Old-School Scams Endure, Costing Billions Amidst AI Fraud Wave

In an era increasingly defined by sophisticated digital threats, where every unsolicited text message raises suspicions of a scam and artificial intelligence supercharges online fraud, the notion of falling victim to old-fashioned credit card skimmers or bogus letters in the mail might seem almost quaint. Yet, as individuals worldwide navigate an relentless barrage of potential scams, these seemingly antiquated attacks continue to inflict substantial financial damage on victims, proving that even in 2026, low-tech fraud remains a potent threat. This ongoing challenge is a key focus for cybersecurity experts, highlighting the need for vigilance across all communication vectors, from the digital inbox to the physical mailbox.

One particularly insidious example of this resurgence is the "fake new credit card in your mailbox" trick. Across Europe, countries like Portugal, France, and Germany have experienced widespread waves of these physical credit card scams in recent years. Criminals meticulously craft and mail phony replacement cards or deceptive letters to potential victims. These accompanying letters often carry a convincing message: the recipient’s current card is purportedly nearing its expiration date, prompting the need for a "new" one – regardless of whether their actual card is indeed expiring soon. The crucial step, according to the scam letter, is to activate this new (fake) card by registering it through an included QR code or a provided URL. To enhance legitimacy, some of these sham cards even feature the victim’s real name printed on them, a detail highlighted by Georg Hauer, an advisor for digital banks. Hauer explains the psychological trick at play: "The card is almost like a token that creates the trust that is needed in order to fall for the actual trick." This physical artifact serves as a tangible anchor, lending credibility to an otherwise digital deception, making it harder for recipients to immediately identify it as fraudulent.

The moment a victim scans the QR code or types the URL, they are typically rerouted to a meticulously crafted fake banking website. This fraudulent portal is designed to mimic legitimate financial institutions, often featuring authentic-looking logos, layouts, and even security badges. Here, unsuspecting individuals are prompted to input sensitive personal and financial details – information that could include their full bank account number, debit card PIN, online banking login credentials, social security number, or other identifying data. By surrendering these details, victims inadvertently grant cybercriminals direct access to their real bank accounts, enabling immediate and often irreversible financial theft. Hauer observes that this particular scam has been "escalating for close to two years," suggesting its proven success might lead to its deployment in additional countries as criminal networks share effective tactics. The economics of this crime have also shifted: "The cost of producing a personalized fake card has dropped in recent years thanks to AI just being able to copy a design based on an image, and the higher conversion rate per victim might justify the extra costs." AI’s ability to rapidly generate convincing card designs and personalize them at scale lowers the barrier for criminals, making this seemingly labor-intensive scam more efficient and profitable than ever before.

Beyond the mailbox, another "90s throwback" scam continues to plague consumers: credit card skimming. Last week, the US Attorney’s Office for the Northern District of Alabama underscored this ongoing threat by indicting two Romanian nationals on charges related to alleged credit card skimming activities. What makes this case particularly concerning is the specific target: government SNAP food assistance benefits. These benefits are often distributed to recipients in most states via antiquated magnetic stripe-only debit cards, known as Electronic Benefit Transfer (EBT) cards. While chip-enabled credit cards have significantly reduced fraud at point-of-sale terminals, this indictment serves as a stark reminder that classic skimmers targeting magnetic stripe cards remain widely deployed. The reason is simple: there is still enough magnetic stripe swiping occurring, particularly with EBT cards used by vulnerable populations, to make these operations financially viable for criminals. The Federal Bureau of Investigation (FBI) has noted a significant rise in EBT card skimming specifically since around 2021, indicating a targeted shift by scammers towards this vulnerable payment method and its users.

The scale of this problem is immense. US Attorney Phillip W. Williams Jr. stated in a press release concerning the recent indictment, "Skimmer fraud is rampant with losses in the United States alone reaching over $1 billion each year." It is important to note that this staggering figure encompasses various forms of credit card skimming, not solely those targeting EBT cards, but includes debit, credit, and gift card compromises. Williams described it as "a silent insidious theft that occurs by merely swiping a credit card at a point of sale." Victims often remain unaware their card data has been compromised until fraudulent transactions appear, or their accounts are completely drained, creating significant financial hardship and emotional distress. Gary Warner, director of intelligence at the cybersecurity firm DarkTower, highlights the critical vulnerability of EBT cards: "The risk here is that if the mag stripe is compromised, a clone of the card can be created and access not only the current value, but future value as well." This means criminals can continue to siphon off funds as new benefits are loaded onto the compromised account, prolonging the impact of the theft.

