Illegal card-reading devices are increasingly being used to intercept and record data stored on magnetic strips on credit cards when people use the cards to buy gas, Litan said. The skimming devices, which have very small footprints, are sometimes linked to the internal wiring of gas pumps; at other times, they are placed externally on top of the regular card readers, where they are hard to notice, she said.

Getting internal access to multiple gas pumps is often not hard because one key can sometimes be used to open numerous pumps made by the same manufacturer, Litan said. "All you need is one disgruntled employee" to compromise a number of systems, she said.