Texas credit card skimming — Penal Code § 32.315 & § 31.17

Verified Credentials

Reggie & Njeri London
Co-Founding Partners

Texas Bar verified. Reggie London (Texas Bar No. 24043514) and Njeri London (Texas Bar No. 24043266) are the co-founding partners of L and L Law Group, PLLC — based at 5899 Preston Rd, Suite 101 in Frisco, Texas (Collin County), with many 5-star Google reviews, and available 24/7 for criminal defense consultations.

If you have been arrested or contacted about a credit card skimming case in Texas, the criminal defense team at L and L Law Group, PLLC handles fraud and financial-data cases across Collin County, Dallas County, Denton County, and Tarrant County. Co-founding partners Reggie London (Texas Bar No. 24043514) and Njeri London (Texas Bar No. 24043266) take these cases personally — there is no associate or paralegal screening clients out before you speak with a lawyer. Skimming prosecutions are unusually document- and device-heavy, and the way the State counts the evidence often decides whether a case is a misdemeanor, a state jail felony, or a first-degree felony.

What is the current Texas law on credit card skimming?

There is no Texas offense literally titled “credit card skimming.” Instead, the conduct people describe as skimming — attaching a hidden reader to a gas pump, ATM, or point-of-sale terminal, or swiping a card through a handheld reader to steal its data — is prosecuted under two separate Penal Code sections that reach different stages of the same scheme.

Penal Code § 31.17, Unauthorized Acquisition or Transfer of Certain Financial Information, targets the capture step. The statute provides^[1]:

(b) A person commits an offense if the person, knowing that the person is not entitled to obtain or possess that financial information: (1) obtains the financial sight order or payment card information of another by use of an electronic, photographic, visual imaging, recording, or other device capable of accessing, reading, recording, capturing, copying, imaging, scanning, reproducing, or storing in any manner the financial sight order or payment card information; or (2) transfers to a third party information obtained as described by Subdivision (1). (c) An offense under Subsection (b)(1) is a Class B misdemeanor. An offense under Subsection (b)(2) is a Class A misdemeanor.

In plain terms, § 31.17 is the “used a skimmer to grab the data” statute. It covers the person who mounts the device, swipes cards through a reader, or otherwise captures the information from either side of a check, a magnetic stripe, or a card. Simply capturing the data is a Class B misdemeanor; passing that captured data to someone else bumps it up to a Class A misdemeanor.

Penal Code § 32.315, Fraudulent Use or Possession of Credit Card or Debit Card Information, targets what happens to the data after it is captured. This 2019 statute (added by House Bill 2625, effective September 1, 2019) provides^[2]:

(b) A person commits an offense if the person, with the intent to harm or defraud another, obtains, possesses, transfers, or uses: (1) a counterfeit credit card or debit card; (2) the number and expiration date of a credit card or debit card without the consent of the account holder; or (3) the data stored on the digital imprint of a credit card or debit card without the consent of the account holder.

Section 32.315 is the felony that reaches possession of stolen card numbers, cloned or “re-encoded” cards, and the data lifted from a magnetic stripe. It is the statute most often charged when police recover a device loaded with dozens of account numbers, a stack of counterfeit cards, or an encoder used to write stolen data onto blank plastic. Because it grades by the number of items, a single skimming operation can be charged anywhere from a state jail felony to a first-degree felony.

The two statutes frequently appear together. A person caught mounting a pump skimmer and holding a phone full of captured numbers may face a § 31.17 misdemeanor for the capture and a § 32.315 felony for possessing the resulting data. Both statutes also contain an express provision allowing the State to prosecute under Texas law, another law, or both — which is how federal access-device charges enter the picture.

What is the penalty for credit card skimming in Texas?

Because two statutes are in play, there are two separate punishment structures. The § 31.17 misdemeanor grading and the § 32.315 felony ladder are set out below.

§ 31.17 — using a device to capture card data

Section 31.17 grades the offense by which act occurred — capturing versus transferring — not by dollar amount or card count^[1]:

The misdemeanor grading reflects that § 31.17 punishes the capture itself, independent of whether any fraudulent purchase was ever completed. The felony exposure in most skimming cases comes from § 32.315, below.

