The Persistent Threat of Analog Fraud: Old-School Credit Card Scams and Skimming Continue to Cost Victims Billions

In an era where artificial intelligence supercharges digital fraud and nearly every unsolicited text message is viewed with suspicion, the idea of being victimized by an old-fashioned credit card skimmer or a deceptive letter in the mail might seem almost quaint. However, as documented in Wired’s "Kernel Panic" newsletter, these seemingly antiquated attack vectors are far from obsolete, continuing to inflict significant financial losses on individuals globally. The reality of 2026 is a complex cybersecurity landscape where advanced digital threats coexist with, and are often amplified by, time-tested analog schemes that exploit human trust and vulnerabilities in older technologies.

One particularly insidious method making a notable comeback is the fake credit card sent through physical mail. Countries like Portugal, France, and Germany have recently experienced widespread waves of these physical credit card scams. Criminals dispatch phony replacement cards or official-looking letters to potential victims, often fabricating claims that an existing card is nearing its expiration date, regardless of the recipient’s actual card status. The scam letter then instructs the recipient to "activate" the new, fake card by scanning an included QR code or visiting a provided URL. Georg Hauer, an advisor for digital banks, notes the alarming sophistication of these schemes, where some sham cards even feature the victim’s real name printed on them. Hauer explains, "The card is almost like a token that creates the trust that is needed in order to fall for the actual trick." The physical presence of a personalized card lends an air of legitimacy, lowering the victim’s guard against what is essentially a highly targeted phishing attempt.

Upon scanning the QR code or navigating to the URL, victims are typically redirected to a meticulously crafted fake banking website. Here, they are prompted to enter sensitive personal and financial details, including login credentials for their real bank accounts. This surreptitious data harvesting grants cybercriminals direct access to their victims’ genuine accounts, enabling fraudulent transactions or even complete account depletion. Hauer indicates that this type of scam has been "escalating for close to two years" and believes its proven success rate makes it ripe for expansion into other countries. He further explains that the "cost of producing a personalized fake card has dropped in recent years thanks to AI just being able to copy a design based on an image." This technological advancement, coupled with a higher "conversion rate per victim" (meaning a greater percentage of targeted individuals fall for the scam), now justifies the additional costs associated with physical production and mailing, making it an increasingly attractive option for criminal enterprises seeking substantial financial gains, often aiming to "empty a proper savings account, which holds much more money," rather than just small amounts.

Beyond deceptive mail, another "90s throwback" scam continues to plague consumers: credit card skimming. The US Attorney’s Office for the Northern District of Alabama recently underscored this persistent threat by indicting two Romanian nationals on charges related to alleged credit card skimming activities. Authorities revealed that the pair specifically targeted government SNAP food assistance benefits, which are distributed to recipients in most states via Electronic Benefit Transfer (EBT) cards. Crucially, many EBT cards still rely on antiquated magnetic stripe-only technology, making them particularly vulnerable to these classic skimming techniques.

While modern credit cards largely feature more secure EMV chip technology designed to prevent cloning and make fraud significantly harder, this case serves as a stark reminder that magnetic stripe cards, and the skimming devices designed to exploit them, are still actively deployed. Scammers continue to find it profitable because enough swiping transactions occur to make the effort worthwhile. The Federal Bureau of Investigation (FBI) has reported a significant increase in EBT card skimming since approximately 2021, highlighting a growing vulnerability among a population segment often reliant on these benefits.

US Attorney Phillip W. Williams Jr. emphasized the scale of the problem in a press release regarding the recent indictment, stating, "Skimmer fraud is rampant with losses in the United States alone reaching over $1 billion each year." It is important to note that this staggering figure encompasses various forms of credit card skimming, not exclusively those targeting EBT cards. Williams described it as "a silent insidious theft that occurs by merely swiping a credit card at a point of sale," illustrating how victims often remain unaware of the compromise until fraudulent charges appear.

Gary Warner, the director of intelligence at the cybersecurity firm DarkTower, sheds further light on the vulnerability of EBT cards, noting that "dozens of states continue to use mag-stripe only cards for benefits purposes." The inherent risk, as Warner explains, is that "if the mag stripe is compromised, a clone of the card can be created and access not only the current value, but future value as well." This means criminals can continue to drain funds from a victim’s account as new benefits are loaded, creating a long-term financial hardship.

Moreover, the risks associated with magnetic stripes extend beyond EBT cards. Warner cautions that even individuals with chip-enabled cards are not entirely immune. "Non-bank ATMs and smaller non-chain merchants may expose your chip-enabled card to mag stripe reading," he warns. In these scenarios, sophisticated mag-stripe skimmers are often designed to intentionally "force the chip read to fail," thereby compelling the terminal to revert to the less secure magnetic stripe reading, allowing the skimmer to capture the card data. This highlights a critical weakness in the payment ecosystem, where the presence of a chip does not always guarantee its use.

While magnetic stripe cards have been gradually phased out in the US and many other parts of the world over several years, their complete eradication is still some time away. Mastercard, a leading global payment technology company, announced a significant step last month, stating its intention to stop issuing any cards with magnetic stripes by 2029. The company anticipates that all remaining Mastercard credit and debit cards featuring magnetic stripes will be completely out of circulation by 2033. This transition is a testament to the recognized security vulnerabilities of magnetic stripes compared to the cryptographic security offered by EMV chips, which generate unique transaction codes for each purchase, making card cloning significantly more difficult.

In the interim, financial fraud has solidified its position as one of the largest overall crime types, both within the United States and globally. While older scams persist, many modern attacks heavily leverage social engineering tactics, mass phishing campaigns through email and messaging, and other forms of deception where victims are manipulated into sending money in transactions that often appear legitimate to banks and financial institutions. However, as Georg Hauer reiterates, criminals are pragmatic; they will consistently employ methods that yield the greatest financial returns. The potential to "empty a proper savings account," rather than just pilfering a few thousand euros, provides a strong incentive for scammers to invest in even seemingly low-tech methods like sending physical letters, demonstrating that high reward justifies the means.

Given the pervasive nature of scams, both digital and analog, vigilance is paramount. To safeguard against these "old-time" threats, several relatively straightforward protective measures can be adopted. Firstly, consumers should prioritize using the chip reader or contactless payment (tap-to-pay) options whenever possible, as these methods offer significantly enhanced security compared to swiping. When swiping is unavoidable, particularly with EBT cards or at older terminals, it is crucial to meticulously inspect the point-of-sale terminal or ATM. Look for any signs of tampering: loose parts, misaligned graphics, different textures or colors, or anything that makes the card reader or keypad appear unusually bulky or altered. If a terminal seems suspicious, it is always best to use an alternative one or pay with cash.

Finally, the same healthy skepticism applied to unsolicited texts and calls should be extended to physical mail. While legitimate organizations such as banks, healthcare providers, and government agencies like the IRS still send important documents via post, scammers are also actively exploiting this channel. Treat any unexpected financial correspondence with extreme caution. If a letter requests personal information or directs you to a website for card activation, verify its legitimacy by contacting the issuing institution directly through official channels—using a phone number found on their official website or on the back of your existing card, not one provided in the suspicious letter itself. Remaining alert to these enduring threats is essential in navigating today’s complex landscape of digital and physical fraud.