They can be hidden anywhere - on or in a gas pump's credit card slot or the corner bank's ATM.
Then with one swipe, an illegal bank card skimmer records data off a debit or credit card and can get the PIN code, too. Seconds later, someone has electronic access to the victim's account.
Customers can't see the devices, said Paul Elliott, special agent in charge of the Secret Service field office in Jacksonville, Fla. Most don't learn they have been skimmed until the monthly bill arrives.
"We found more than 10,000 numbers on a suspect's computers that he had recovered from various skimmer devices he had," Elliott said of a recent arrest. "The dollar loss with one bank was $110,000, off just one financial institution, and there are more."
Titika Hill got skimmed in October after she swiped her card at a convenience store in St. Augustine.
"Within 24 hours my card had been used at a Walmart in Lakeland for $300. However, my card was still in my possession," she said. "My bank did credit my account back after I submitted a police report. I was advised by my bank to not swipe my card at the pump and to go inside to pay for gas."
It also happened to Brooke Metcalf's husband. But the Westside woman said she only learned when their credit union called them.
"They told us someone tried to use the card in Miami. ... Our card was in my husband's wallet and the only thing we can think is that he went to a store and they used a device to steal the numbers," Metcalf said.
While there isn't much a potential victim can do to stop this kind of credit identity theft, a close look can sometimes tell if the ATM or gas pump is rigged. Gas stations are installing special "tamper tape" across the face of the card reader, which allows the customer to see if it has been tampered with.
If the tape is broken, don't use it, said Clay County Sheriff's Office detective Bill Roberts. Other companies ask station employees to check regularly for tampering, Elliott said. Gate Petroleum and The Pantry, which owns Kangaroo stores, would not comment on the crimes.
Millions of people use the estimated 400,000 automated teller machines across the country every day, according to the Federal Trade Commission. There are many ways a thief can steal the information coded on those cards' magnetic strip.
The simplest is done by store employees and waiters, who use a pocket skimmer to run a customer card and record its data. That is sold to someone who uses it to access that victim's bank account or downloading it onto a credit card or gift card.
A higher-tech way is to stick a fake card reader atop the real slot on the ATM. Looking like the real thing, it scans the victim's card, some using a tiny camera to record the PIN. That data can be put onto a blank card, then the PIN is used to "clean out an account," Elliott said. This can be thwarted if customers take a careful look.
"Look at the device, grab the card reader and give it a tug," Elliott said, since a fake card reader will pull off.
A cell phone can be used to grab and transmit the personal information off the card, too, Roberts said.
"We have seen Bluetooth technology, where the information is sent to the bad guy sitting in a parking lot, so they don't have to retrieve it," he said. "They are getting it over the air."
Another method hides the device inside the ATM or gas pump's card reader.
"We made several arrests in the Orlando area where they would install these devices inside the pump with a key. ... The device would not make the pump malfunction. You had no way of knowing," Elliott said.
Getting the gear to do this isn't too hard for tech-savvy people, Elliott said. He said tests showed one could be installed inside a gas pump in eight seconds.