§ 32.315 — possessing, transferring, or using captured card information

Section 32.315(e) sets a four-step felony ladder keyed to the number of items obtained, possessed, transferred, or used^[2]:

An “item” is a counterfeit card, or a card number-and-expiration pair, or a set of stripe/digital-imprint data possessed without the account holder's consent. Because the count sets the felony level, how the State tallies items is one of the most consequential — and most contestable — parts of a skimming prosecution. A phone that appears to hold “50 numbers” may contain duplicates, test entries, the defendant's own cards, incomplete fragments that do not meet the statute's “number and expiration date” requirement, or data belonging to no identifiable account holder. Each of those can move a case down the ladder.

Section 32.315 also carries a rebuttable presumption: under subsection (c), possessing five or more number/stripe items creates a presumption that they were possessed without the account holders' consent. “Rebuttable” means the defense can introduce evidence to overcome it, and subsection (d) exempts legitimate businesses and government agencies acting lawfully. Subsection (f) authorizes restitution for a victim's lost income or expenses (other than attorney's fees) resulting from the offense.

As with any Texas offense, the punishment actually imposed can be well below the statutory maximum — through plea negotiation, reduction to a lesser count, deferred adjudication, probation, or pretrial diversion. Whether probation or deferred adjudication is available depends on the felony level and the defendant's criminal history.

What the State must prove

Each statute has distinct elements, and the State must prove every element beyond a reasonable doubt.

Under § 31.17, the State must show that the defendant (1) knew he was not entitled to obtain or possess the financial information, and (2) either used a capture-capable device to obtain another person's payment-card or sight-order information, or transferred information so obtained to a third party. The knowledge element — knowing you are not entitled to the data — is central; a person who reasonably believed the transaction was authorized has not committed this offense.

Under § 32.315, the State must prove (1) an intent to harm or defraud another, and (2) that the defendant obtained, possessed, transferred, or used a counterfeit card, a card number-and-expiration pair without consent, or the data from a card's digital imprint without consent. The mens rea — the specific intent to harm or defraud — is what separates a chargeable offense from innocent possession. Merely having a card number written down, without that intent, is not a § 32.315 offense. The felony level is then a sentencing question driven by the item count under subsection (e).

The defense lawyer's job is to identify where the State's proof falls short of any required element — whether that is intent, knowledge, consent, or the count itself. In device cases, the “possession” element also raises questions of who actually controlled the device and its data, which forensic attribution does not always answer cleanly.

How § 32.315 differs from credit card abuse and identity theft

Skimming cases sit at the intersection of three overlapping Chapter 31 and Chapter 32 offenses. Understanding the distinctions matters because the State often charges more than one, and the right defense depends on which statute actually fits the facts.

• Credit card abuse — Penal Code § 32.31. Section 32.31 covers using or presenting an actual, physical card without the cardholder's effective consent to fraudulently obtain a benefit. It is about the card as a payment instrument. Section 32.315, by contrast, is about the information — the numbers, the stripe data, and counterfeit cards. When someone runs a cloned card, prosecutors may charge both.
• Fraudulent use of identifying information — Penal Code § 32.51. The identity-theft statute reaches a broader set of “identifying information” — names, dates of birth, Social Security numbers, biometric data — and grades by the number of items of identifying information. Card data can qualify as identifying information, so a skimming operation can be charged under § 32.51 as well as § 32.315, and defense counsel must watch for double-counting across the two ladders.
• Unauthorized acquisition — Penal Code § 31.17. As explained above, § 31.17 is the capture-stage misdemeanor. It is narrower than § 32.315 and does not require intent to defraud — only knowledge that the person is not entitled to the data.

These overlaps are not academic. A single skimmer arrest can produce a § 31.17 count for the capture, a § 32.315 felony for the recovered data, and a § 32.51 count for any identity information swept up alongside the card numbers. Sorting out which counts are supportable — and which items are being counted twice — is a core part of the defense.

