New FICO Data Shows

In August of 2022, I explored the radical increase in card skimming for the first half of 2022. Now that we have data from the entire year to review, we are seeing the alarming trend continue.

For 2022, we saw a significant increase in compromised cards resulting from skimming activity. Total compromise cards were up 368% from 2021, with more than 161,000 impacted cards identified — nearly a 5x increase over 2021. Nearly 3,000 unique financial institutions (FIs) were affected by a compromise, representing a 79% year-over-year increase in affected institutions.

This growth trend is concerning not only for the FIs, but also for the consumers whose card details and account information are impacted. And the data from January 2023 is already trending at nearly 10x increase over 2022. Taken together, these statistics point to an issue that isn’t going away. Unfortunately, we expect to see high volumes of skimming points of compromise (POCs) and compromised cards this year as well.

Increasing In Volume, Impact

The jump in skimming activity was directly related to an increase in the number of POCs. Last year, we saw a 452% increase in POCs, illustrating that criminals are back in force and working to put a skimmer in as many locations as possible.

One striking fact about the increase in POCs was that 75% of the total compromise sites were new in 2022 (sites that had not been compromised before). While this alone should give pause, when combined with the fact that there were an average of 185 cards compromised per skimming event, banks and consumer should all be wary when using any ATM, point of sale terminal, or other location where a card skimmer could be potentially located.

Across the US, we saw clear geographic focal points for skimming activities. California earned the dubious distinction of the top state for skimming event locations, with 47% of the total for the year. A cluster of states in the northeastern US accounted for an additional 29%, and included New York, New Jersey, Pennsylvania, Maryland and Virginia.

When looking at total fraud cases related to skimming, we saw that 70% were tied to POCs in 5 states: California (38%), New York (16%), Pennsylvania (6%) and Florida/Washington (5%). Most of the skimming events happened in a relatively short time frame, with 64% taking one week or less, and 87% lasting two weeks or less. With this short timeframe, finding and disabling skimming devices can be nearly impossible, and many (if not most) consumers will not know that their information has been compromised until fraudulent charges show up on their card.

Consumers: Pay Attention to Detail

Fortunately, there are several specific actions that both FIs and consumers can take to minimize the impact of skimming.

1. As I mentioned in my last skimming post, consumers can pay close attention to PIN pads and payment terminals when using a credit card or a debit card. Anything that looks suspect, like weird keys on the keypad, a broken seal on the gas pump, or buttons that simply don’t feel right, should be red flags to move on or use another location.
2. Consumers can also take more advantage of tap-to-pay technology. By using this contactless payment method, consumers can take advantage of tokenization and encryption of card details, making it much harder for criminals to capture sensitive card information.
3. Chip and PIN transactions are more secure than swiping, but consumers will need to take care to cover the PIN pad while entering their number so that thieves cannot capture the unique PIN with a spy cam.
4. The least secure card payment method is swiping, as this will allow criminals with a skimmer in the terminal to capture all the card information from its magnetic strip. Often a compromised payment terminal will prevent a user from using anything other than a swipe, so if you encounter problems using contactless or chip and PIN methods, look for another card reader.

Banks Need Vigilance, Proactivity, And Technology to Protect Against Compromise

For banks and other FIs, knowing the signs of compromised cards are vitally important. We saw that in 2022, 58% of the attempted transactions in fraud cases were balance inquiries. Banks can use this information to define rule sets to increase monitoring or do proactive customer outreach in case of balance inquiries, helping to head off criminal activity before it results in losses.

Banks can also take advantage of detailed information contained in Compromised Card Reports (CCRs) and Suspect reports, available through the FICO Card Alert Service. Using the data from these reports, issuers can act immediately to address known compromised cards with tactics like block/reissue or implement strategies to increase monitoring of those cards for signs of fraudulent activity.

Knowing where skimmers are most prevalent is also a powerful piece of knowledge. With geographically specific strategies, issuers can define and implement rules that address the increased risk in distinct locations, or establish limits on transaction amounts in areas where skimming incidents are higher.

Proactive customer outreach is another excellent tool in the FI toolbox. Using real-time, two-way customer communication capabilities in the channel of customer choice (whether text, email, phone, or in-app messages), FIs can confirm whether a specific transaction was initiated by the consumer or whether it was a fraudster.

While skimming events can impact hundreds of unknowing individuals, criminals will also continue to target consumers through phishing, smishing, scams, and other tactics to obtain cardholder data that can be used for card-not-present fraud. Banks should deploy fraud checks prior to authorizing any purchase or payment transaction. AI- and ML powered models can help protect against credit card fraud, debit card fraud, and authorized user fraud related to scams.

How FICO’s Card Alert Service Can Help Fight Card Skimming Fraud

• Read about the first half 2022 card skimming results from Card Alert Service.
• Learn how Customer Communications Services for Fraud helps protect customers from fraud in real time
• Learn more about FICO’s award-winning Retail Banking model 3.0 with scam detection score

Follow me on LinkedIn for more insights about FICO’s innovative fraud fighting efforts.