The decals in those viral posts are maintenance stickers. FCIC Intelligence Operations Captain Jeff Roberts said it plainly: "While we all need to stay vigilant as criminals become more savvy, there are no legitimate instances reported where 'tap-to-pay stickers' have been used to steal data. The decals shown in social media posts appear to be standard industry stickers used to replace worn or hard to see tap-to-pay terminals" (Texas FCIC, earlier this month).

The FCIC also reiterated that tap-to-pay, especially through a mobile payment app, remains the safest method at the fuel pump during the current surge in magnetic-stripe skimming (Texas FCIC, earlier this month).

Knowing what's actually suspicious matters here. A flat printed decal over the NFC symbol is not a red flag. What is worth acting on: anything bulky, raised, or misaligned on the face of the reader; a device sitting on top of the card slot rather than flush with the panel; a reader that won't respond to a tap despite close contact. The FCIC's guidance is direct if a sticker or attachment appears to physically interfere with a tap transaction rather than simply mark the tap zone, report it to the station attendant immediately and skip the swipe (Texas FCIC, earlier this month). Physical obstruction is the signal. A printed label is not.

Real skimming has nothing to do with the surface of a contactless reader. Fuel pump skimmers are typically attached to internal wiring inside the machine, invisible to anyone standing at the terminal (FBI). The threat is inside the pump, not on it, closer to a bug planted inside a phone than a note taped to the front of one.

Data captured that way gets encoded onto a blank card with a magnetic stripe, which criminals then use to make fraudulent purchases or withdrawals (U.S. Secret Service, earlier this year).

The scale is serious. Secret Service operations in 2025 covered more than 9,000 businesses, inspected nearly 60,000 terminals, pumps, and ATMs, removed 411 illegal skimming devices, and prevented an estimated $428 million in potential losses (U.S. Secret Service, earlier this year). Those are just the devices that were found.

Skimmers rarely operate alone. Pinhole cameras mounted above keypads, or keylogging overlays that sit on top of the physical keypad and record keystrokes, are frequently deployed alongside the skimming hardware to capture PINs (FBI). A stolen card number is useful on its own; paired with a PIN, it enables ATM withdrawals.

EBT cardholders face compounded exposure. Unlike modern credit and debit cards, EBT cards still rely on magnetic stripes rather than chip technology, which makes them straightforwardly vulnerable to skimming (AARP, about three months ago). Law enforcement has documented a nationwide increase in skimming operations specifically targeting these accounts (U.S. Secret Service, earlier this year). When theft occurs, reimbursement protections are weaker than for standard credit or debit cards, and repayment, when it happens at all, may take weeks (FBI). Criminals time their moves deliberately: EBT cash benefits are typically drained between midnight and 6 a.m. on the day monthly funds become available, and SNAP balances are targeted between the first and tenth of the month (FBI).

The security advantage of tap-to-pay is architectural, not just a preference. A contactless transaction using NFC (near field communication) technology doesn't transmit your actual card number. It generates a one-time token, a unique code tied to that single transaction, that is worthless to anyone who intercepts it because it can't be reused (AARP, about three months ago). A magnetic stripe does the opposite: it transmits the same static data every time you swipe, data that a skimmer can capture once and replay indefinitely.

Both the FBI and the Secret Service advise consumers to tap rather than swipe or insert whenever the card and terminal support it.

Paying through a phone or watch pushes that security further. Smartphone and wearable payment solutions use biometric authentication, Face ID or fingerprint, verifying the user's identity even when a transaction falls below the standard contactless limit, so a phone in the wrong hands still can't authorize a payment without the owner's biometric (NFC Forum/ABI Research, about two years ago). That's why the FCIC specifically calls out paying via a payment app as the strongest option at the pump.

Consumer behavior is already tracking in this direction. A majority of respondents in an NFC Forum study already preferred device-based contactless options over physical cards, and digital wallet tap-to-pay transaction value is projected to grow by more than 150 percent by 2028 (NFC Forum/ABI Research, about two years ago; CFPB, about three years ago).

One platform detail worth knowing: on iPhones, the only tap-to-pay option is Apple Pay. Apple restricts third-party payment apps, PayPal, Venmo, Cash App and similar services, from accessing the NFC chip on iOS devices, so those apps can't be used for tap-to-pay on an iPhone (CFPB, about three years ago). Android users can choose from multiple wallet apps. For most people this is background context rather than a practical barrier, but it does explain why "tap to pay" increasingly means something different depending on which phone is in your pocket.

Payment method, in order of security:

• Tap via mobile wallet (phone or watch) strongest option
• Tap via contactless card strong
• Chip insert acceptable
• Swipe last resort only

This ordering reflects guidance from both the Secret Service and the FBI, each of which advises using tap-to-pay or chip technology whenever possible (U.S. Secret Service, earlier this year; FBI).

If you have to swipe a debit card, run it as credit to avoid entering a PIN. If a PIN is unavoidable, cover the keypad with your other hand, pinhole cameras mounted above the keypad are a documented part of skimming setups (U.S. Secret Service, earlier this year).

Before inserting a card, give the reader a quick look and feel. Loose components, a card slot that feels different from the surrounding casing, exposed wiring, or a keypad that sits raised above the panel are the red flags worth acting on (AARP, about three months ago). A flat decal on the contactless zone is not.

If something looks wrong, tell the station attendant and don't swipe. Report suspected pump tampering to your state's fuel pump oversight authority, in Texas that's the Department of Licensing and Regulation; most other states route this through weights-and-measures agencies (Texas FCIC, earlier this month). Skimming can also be reported to the FBI's Internet Crime Complaint Center at IC3.gov (FBI).

EBT cardholders specifically: monitor your benefit account closely around your monthly deposit date. If you receive a call, text, or email asking for your PIN, don't provide it. State benefits agencies don't request PINs that way (FBI).

The real fraud at gas pumps isn't printed on the surface. It's wired into the inside, hidden, expensive, and growing, with federal operations last year removing hundreds of devices and preventing hundreds of millions in potential losses (U.S. Secret Service, earlier this year). State financial crimes officials have found no legitimate cases of tap-to-pay stickers being used to steal data, and both the FCIC and the FBI recommend contactless payment as the more secure option at the pump (Texas FCIC, earlier this month; FBI).

As mobile wallets become the default for more consumers, the attack surface for magnetic-stripe skimming shrinks. Projected growth of more than 150 percent in digital wallet transactions by 2028 suggests that trajectory only accelerates (CFPB, about three years ago). Viral misinformation that pushes people back toward swiping works directly against it, and hands skimmers exactly the conditions they need.

For anyone wanting to go further: the FBI's skimming resource page, the Secret Service's consumer guidance on EBT fraud, and your state's fuel pump oversight agency are the most practical next stops.