Cybersecurity expert warns this paper-thin device at Walmart self-checkout has stolen $428 million

Cybersecurity expert Boyd Clewis says the next time you use a self-checkout card reader at a big-box store, gas station, or grocery lane, you should stop treating that machine like harmless plastic and start treating it like a possible crime scene. In his recent video, Clewis warned that a paper-thin skimming device placed over a legitimate card reader can quietly steal payment data from shopper after shopper, all while the terminal appears to work perfectly.

His most alarming claim was not just about how easy the scam is, but how big it has become. Clewis pointed to figures he said came from the U.S. Secret Service, showing that in 2025 investigators removed more than 411 skimming devices nationwide and prevented an estimated $428 million in fraud.

That number is staggering on its own, but Clewis’ real point was simpler and more personal: the scam does not need to look dramatic to ruin somebody’s day, or their bank balance. It can happen during a fast grocery run, at a checkout you use without a second thought, and by the time you get home, the damage may already be underway.

The Device Is Designed To Be Invisible

Clewis built his warning around a story from Gastonia, North Carolina, where, he said, a Walmart employee noticed something slightly off during a routine check of self-checkout lanes.

According to Clewis, the color matched, the shape matched, and the terminal looked normal at a glance. But something about the reader seemed too thick. When the employee tugged on it, the whole false front came off in her hands.

Underneath, Clewis said, was a paper-thin skimmer overlay that had been quietly collecting card data from every shopper who used it. Nothing had jammed. No alarm had sounded. The machine still worked exactly the way customers expected.

That is the part that makes this scam so effective and so ugly. It does not rely on chaos or a broken machine. It depends on the fact that most people are in a hurry, trust the store, and never think to examine the card reader before they pay.

Clewis compared it to finding out a vending machine had been pickpocketing people every time they bought a snack. It is a funny image for about one second, and then it is not funny at all, because in the real version of the story, the theft can wipe out rent money, grocery money, or a benefits card somebody cannot afford to lose.

Boyd Clewis Says The Scale Is Much Bigger Than One Store

To show that this is not just an isolated Walmart story, Clewis pointed to several broader enforcement actions.

He said detectives in Fairfax County, Virginia, carried out what they called Operation Skim Scam, checked 100 locations in a single day, and found 20 skimming devices across convenience stores, grocery stores, and discount retailers. He also cited a case in Boston, where police reportedly connected skimmers found at 19 separate Walmarts across the Northeast to a single organized crime ring.

Those examples were meant to make one point clear: this is not random petty theft. According to Clewis, these scams are being run at scale, often by organized crews that know exactly what they are doing and exactly where people let their guard down.

That matters because people still tend to imagine credit card theft as something messy or obvious, maybe a stolen wallet or a hacked website. Clewis’ warning is that this version of theft is quieter, more physical, and in some ways more unnerving because it happens in places people assume are safe.

He also stressed that when the Secret Service gets involved, the crime has moved well beyond small-time mischief. In his telling, that alone should tell viewers how profitable and widespread this skimmer economy has become.

How The Skimmer Actually Works

One of the strongest parts of Clewis’ video was how plainly he explained the mechanics of the scam.

A skimmer, he said, fits directly over a real card reader at a self-checkout machine, ATM, or gas pump. The newer versions are so thin they may be only as thick as two or three stacked credit cards, and they are made to match the color, texture, and shape of the legitimate device underneath.

That means the criminal does not need to break the machine or rebuild it. They just need to add a false skin over the part where the card data is captured.

Clewis said installation can take as little as three seconds. Someone walks up, presses the overlay onto the machine, and moves on. On security footage, it can look like an ordinary shopper using the checkout.

Once the skimmer is in place, it reads and stores data from the card’s magnetic strip when someone swipes or inserts the card. More advanced versions, he said, may also include a tiny camera or a fake PIN pad overlay to capture the customer’s PIN.

