The card reader worked.
That is the part that would bother me.
No error message. No frozen screen. No customer complaining that their card would not go through. The machine sat on the counter doing exactly what everyone expected it to do.
Except it may have been stealing card information at the same time.
That is what makes skimmers such a nasty little fraud.
They do not always announce themselves.
Sometimes the first sign is an investigator standing at your register, lifting off a piece of plastic nobody on your staff noticed.
Now you have a different problem.
How long was it there?
Start With the Machine
If I walked into a business to look for a skimmer, I would not start with the bank statement.
I would start with the terminal.
What is it supposed to look like?
That sounds obvious. It is not.
Most employees use the same card reader every day and probably could not tell you whether the side panel has always had that little gap, whether the keypad sits completely flat, or whether the card slot was always that thick.
Why would they know?
Nobody ever told them to look.
That is the first thing I would change.
Take photos of every terminal when you know it is clean.
Front. Back. Sides. Keypad. Cords. Mounting point.
Keep the pictures somewhere employees can pull them up quickly.
Now they have something to compare against.
Yesterday the keypad was flat.
Today the bottom edge looks raised.
That is a clue.
Yesterday there was one cable coming out of the back.
Today there are two.
Clue.
The card slot suddenly looks thicker.
Clue.
Nobody needs to yell, “We found a skimmer!”
They just need to know when something looks different.
Fourteen Devices
In May 2026, law enforcement inspected more than 3,000 payment terminals, gas pumps, and ATMs around Houston.
They found 14 skimmers.
Fourteen.
That does not sound like a lot until you see the estimated potential loss.
About $14.5 million.
That is why I would not brush this off as something that only happens at sketchy gas stations.
A skimmer can be installed on an ordinary point-of-sale terminal inside an ordinary business while ordinary customers are standing three feet away.
Newer devices can be small. Some cover only part of a terminal. Others sit inside the area where a magnetic-stripe card is swiped. Fake keypad covers can capture PINs.
You may not see a giant piece of crooked plastic hanging off the machine.
You may see almost nothing.
Who Touched the Terminal?
This is where I would start asking questions.
Who can get close to the card reader?
Employees, obviously.
But who else?
Cleaning crews?
Outside technicians?
Delivery people?
Customers?
Someone who says they are from the processor?
Someone who walks in carrying a toolbox and looks like they belong there?
Fraudsters love looking like they belong somewhere.
That is half the trick.
If a person walks into your business and says, “I’m here to service the payment terminal,” what happens?
Does the cashier say okay?
Or does someone call the payment company using the phone number already on file and verify that a technician was actually sent?
That one phone call can matter.
And no, I would not call the number on the technician’s paperwork.
If the person is fake, the paperwork can be fake too.
Use the number you already trust.
Give Employees Something Specific to Look For
I would make the inspection quick.
Nobody is going to follow a 27-step skimmer checklist three times a day.
But they can look at the machine.
Is anything loose?
Does the keypad look raised?
Is the card slot crooked?
Any new scratches?
Sticky residue?
A seal that looks broken?
A cable that was not there before?
Has the terminal moved?
Does one side suddenly not sit flush?
That is enough.
Do it when the business opens.
Do it again at shift change.
Check it when you close.
Write down who checked it and when.
That log is not busywork.
Imagine a skimmer is found Thursday afternoon.
Your Wednesday closing inspection says the terminal looked normal.
Your Thursday morning employee noticed nothing unusual.
Now investigators have a much smaller window to look at.
That is useful.
Compare that with:
“Honestly, I don’t know. Nobody really checks it.”
Very different conversation.
Do Not Rip It Off
This is the part where someone’s inner detective can cause trouble.
You see something weird.
You want to pull on it.
Do not.
You want to pop the cover off and see what is underneath.
Also do not.
If you think the machine has been tampered with, stop using it.
Move customers somewhere else.
Keep people away from it.
Then call the people who need to be called.
Your payment processor.
The terminal company.
Law enforcement.
Your insurer or attorney, if the situation calls for it.
And save everything connected to that terminal.
Camera footage.
Employee schedules.
Service visits.
Inspection sheets.
Transaction times.
Anything showing who was around the terminal and when.
The device itself may be evidence.
Treat it that way.
One More Thing I Would Check
Look at how often your business still uses magnetic stripes.
Chip and tap transactions have made some card theft harder, but the magnetic stripe is still a weak spot.
That matters even more for businesses processing EBT cards, because many of those cards still rely on magnetic-stripe technology.
Ask your processor what your terminals should allow.
When should a swipe be accepted?
When should an employee stop and try something else?
What happens when someone says, “My chip never works. Just swipe it”?
Maybe they are telling the truth.
Maybe not.
Either way, I would rather have a rule than make a cashier decide while a line is forming.
The Part That Gets Missed
Here is the clue I keep coming back to.
The machine can work.
That means a successful payment proves almost nothing about whether the terminal has been tampered with.
That is uncomfortable because most small businesses use “it worked” as their safety check.
Payment approved?
Great.
Next customer.
But a skimmer lives inside that routine.
So I would change the routine.
Take pictures of your terminals.
Show employees what normal looks like.
Check them a few times a day.
Verify technicians.
Control keys and spare equipment.
And if something changes, stop using the machine.
You do not need an employee standing over the register with a magnifying glass.
You just need someone paying enough attention to say:
“Was that always there?”
That question may be what catches it.
