Skimmers and fake letters were supposed to be relics of a less sophisticated era of fraud. A newsletter by WIRED's Lily Hay Newman and Matt Burgess makes the case that in 2026 they are still costing victims dearly — partly because AI has made them cheaper to run.
The fake-new-card-in-your-mailbox trick is the most insidious variant. Portugal, France and Germany have all seen waves of physical credit card scams in recent years, in which criminals mail phony replacement cards or letters claiming the recipient's current card is about to expire. To 'activate' the new card, the letter says, it should be registered via an enclosed QR code or URL. Some sham cards even carry real customer names. 'The card is almost like a token that creates the trust that is needed in order to fall for the actual trick,' says Georg Hauer, an advisor to digital banks. Scanning the code typically leads to a fake banking site that harvests credentials — potentially giving criminals access to the real account. Hauer says the wave has been escalating for close to two years, and that falling production costs for personalised fake cards, helped by AI copying a design from an image, could push it into more countries.
The magnetic stripe is not dead either. The US Attorney's Office for the Northern District of Alabama recently indicted two Romanian nationals over alleged skimming, saying they targeted SNAP food-assistance benefits issued in most states on mag-stripe-only debit cards, or EBT cards. The FBI says EBT skimming has grown since about 2021. 'Skimmer fraud is rampant with losses in the United States alone reaching over $1 billion each year,' US Attorney Phillip W. Williams Jr. said.
Even chip cards are exposed: at non-bank ATMs and smaller merchants, skimmers are installed in ways that force the chip read to fail, so the stripe gets used. Mastercard said last month it will stop issuing any cards with stripes in 2029, with the remainder out of circulation by 2033.
The countermeasures are unglamorous but effective: avoid swiping where you can, inspect terminals for signs of tampering, and give physical mail the same scepticism you give to texts and calls.
