CHELMSFORD, Mass. — Authorities in Massachusetts issued a warning on Friday after a debit card skimming device and a hidden camera were discovered on an ATM inside a popular grocery store, raising concerns about potential identity theft for customers who used the machine.
The incident occurred at the Hannaford Supermarket located at 66 Drum Hill Road in Chelmsford, according to the Chelmsford Police Department. A representative from a private company, who was performing routine maintenance on the ATM situated at the store's entrance, stumbled upon the suspicious attachments. The skimming device was designed to capture card information from users swiping their debit cards, while the concealed camera was positioned to record personal identification numbers, or PINs, entered on the keypad.
"The device was discovered at Hannaford Supermarket at 66 Drum Hill Road in Chelmsford," the Chelmsford Police Department stated in an official release. Officials emphasized that the discovery highlights the ongoing threat of ATM tampering, a method criminals use to steal financial data and perpetrate fraud.
It's unclear exactly how long the skimming device had been in place before its detection, but police urged anyone who may have used the ATM in recent weeks to take immediate action. Customers are advised to change their PINs promptly and to scrutinize their bank statements for any unauthorized transactions. "Anyone who may have used the machine is urged [to] change their PIN and closely monitor their bank statements for signs of suspicious activity," the police department recommended.
In the event of detecting fraudulent activity, individuals should contact their bank without delay and also notify the Chelmsford Police Department. This dual reporting approach ensures that financial institutions can freeze accounts if necessary and that law enforcement can investigate potential broader patterns of crime.
The discovery comes amid a rise in reported skimming incidents across the United States, where criminals increasingly target everyday locations like grocery stores and gas stations for their high foot traffic. According to the Federal Trade Commission, identity theft complaints related to payment card fraud numbered over 400,000 in 2023 alone, with skimming devices contributing to a significant portion of these cases. In Massachusetts, similar devices have been found in recent months at ATMs in Boston and surrounding suburbs, prompting heightened vigilance from local authorities.
Skimming, a form of electronic theft, involves attaching a small, often undetectable reader to the card slot of an ATM or point-of-sale terminal. These devices scrape the magnetic stripe data from debit or credit cards as they are inserted. Paired with a camera—sometimes as tiny as a pinhole—the setup allows thieves to obtain both card details and access codes, enabling them to clone cards or make unauthorized withdrawals.
While the Chelmsford case appears isolated for now, investigators are working to determine if the perpetrators are part of a larger network. The police department has not released descriptions of suspects or details on how the device was installed, citing the ongoing nature of the probe. "An investigation into Friday’s discovery remains ongoing," officials noted.
To help prevent such crimes, the Chelmsford Police Department shared practical tips for users of ATMs and card readers. "Inspect ATMs, POS terminals, and other card readers before using. Look for anything loose, crooked, damaged, or scratched. Don’t use any card reader if you notice anything unusual," the department advised in its public alert.
Further guidance includes physically testing the keypad for tampering. "Pull at the edges of the keypad before entering your PIN," police suggested, explaining that this can dislodge any overlay devices criminals might use to capture keystrokes. Users are also encouraged to shield their hand when inputting codes: "Then, cover the keypad as fully as possible when you enter your PIN to prevent cameras from recording your entry."
The department highlighted the risk of hidden cameras, noting that they could be concealed anywhere nearby. "Keep in mind that a pinhole camera may be present anywhere on or around the terminal," the alert warned. Opting for safer environments can reduce risks as well: "If possible, use ATMs in a well-lit, indoor location. These may still be compromised, but are less-vulnerable targets."
Hannaford Supermarket, a regional chain with over 180 stores primarily in the Northeast, has not issued a specific statement on the incident beyond cooperating with authorities. Store management reportedly removed the ATM from service immediately upon notification and is assisting in the investigation. Customers who frequent the Chelmsford location expressed surprise but appreciation for the quick alert, with one shopper, who declined to give her name, saying she had used the machine just days earlier and planned to check her accounts right away.
This event underscores broader challenges in securing public financial access points. Experts from the banking industry, such as those at the American Bankers Association, have long advocated for contactless payment options and chip-enabled cards as deterrents to skimming. In Massachusetts, state lawmakers have considered legislation to mandate anti-skimming technology on all public ATMs, though no such bill has passed into law yet.
Related incidents in the state provide context for the Chelmsford discovery. Last month, a skimming ring was busted in nearby Lowell, where police recovered dozens of cloned cards from a suspect's vehicle. In that case, authorities linked the operation to Eastern European crime groups, a pattern seen in several U.S. skimming cases. While no such connection has been alleged here, the similarities in modus operandi have local officials on high alert.
As the investigation progresses, Chelmsford police are appealing to the public for tips. Residents are encouraged to report any suspicious behavior around ATMs or unusual ATM appearances. The department's warning serves as a timely reminder in an era where digital transactions are ubiquitous, yet physical vulnerabilities persist.
Beyond immediate victim support, the incident highlights the need for technological upgrades. Many banks now offer virtual card numbers or app-based ATM access to bypass traditional skimmers. For those without such options, vigilance remains key. As one cybersecurity expert from Northeastern University, not directly involved in this case, noted in a recent interview, "The best defense is awareness— a few seconds of caution can save thousands in losses."
In the coming days, authorities expect to provide updates on the investigation, potentially including forensic analysis of the recovered devices. For now, the focus is on protecting the community and preventing further incidents. Shoppers at the Drum Hill Road Hannaford are returning to their routines, but with a newfound wariness toward the once-routine task of withdrawing cash.
The broader implications extend to consumer trust in retail environments. Grocery stores like Hannaford, which often host third-party ATMs to convenience customers, must balance accessibility with security. Industry analysts predict that such breaches could accelerate the shift toward cashless societies, though rural and suburban areas like Chelmsford may lag behind urban centers in adoption.
Ultimately, this story is a microcosm of evolving cyber threats in everyday life. While the exact number of affected individuals in Chelmsford remains unknown, the prompt detection by the maintenance worker likely averted widespread harm. As police continue their work, the message is clear: Stay alert, verify, and report.