Federal overlap — 18 U.S.C. § 1029

Skimming is a favorite target of federal prosecutors because the schemes so often cross state lines and involve interstate financial networks. The controlling federal statute is 18 U.S.C. § 1029, access-device fraud^[3]. Section 1029 criminalizes, among other things, knowingly and with intent to defraud producing, using, or trafficking in counterfeit or unauthorized access devices, and possessing device-making equipment — a category that squarely includes skimmers, re-encoders, and blanks used to manufacture cloned cards.

Because both Texas and federal law reach the same conduct, a defendant can face state charges, federal charges, or both. Section 32.315(g) and § 31.17(d) each expressly permit prosecution “under this section, the other law, or both.” Cases involving large card counts, multi-state activity, organized rings, or losses to federally insured institutions are the ones most likely to be adopted federally. If federal exposure is a possibility, that reality shapes strategy from the first conversation — including how, and whether, to engage with investigators. Our federal defense guide explains how the federal process differs.

What defenses are available to a credit card skimming charge?

Defenses to skimming charges fall into three categories: factual defenses (the alleged act did not happen, or did not happen as alleged), legal defenses (an element such as intent or consent is missing), and constitutional defenses (the State obtained evidence in violation of the defendant's rights). The most common defenses we raise:

• No intent to harm or defraud (§ 32.315). The felony requires specific fraudulent intent. Possession of card data explained by a legitimate reason — a merchant's records, a family member's card, data a person did not know was on a device — can defeat the intent element.
• No knowledge (§ 31.17 and possession theories). A person who did not know a skimmer was present, or did not know a phone or drive contained captured card data, lacks the knowledge the statutes require. Passengers, employees, and borrowers of vehicles or devices are frequently charged on thin knowledge proof.
• Challenging the item count. Because the felony level turns on the number of items, the defense scrutinizes every claimed “item” for duplicates, incomplete fragments that lack a required number-and-expiration pair, test data, the defendant's own accounts, and entries tied to no identifiable account holder. Knocking the count below a threshold can drop the offense an entire felony level.
• Rebutting the § 32.315(c) presumption. The presumption that five-plus items were possessed without consent is rebuttable; affirmative evidence of authorization or lawful business purpose can overcome it.
• Unlawful search and seizure. Skimming cases are built on phones, laptops, encoders, and vehicles. A warrantless or overbroad search of a device, or a stop lacking reasonable suspicion, can support a motion to suppress the very evidence the case depends on.
• Forensic attribution and chain of custody. Proving who controlled a device and its data — and that the data was not altered between seizure and analysis — is often harder than it looks. Gaps in the forensic record create reasonable doubt.
• Mistaken identity. Surveillance footage of a person at a pump or ATM is frequently low-quality, and shared devices and vehicles can put the wrong person in the frame.

The right defense depends on the specific facts and the specific evidence the State has. We evaluate every case for all three categories of defense before plea conversations begin.

Digital-forensics and counting issues

More than most offenses, a skimming case is a data case. The State's proof usually lives on seized electronics: the skimmer or reader itself, a phone or laptop used to offload numbers, an encoder used to write data to blanks, and the counterfeit cards produced. Several recurring forensic issues shape these prosecutions.

Extraction and integrity. Card data recovered from a device must be extracted with sound tools and documented, and the analysis must be reproducible. A forensic report that cannot be independently verified — or that shows the data was accessed or modified after seizure — is vulnerable on cross-examination.

What counts as an “item.” Investigators may report a raw total that inflates the true count. Duplicate captures of the same card, incomplete entries missing the expiration date required by § 32.315(b)(2), non-card data, and the defendant's own legitimately held cards should not count toward the felony threshold. Because a single card can move a case from a second-degree to a third-degree felony, this line-by-line audit is worth doing carefully.

Attribution. Shared phones, shared vehicles, and cloud-synced accounts complicate the question of who possessed the data. The government's theory that a device “belonged to” the defendant is often an inference, not a proven fact.

Payment-processor and bank records. Merchant and issuer records are frequently used to tie captured numbers to real accounts and to establish loss. Those same records can also reveal that claimed “victim” accounts were never actually compromised, undercutting both the count and any restitution demand.

