What Is Card Skimming and How Can You Avoid It?

What Is a Card Skimmer?

A card skimmer is a device criminals use to secretly capture information from a credit or debit card's magnetic stripe. Skimmers can be installed over or inside credit card readers at ATMs, point-of-sale terminals, gas station pumps or other payment terminals. The stolen information may later be used to make fraudulent purchases or create counterfeit cards.

How Does Card Skimming Work?

Card skimming has been a problem for years, but the methods have evolved over time. As ATM and POS operators develop new ways to catch or block skimmers, criminals respond with new techniques and skimming devices.

Here's an overview of how card skimming works.

1. Device Installation

Criminals install a skimming device on top or inside a credit card reader to capture your card information. Some of these are very small and well hidden, and you might insert or swipe your card without ever realizing the skimmer is there.

Sometimes a hidden camera is installed near the keyboard or a thin overlay is placed on top of the keypad to capture keyed information.

2. Data Interception

When you swipe or insert your credit card, the device captures information from the card through the magnetic stripe. Your name, card number and expiration date might be compromised.

Any hidden cameras can record the PIN that you enter.

3. Data Retrieval

Depending on the type of skimmer, the criminals may retrieve stolen data by physically retrieving the skimming device or a device connected to the payment terminal or by using a wireless connection to transmit the information.

4. Fraudulent Exploitation

Once criminals have obtained the stolen information, they can then create counterfeit credit cards that may be used to make fraudulent purchases or potentially withdraw cash from an ATM. Thieves may also sell the information online.

Card Skimming vs. Shimming

Skimming devices capture data from a card's magnetic stripe. As chip cards have become more widely used and fewer credit cards are swiped, criminals have developed so-called card shimming devices. These devices are inserted inside the card reader and intercepts data from the chip during the transaction. Shimming devices are often more difficult to detect because they're smaller and not as visible.

Since magnetic stripes contain static card information, criminals can use skimmers to simply copy the card data and make a counterfeit card. On the other hand, EMV chips generate dynamic transaction data, so unlike card skimmers, shimming devices don't simply copy everything from the magnetic stripe. Some of the captured information can potentially be used for fraud, but criminals can't create a copy of the original chip.

Where Are Card Skimmers Found?

Criminals often target payment terminals that are located outdoors or unattended, where they may be able to install a skimmer without being noticed. Card skimmers can be attached to or installed inside legitimate card readers, which makes them difficult to detect.

Card skimmers are most commonly found on:

• Gas pumps
• ATMs
• Vending machines and kiosks
• Parking meters

How to Spot a Card Skimmer

Card skimmers aren't always easy to spot, but there are a few warning signs to watch out for before using an ATM, gas pump or other payment terminal:

• Loose or wobbly card reader: Gently wiggle the card reader or keypad. It shouldn't move or feel as though it has been placed over something else.
• Bulky or unusually thick reader: An external skimmer placed on top of the existing credit card reader may make the reader appear larger or thicker than usual.
• Mismatched parts: Compare the card reader and keypad with those at nearby terminals. Different colors, materials or parts could indicate that a part has been replaced.
• Raised or unusual keypad: If the keypad feels thick or the numbers appear raised, an overlay may have been placed over the keypad to capture information you enter.
• Broken security seal: Some gas stations use a special security seal tape on their pumps. Don't use a pump if the seal is broken or displays a void warning.

How to Avoid Card Skimming

You can look for card skimming devices whenever you use your card at an ATM, gas pump or another payment terminal. However, you can't rely on detection alone to spot skimmers because some are installed inside the terminal and can't be seen from the outside.

Still, there are several steps you can take to protect yourself and reduce your risk of card skimming.

