Old-School Scams Endure: Fake Cards and Skimmers Continue to Cost Victims Billions Amidst AI Fraud Surge

In an era dominated by concerns over AI-supercharged digital fraud and a seemingly unending barrage of sophisticated online scams, the persistence and profitability of antiquated attacks like physical credit card skimmers and bogus letters arriving in the mail might seem laughable. Yet, as detailed in the weekly newsletter Kernel Panic by Lily Hay Newman and Matt Burgess, these "old-time" methods continue to inflict substantial financial losses on victims globally, serving as a stark reminder that vigilance must extend beyond the digital realm into the physical world of privacy and digital security.

The fake-new-credit-card-in-your-mailbox trick stands out as a particularly insidious form of deception. In recent years, countries such as Portugal, France, and Germany have experienced significant waves of these physical credit card scams. Criminals meticulously craft and mail phony replacement cards or letters to potential victims, often claiming that their current card is set to expire soon, irrespective of the victim’s actual card expiration date. The accompanying letters typically instruct recipients to activate the "new" (fake) card by registering it using an included QR code or a provided URL. The level of detail in these scams can be alarmingly high; some sham cards even feature real customer names printed on them, a detail that lends a crucial air of legitimacy.

Georg Hauer, an advisor for digital banks, explains the psychological impact of such physical artifacts. "The card is almost like a token that creates the trust that is needed in order to fall for the actual trick," Hauer notes. This tangible element bypasses some of the immediate skepticism people might apply to a purely digital message, creating a false sense of security. Upon scanning the QR code or visiting the provided URL, victims are invariably redirected to a meticulously designed fake banking website. Here, they are prompted to enter their personal and financial details, including account numbers, PINs, security questions, and potentially even one-time passcodes. This act of "activation" inadvertently hands cybercriminals direct access to their real bank accounts, often leading to significant financial losses.

Hauer observes that this particular type of mail scam has been "escalating for close to two years," suggesting its proven success. He believes it is ripe for broader rollout in other countries, driven by two key factors. Firstly, the cost of producing a personalized fake card has plummeted in recent years, largely due to advancements in artificial intelligence. AI-powered tools can efficiently copy a legitimate card design based on a simple image, enabling scammers to generate high-quality replicas with minimal effort and expense. Secondly, the "higher conversion rate per victim" achieved through these physical scams often justifies the additional costs associated with printing and mailing. The physical presence of a personalized card can be more convincing than a generic email or text, making recipients more likely to comply with the instructions.

Mail scams are not the only "90s throwback" making a costly comeback. Last week, the US Attorney’s Office for the Northern District of Alabama announced the indictment of two Romanian nationals on charges related to alleged credit card skimming. This case highlights a persistent threat, particularly targeting government SNAP (Supplemental Nutrition Assistance Program) food assistance benefits. These benefits are often distributed to recipients in most states via antiquated magnetic stripe-only debit cards, known as Electronic Benefit Transfer (EBT) cards, making them particularly vulnerable to skimming devices.

While fraud related to more secure chip credit cards certainly exists, this recent indictment serves as a stark reminder that classic skimmers, designed to capture data from magnetic stripe cards, are still widely deployed. The reason is simple: there is apparently still enough magnetic stripe swiping occurring to make these efforts highly profitable for scammers. The Federal Bureau of Investigation (FBI) has reported a noticeable rise in EBT card skimming specifically since around 2021, underscoring the growing concern.

US Attorney Phillip W. Williams Jr. emphasized the scale of the problem in a press release regarding the recent indictment. "Skimmer fraud is rampant with losses in the United States alone reaching over $1 billion each year," he stated. This staggering figure encompasses various types of credit card skimming, not exclusively those targeting EBT cards. Williams described it as "a silent insidious theft that occurs by merely swiping a credit card at a point of sale." Victims often remain unaware their card data has been compromised until fraudulent charges appear on their statements, sometimes weeks or months later, making detection and recovery challenging.