More broadly, Warner warns that significant risks persist whenever payments are made using the magnetic stripes on any cards, even those that also include the more secure EMV chips issued over the past decade-plus. While chip technology was designed to create unique, encrypted transaction data for each use, making it far harder to clone a card, criminals have adapted their methods. "Non-bank ATMs and smaller non-chain merchants may expose your chip-enabled card to mag stripe reading," Warner explains. In these scenarios, skimmers are frequently installed in such a sophisticated manner that they intentionally force the chip reader to fail, thereby prompting the user to swipe the less secure magnetic stripe. These illicit devices, often designed as overlays on legitimate card readers or as internal modifications to the machine, silently capture card numbers, expiration dates, and sometimes even Personal Identification Numbers (PINs) via hidden cameras or tampered keypads. The stolen data is then rapidly used to create cloned cards for illicit purchases, cash withdrawals, or online fraud before the victim becomes aware.

While magnetic stripe cards have been gradually phased out in the US and globally over many years, their complete eradication is still some time away. Mastercard, for instance, announced last month its commitment to stop issuing any cards with magnetic stripes by 2029, with all remaining stripe-enabled cards expected to be completely out of circulation by 2033. Until then, the window of vulnerability remains open for millions of cards still in circulation. Financial fraud, in general, has escalated dramatically, becoming one of the largest overall crime types in the US and worldwide, with the Federal Trade Commission (FTC) reporting billions lost to imposter scams alone in 2025. Many modern attacks predominantly leverage social engineering tactics, mass phishing message campaigns, and other forms of digital fraud where victims are manipulated into sending money through transactions that often appear legitimate to banks and financial institutions, making recovery incredibly difficult.

However, the persistence of these analog scams underscores a fundamental truth about criminal enterprises: they will always gravitate towards methods that promise the highest returns with the lowest perceived risk. Georg Hauer emphasizes this point, noting that the "real idea behind some of these scams is to not essentially try to steal €2,000 from someone’s bank account, but rather actually empty a proper savings account, which holds much more money." This strategic approach explains why criminals are willing to invest in physical infrastructure, whether it’s printing fake cards or installing skimmers, if the potential payout is substantial enough to justify the effort and cost. They target vulnerabilities, whether technological (outdated magnetic stripes) or psychological (trust in official-looking mail and the urgency of a "new card").

For individuals feeling overwhelmed by the constant threat of scams, there are practical and relatively straightforward measures to protect against these "old-time" schemes. Firstly, whenever possible, avoid swiping cards. Prioritize using chip readers or contactless payment methods (Near Field Communication, or NFC), as these technologies offer superior encryption and generate unique transaction codes that are far more difficult for criminals to intercept and replicate. Secondly, when swiping is unavoidable—as is frequently the case with many EBT cards—cultivate a habit of vigilant inspection. Before inserting or swiping your card, carefully examine the terminal. Look for anything that appears unusual, altered, or damaged. This could include loose parts, misaligned graphics, an unusually bulky card reader, visible wires, or a keypad that feels different from the rest of the machine. If a terminal seems suspicious, opt to use a different one or, if possible, another payment method entirely. Finally, extend the same healthy skepticism you apply to unsolicited texts and calls to physical letters arriving in your mailbox. While legitimate organizations like marketers, healthcare providers, banks, and the IRS still send mail, scammers are increasingly lurking there too. Always verify the authenticity of any request for personal information by contacting the institution directly using official contact details (from their website or a trusted statement), never the ones provided in a suspicious letter or email. Shred any unsolicited mail that requests personal information or appears to be a scam to prevent identity theft.

The ongoing battle against financial fraud requires continuous vigilance and adaptation, not just against the latest digital innovations but also against the enduring ingenuity of criminals employing tried-and-true methods. Staying informed and practicing caution across all communication channels—digital and physical—remains paramount in safeguarding personal finances against a diverse and evolving threat landscape.