Enhancements & collateral consequences

Beyond the base ranges, several factors can raise exposure or create consequences that outlast the sentence. Prior felony convictions can enhance the punishment range under the Texas habitual-offender provisions in Penal Code Chapter 12. Multiple counts — a § 31.17 misdemeanor, a § 32.315 felony, and a § 32.51 identity-theft count arising from the same operation — can be charged together and can be ordered to run consecutively in some circumstances. Federal adoption of the case, discussed above, can dramatically increase the potential sentence.

The collateral consequences are significant. A fraud conviction — particularly a felony — can affect employment in banking, retail, and any position handling money or payment systems; professional and occupational licensing; immigration status (fraud offenses are frequently treated as crimes involving moral turpitude under federal immigration law); and eligibility for certain financial services. Restitution obligations under § 32.315(f) can persist for years. Because of these downstream effects, the goal in many cases is not only to reduce the sentence but to avoid a fraud conviction on the record entirely — through dismissal, diversion, or a plea to a non-fraud offense where the facts allow.

Key legal terms

Skimmer

A concealed device attached to a card reader — at a gas pump, ATM, or point-of-sale terminal — or a handheld reader, used to capture the data stored on a card's magnetic stripe or chip.

Re-encoder / encoder

Equipment used to write captured card data onto a blank or existing card, producing a “cloned” or counterfeit card. Possession of such device-making equipment is central to both § 32.315 and federal § 1029.

Counterfeit credit or debit card

Under § 32.315(a)(1), a card that purports to be issued by an issuer that did not issue it, or that has been altered to carry a digital imprint or account information different from the issuer's — i.e., a cloned card.

Digital imprint

Under § 32.315(a)(3), the digital data placed on a card or counterfeit card — the information a skimmer captures and an encoder writes.

Rebuttable presumption

A legal assumption the fact-finder must draw unless the defense presents evidence to overcome it. Section 32.315(c) presumes that possessing five or more card-number items means they were held without consent.

Access device

The federal term under 18 U.S.C. § 1029 for a card, account number, or other means of account access; skimmers and blanks fall under “device-making equipment.”

What happens after arrest for a skimming charge?

The Texas criminal process has predictable stages. After arrest, you appear before a magistrate within 48 hours, where bond is set (see bond conditions). Because skimming cases are evidence-heavy, the early period is when device-search and counting issues are best preserved. The DA's office then makes a charging decision; for felonies, the case goes to a grand jury (see active investigations). At arraignment, you enter a plea. Discovery, forensic review, motions, and plea negotiation follow (see fighting a charge). Most cases resolve before trial — but the cases that resolve favorably are the cases where the defense was genuinely ready to try the case if necessary.

Why hire L and L Law Group for a credit card skimming case?

L and L Law Group, PLLC handles fraud and financial-data cases personally — Reggie London (TX Bar 24043514) and Njeri London (TX Bar 24043266) appear in court on every case we accept. We do not refer cases to associates or use junior attorneys to make first appearances. The same attorney you meet at the consultation is the attorney who handles your case. Njeri London's Fourth Amendment motion practice is directly relevant to the device-search issues that drive these prosecutions, and Reggie London's background as a former Dallas County Assistant District Attorney gives the defense an inside read on how the State builds and values a fraud case.

We serve clients across DFW including:

• Collin County — Plano, Frisco, McKinney, Allen, Wylie
• Dallas County — Dallas, Garland, Irving, Mesquite, Carrollton
• Denton County — Denton, Lewisville, Flower Mound, Carrollton, Highland Village
• Tarrant County — Fort Worth, Arlington, Grand Prairie, Mansfield, North Richland Hills

Call (972) 370-5060 for a free, direct-to-attorney consultation. Email info@landllawgroup.com if calling is not safe right now.

Frequently asked questions about credit card skimming in Texas

About the Authors

Njeri London

Co-Founding Partner

Texas Bar No. 24043266. Admitted: TXND, TXED, 5th Circuit. Thurgood Marshall School of Law. Focus: Fourth Amendment motion practice, drug-crime defense, federal cases. Verify on Texas Bar

Read full bio →

Reggie London

Co-Founding Partner

Texas Bar No. 24043514. Former Dallas County Assistant District Attorney. Extensive felony trial experience including fraud and financial-crime dockets. Verify on Texas Bar

Read full bio →