That is already bad enough, but Clewis said the part many news reports glide past is even worse: the criminals do not necessarily need to come back and remove the device. He said modern skimmers can send the stolen data wirelessly through Bluetooth, meaning the person running the operation could be sitting in the parking lot collecting card numbers in real time.

If that is true, then the whole scam becomes even more disturbing. It means the thief may be nowhere near the victim in any obvious sense, yet still harvesting payment data while looking like just another person in a parked car.

Why EBT Users May Be At The Greatest Risk

Clewis said the people hit hardest by this scam are often EBT card holders, and his anger was especially clear on that point.

His argument was that while victims with debit or credit cards usually have at least some dispute process, some federal protections, and a chance – even if frustrating – to fight unauthorized charges, EBT users are in a much worse position. According to Clewis, EBT systems are run through state agencies rather than banks, and the federal fraud protections under the Electronic Funds Transfer Act do not apply in the same way.

His blunt conclusion was this: if a skimmer drains an EBT balance, that money is often simply gone.

That is the part of the scam that feels especially cruel. A person with more financial cushion may eventually survive a stolen debit card episode, even if the process is maddening. A person depending on food assistance may not have the same margin for error, and there is something especially ugly about thieves targeting a system built for people already under pressure.

Clewis said criminals can profit from EBT data the same way they profit from stolen bank-card data: spend the balance on food and groceries, then resell the items or otherwise turn the card into cash value.

That turns the scam from ordinary fraud into something meaner. It is not just theft from anonymous consumers. It is theft aimed at people who may already be living close to the edge.

The Protection Advice Is Simple – But It Matters

Clewis said he was not making the video to scare people, but to tell them exactly how to fight back. His advice was practical, repetitive, and probably worth taking seriously.

First, he said, do the “wiggle test” every single time. Grab the card reader and tug at it. A real reader should be bolted down and stable. A skimmer overlay may shift, move, or even pop off.

That advice sounds almost too simple, which is probably why most people do not do it. But Clewis’ whole argument is that the scam relies on speed and habit, so anything that interrupts your autopilot works in your favor.

Second, he strongly recommended tap to pay whenever possible, whether through Apple Pay, Google Pay, or contactless cards. According to Clewis, contactless payments generate a one-time token rather than exposing the real card number in a reusable way, which makes the stolen data effectively worthless to a skimmer.

That may be the single most useful tip in the video, because it changes the entire equation. If the criminal’s tool is built to steal card numbers, and your payment method gives it nothing reusable to steal, then the scheme largely collapses.

Third, he said people should cover the keypad when entering a PIN. Even if thieves get the card data, a hidden PIN can still block them from draining the account at an ATM.

Fourth, check bank statements at least once a week, because Clewis said skimming crews often start with tiny test charges before making larger withdrawals or purchases. Catching those early can be the difference between inconvenience and real financial pain.

Finally, he advised shoppers to trust their instincts. If one reader in a store looks a different color, seems slightly raised, has an odd sticker, or just looks off compared with the others, do not use it.

That is old-fashioned advice, but it is good advice. A lot of personal security still comes down to noticing when something does not feel right and acting on that feeling instead of brushing it aside.

Why This Warning Lands

What makes Clewis’ video effective is not just the scary number – the $428 million figure is dramatic enough on its own – but the way he explains how ordinary the fraud looks while it is happening.

There is no masked thief grabbing your wallet. No shattered terminal. No Hollywood-style cyberattack. There is just a card reader that looks almost normal, a customer in a hurry, and a few seconds of trust that criminals are counting on.

That is why this kind of scam is so effective. It lives inside routine.

Clewis’ broader point is that self-checkout has trained people to move fast and assume the machine is trustworthy. The criminals have adapted to that habit. They are not counting on technology alone. They are counting on human behavior.

And that may be the most useful lesson in the whole warning. Security is often less about being paranoid than about breaking your own rhythm for two or three seconds. Tug the reader. Tap instead of swipe. Shield the keypad. Check the statement.

None of that is dramatic. But then again, neither is the skimmer – until your money is gone.