• Use contactless payment. Tapping your digital wallet or contactless card can be safer than inserting or swiping your card because contactless transitions use secure information.
• Insert the chip rather than swiping. Chip transactions are generally safer than magnetic-swipe transactions because EMV chips generate data that's more difficult for criminals to use to create counterfeit cards. If a terminal asks you to swipe a chip card instead of inserting it, consider using another payment method or a different terminal.
• Inspect the terminal. Before inserting or swiping your card, check the card reader and keypad for signs of tampering. If something looks unusual or doesn't feel securely attached, don't use the terminal.
• Choose the credit option for debit cards. When you have the option to run a debit card as credit, you typically won't have to enter your PIN, which protects your bank account from unauthorized ATM withdrawals.
• Pay inside. If a gas pump looks suspicious or you don't feel comfortable using it, pay inside rather than inserting or swiping your card at the pump. Paying inside allows you to use a payment terminal that's monitored by employees.
• Use ATMs in secure locations. Bank-owned ATMs or those located inside well-monitored locations are often more secure. Standalone machines that you find in places like convenience stores are at higher risk of tampering since they're less monitored.
• Cover the pad when entering your PIN. Place your hand over the keypad as you enter your PIN to prevent a hidden camera from seeing it. Note that covering the keypad isn't completely foolproof because a keypad overlay could potentially record what you type, but this step can keep cameras (as well as shoulder surfers) from recording what you type.

Tip: Sign up for bank alerts to receive a notification when there's a new transaction on your account. The alerts can help you act quickly if someone uses your card's info to make fraudulent purchases.

How to Know if Your Card Has Been Skimmed

Skimming doesn't damage your physical credit card, so you may not know your card has been skimmed until you spot fraudulent activity days or weeks later. Criminals may not use stolen card information right away which can make it harder to determine when or where your card information was compromised.

Warning signs that your card may be affected include:

• Transactions you don't recognize: If your authorized transactions appear on your credit card or bank statement after using it at a gas station or ATM, it's possible that your card was skimmed.
• Small or unusual charges: Criminals may test stolen card information by making small transactions before attempting larger purchases. Don't ignore an unfamiliar purchase because the amount is small.
• Unexpected declines: An unexpected decline can sometimes occur if your card issuer detects suspicious activity and places a temporary restriction on your account.
• Email or text alerts about payments you never made: Your card issuer may detect suspicious charges and alert you before you notice them yourself. Transaction alerts can help you identify and report fraudulent activity quickly.

If you notice any of these warning signs, contact your card issuer right away and review your recent transactions for other unauthorized activity.

Learn more: Ways to Protect Yourself From Identity Theft

What to Do if You're a Victim of Card Skimming

You might not realize that someone has skimmed your card until days or weeks later. But if you notice any unusual transactions on your credit card, bank account or EBT account, contact the financial institution or your state's benefits agency as soon as possible. You don't have to know exactly how your card information was stolen before reporting suspicious activity.

• Lock or freeze the card. Many banks and card issuers allow you to temporarily freeze your card online or through a mobile app. This prevents future unauthorized transactions while you determine what happened and contact your bank.
• Review recent transactions. Look through your recent account activity and identify any transactions you don't recognize. Highlight these so you can report them to your bank or card issuer.
• Contact your bank or card issuer. Report your compromised card and any unauthorized transactions as soon as possible. Your card issuer can cancel the compromised card number, issue a replacement card with a new number and investigate disputed transactions.
• Change your PIN if you suspect it was captured. If you entered your PIN at a compromised ATM or payment terminal, change it as soon as possible. This can prevent criminals from using a stolen PIN to access money in your bank account.
• Update recurring payments after replacing the card. If your card issuer sends a replacement card with a new number, update recurring payments and subscriptions that were linked to your old card. You may also need to update your card information in digital wallets.
• Keep monitoring the account. Continue checking your credit card and bank account for unauthorized transactions, even after you've reported the initial fraud. Report additional suspicious activity to your bank immediately.
• Check for signs of identity theft. If you suspect your personal information was compromised in addition to your card information, review your credit reports for accounts you didn't open or inquiries you didn't initiate.

Keep in mind that unauthorized transactions don't always mean your credit card was skimmed. Since card information can be stolen in several ways, including data breaches and phishing scams, it can be difficult to determine exactly how your card information was stolen.

Learn more: What Happens When You Lock Your Credit Card?

The Bottom Line

While credit card skimmers aren't always easy to spot, you can lower your risk by using contactless payments or inserting your card instead of swiping it. It's also important to monitor your account regularly and report suspicious transactions to your card issuer immediately.

Experian's free credit monitoring is one way to stay on top of your credit. You can spot changes to your credit quickly and respond to potential identity theft early to protect yourself.