Card skimming is one of the oldest forms of financial cybercrime, yet it remains stubbornly effective. The U.S. Secret Service estimates that card skimming costs consumers and financial institutions over $1 billion annually. Despite the widespread rollout of EMV chip cards, skimming attacks have adapted — and in some ways, grown more sophisticated.
How Card Skimming Works
At its core, a card skimmer is a data-capture device installed over or inside a legitimate card reader. When you insert or swipe your card, the skimmer reads the magnetic stripe data and stores it. A hidden camera or PIN pad overlay captures your PIN. With those two pieces of data, criminals can create cloned cards and drain your account.
Overlay Skimmers
The most common type is the overlay skimmer — a plastic shell designed to fit precisely over the legitimate card reader. These are manufactured to match specific ATM models and are frighteningly convincing. They are typically glued or clipped in place and can be retrieved by the criminal within hours.
Signs of an overlay skimmer:
- The card slot wiggles or feels loose
- The card slot protrudes further than expected
- Colors or materials don’t quite match the rest of the machine
- The overall card slot looks bulkier than similar machines nearby
Shimming — Attacking EMV Chips
The chip-and-PIN rollout was supposed to end card fraud. It didn’t. Criminals responded with shims — ultra-thin circuit boards inserted directly into the card slot, sitting between the chip reader and the card. The shim reads data off the chip during a legitimate transaction.
However, shims collect slightly different data than magnetic stripe skimmers. The chip transaction data is not directly replayable in the same way. Shim data is primarily useful for creating magnetic stripe clone cards — which only work at merchants that still accept swipe. This is increasingly limiting, but still exploitable in some regions and online transactions where no chip verification is required.
Deep Insert Skimmers
More advanced than overlays, deep insert skimmers are inserted entirely inside the card reader throat — invisible from the outside. These are harder to detect visually and are increasingly favored by sophisticated criminal groups. They require specialized tools to install but are also harder for ATM technicians to notice during routine maintenance.
Hidden Cameras and PIN Capture
Capturing the card data is only half the equation — criminals also need your PIN. Methods include:
- Micro-cameras mounted in false panels above the keypad, in brochure holders, or in fake bezels
- PIN pad overlays — a thin membrane placed over the real keypad that records keypresses
- Thermal imaging — in lab settings, researchers have shown that heat signatures on keypad buttons reveal recently pressed keys, though this is rarely used in practice
What to Look For at the ATM
Before using any ATM, spend five seconds on a quick physical inspection:
- Wiggle the card reader: Legitimate readers are firmly attached. If it moves, don’t use it.
- Cover the keypad when entering your PIN: Even if there’s no camera visible, use your other hand as a shield.
- Compare to neighboring ATMs: If one machine looks different from others of the same brand, investigate why.
- Check for unusual attachments: Look at the top of the machine, in brochure holders, and along the keypad bezel.
- Choose ATMs in high-visibility locations: Bank lobbies and busy areas are harder for criminals to tamper with unnoticed.
| ATM Type | Relative Risk Level |
|---|---|
| Bank branch lobby (with cameras) | Low |
| Bank branch exterior (24/7 vestibule) | Low–Medium |
| Freestanding retail ATM (convenience store) | Medium–High |
| Gas station pump card reader | High |
| Nightclub or bar ATM | Very High |
Gas Pump Skimmers
Point-of-sale terminals at gas stations are particularly vulnerable. The physical housing locks with a universal key that many criminals have obtained, and the interior is easily accessible. Bluetooth-enabled skimmers at gas pumps transmit stolen card data wirelessly, meaning criminals never need to return to the device.
When paying at the pump:
- Use the terminal closest to the attendant’s window, where tampering is harder
- Choose credit over debit — credit cards have stronger fraud protections and don’t drain a bank account
- Pay inside when possible
- Check if the security tape on the pump panel is intact (many stations use this)
Contactless Payment and Why It’s Safer
Tap-to-pay (NFC) transactions — Apple Pay, Google Pay, contactless debit/credit cards — are substantially more resistant to skimming:
- The card number transmitted is a tokenized one-time code, not your real card number
- There is no magnetic stripe interaction
- A physical skimmer cannot capture usable data from an NFC transaction
- Deep insert skimmers only affect inserted cards
This is one of the clearest cases where adopting newer technology directly reduces your attack surface. If your bank or card supports tap-to-pay, use it by default.
If You Suspect You’ve Been Skimmed
- Don’t use the ATM — report it to the bank or business immediately and note the machine’s location
- Contact your bank as soon as you notice unauthorized transactions
- Request a card replacement — banks typically issue new cards quickly in fraud cases
- File a police report — this creates documentation for potential fraud recovery
- Monitor your accounts for 30–60 days, as stolen data is sometimes sold and used weeks after capture
The best defense against card skimming is a combination of physical awareness, behavioral habits (covering the PIN pad, preferring chip or tap), and account monitoring. Criminals count on inattention — a five-second inspection habit is enough to disrupt most skimming attacks.