Gary Warner, director of intelligence at the cybersecurity firm DarkTower, further elaborates on the vulnerability of EBT cards. He points out that "dozens of states continue to use mag-stripe only cards for benefits purposes." The inherent risk with magnetic stripe technology is that if the stripe is compromised, a clone of the card can be easily created. This cloned card can then be used to access not only the current value of the benefits but also "future value" as new funds are loaded onto the account, leading to ongoing theft from vulnerable populations.

More broadly, Warner warns that significant risks remain associated with making payments using the magnetic stripes on any card, even those that also include the more secure EMV (Europay, Mastercard, and Visa) chip technology that has been widely issued over the last decade-plus. He explains, "Non-bank ATMs and smaller non-chain merchants may expose your chip-enabled card to mag stripe reading." In these scenarios, a point-of-sale (POS) terminal or ATM might not be equipped to read a chip, or a faulty reader might force a swipe transaction. Furthermore, Warner highlights a common tactic employed by sophisticated skimmers: "Mag-stripe skimmers are often installed in such a way that the chip read is forced to fail," effectively bypassing the card’s security features and forcing the transaction through the less secure magnetic stripe. Examples include gas pumps, standalone kiosks, and older POS systems in smaller, independent businesses where upgrades might be less frequent.

The gradual phasing out of magnetic stripe cards in the US has been a multi-year process, driven by their inherent security weaknesses. Unlike EMV chip cards, which generate a unique, dynamic cryptogram for each transaction, magnetic stripes contain static data that is easily copied. Mastercard, a major player in the payments industry, announced last month its intention to stop issuing any cards with magnetic stripes by 2029, with its remaining batch of striped cards expected to be completely out of circulation by 2033. This transition underscores the industry’s move towards more secure payment methods, but in the interim, the vulnerabilities persist.

In the broader context of financial crime, fraud has emerged as one of the largest overall crime types in the US and around the world. While many contemporary attacks are focused on advanced social engineering, mass phishing message campaigns, and other forms of digital fraud where money is transferred by victims in transactions that often appear legitimate to banks and other financial institutions, the continued success of physical scams cannot be overlooked.

Hauer emphasizes that criminals are perpetually seeking methods that allow them to steal the maximum amount of money. He clarifies that "the real idea behind some of these scams is to not essentially try to steal €2,000 from someone’s bank account, but rather actually empty a proper savings account, which holds much more money." This pursuit of larger scores drives the investment in even "old-school" methods if they prove effective.

For individuals who feel like they are already constantly dodging scams, there are several relatively straightforward takeaways to protect against these enduring "old-time" threats. Firstly, consumers should avoid swiping cards whenever possible. Opting instead for chip readers (inserting the card) or contactless payment methods (like tap-to-pay using NFC technology) significantly reduces the risk of magnetic stripe skimming, as these methods leverage the more secure EMV chip.

Secondly, when a swipe is unavoidable—as is frequently the case with many EBT cards and older POS systems—it is crucial to meticulously inspect the terminal. Look for any signs that the terminal appears unusual, altered, or broken. Red flags include loose parts, a misaligned card slot, a different color or material on the card reader compared to the rest of the machine, or any unusual bulk around the card entry point. If anything seems suspicious, it is best to use a different terminal or pay with an alternative method.

Finally, consumers should extend the same level of skepticism they apply to unsolicited texts, emails, and phone calls to physical letters arriving in the mail. While legitimate organizations like marketers, healthcare providers, banks, and the IRS do send mail, scammers are still actively lurking in this channel. Be wary of letters that demand urgent action, request sensitive personal information, contain grammatical errors, or use generic salutations despite claiming to be from your bank. If a letter prompts you to "activate" a new card or update your details, contact your bank directly using a verified phone number (e.g., from their official website or the back of your existing card), rather than any contact information provided in the suspicious letter. Vigilance across all communication channels remains the most effective defense against the ever-evolving, and sometimes re-emerging, landscape of fraud.