Card shimming is a form of payment fraud in which a paper-thin device is hidden inside a chip card reader to intercept data from your EMV chip as you insert your card. The device sits between your chip and the reader’s metal contact pins, invisible from the outside, and captures your account number and expiration date. It cannot clone a working chip card, but criminals use the stolen data to encode counterfeit magnetic stripe cards that may still be accepted at terminals allowing swipes.
What a Shimmer Is
A shimmer is a flexible circuit board built on polyimide film, roughly as thin as a sheet of paper. It carries a small microprocessor and a flash memory chip that can store intercepted data from dozens or hundreds of transactions. Once installed behind the reader’s gold-plated contact pins, it draws power from the terminal itself during each transaction, so there is no battery to die.
When you insert your card, the shimmer passively monitors the electronic exchange between your chip and the reader. It captures Track 2 equivalent data: your primary account number and expiration date. The criminal later returns with a specially programmed download card to pull the stored records, or in some setups the shimmer transmits data over Bluetooth to a device nearby.
What Criminals Can and Can’t Do With the Data
The good news is that shimming is far less powerful than old-school magnetic stripe skimming. Your chip generates a unique, one-time authentication code for every transaction. That code cannot be reused or predicted, so a criminal who captures a chip transaction cannot replay it to authorize another chip purchase. Cloning a working chip card from shimmed data is not possible with current technology.
What criminals can do is encode the stolen account number and expiration date onto a counterfeit magnetic stripe card. The chip and the stripe share some overlapping information, which is why this works at all. Chip cards do carry a separate verification value called the iCVV that differs from the CVV on your physical magnetic stripe, and banks that properly check for this distinction will decline a swipe that presents the wrong value. When issuers skip that check, counterfeit stripe cards made from shimmed data can succeed at terminals that still accept swipes.
Shimmed data does not include the three-digit code printed on the back of your card, which most online merchants require. That limits its usefulness for online shopping, though some merchants with weaker verification may not ask for it. Stolen U.S. credit card records with basic account details typically sell on dark web marketplaces for $10 to $40 per card, with higher-limit accounts commanding more.
Where Shimmers Usually Turn Up
Unattended terminals are the primary targets because they give criminals the privacy to install a device without being noticed. Gas station pumps top the list. They handle high transaction volumes, sit outdoors with minimal surveillance, and many still run older hardware with enough physical clearance in the card slot for a shimmer to fit. ATMs in low-traffic locations such as convenience stores and standalone kiosks are close behind.
Self-service kiosks for parking, transit tickets, and vending machines face similar risk. They are inspected infrequently and process hundreds of transactions a day. Commercial fleet cards add another layer: many still rely on magnetic stripe technology rather than EMV chips, which makes them vulnerable to both skimming and shimming at the fuel terminals where fleet vehicles refuel.1Visa. Car IQ: Cardless Fleet Payments
How to Spot a Compromised Reader
Shimmers are designed to be invisible, so there is no foolproof visual test. But a tampered terminal often shows physical symptoms worth checking before you insert your card.
- Unusual resistance. If your card feels stuck, requires extra force, or does not slide in smoothly, a shimmer may be narrowing the slot.
- Repeated errors. If the reader rejects your card or asks you to re-insert multiple times, a misaligned shimmer could be interfering with the chip contacts.
- Wobble or looseness. Give the reader housing a gentle tug. A legitimate reader is firmly attached; any movement or separation suggests tampering.
- Visual mismatches. Compare the slot to other terminals nearby and look for differences in color, alignment, or plastic. At gas stations, check whether the security seal near the card reader shows “void,” which means the pump panel has been opened.
- Slot misalignment. A slight bulge around the bezel or a gap between the slot and the terminal housing can indicate a device has been inserted.
None of these signs is conclusive on its own. If you notice more than one, use a different terminal and report the suspicious reader to the business and your bank.
Pay in a Way That Bypasses the Slot
The simplest way to avoid shimming is to never insert your card into the reader. Contactless payments, whether you tap your physical card or use a mobile wallet, transmit payment data wirelessly through near-field communication. Your card never enters the slot, so it never touches a shimmer’s contacts. The physical point of compromise does not exist.
Mobile wallets such as Apple Pay, Google Pay, and Samsung Pay add a second layer of protection through tokenization. Instead of transmitting your actual 16-digit card number, the wallet substitutes a token, a stand-in number that is useless if intercepted. Your real account number is never shared with or stored by the merchant.2Mastercard. Tokenization Explained: Protecting Sensitive Data and Strengthening Every Transaction Each mobile wallet transaction also generates a one-time cryptographic code, and the payment requires on-device authentication through a fingerprint, face scan, or passcode. Even if someone intercepted both the token and the cryptogram, they would be single-use and worthless for a second transaction.
Where contactless is not available, an ATM operated by your own bank inside a branch is significantly safer than a standalone machine. Indoor ATMs are monitored more frequently and are harder for criminals to access.
What to Do If Your Card Is Compromised
Speed matters. If you notice unauthorized charges or suspect your card was used at a tampered terminal, act immediately.
- Lock your card. Most banking apps let you freeze a debit or credit card instantly from your phone, which blocks new transactions while you sort things out. Locking the physical card does not automatically lock any linked virtual cards or digital wallet entries, so freeze those separately if needed.
- Call your bank. Report the unauthorized charges directly. For debit cards, reporting within two business days limits your liability to $50 at most. Waiting longer than 60 days after your statement is sent can leave you liable for the full amount of subsequent unauthorized transfers.3eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
- Request a new card. A freeze is a stopgap. A replacement card with a new number is what makes the compromised data useless.
- File a report at IdentityTheft.gov. The FTC’s official portal generates a personalized recovery plan and an identity theft report you can use when disputing charges with creditors or filing a police report.4IdentityTheft.gov. IdentityTheft.gov
- Monitor your statements. Criminals often test a stolen card with a small charge before making larger purchases. Watch for unfamiliar transactions of any size for several months.
What You Could Owe for Unauthorized Charges
Federal law caps what you owe for unauthorized card use, and card network policies often eliminate your liability entirely. For credit cards, the Truth in Lending Act caps your exposure at $50 regardless of when you report.5Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card Debit cards follow different rules under Regulation E: report within two business days and your loss is capped at $50, but waiting beyond 60 days after receiving your statement can leave you responsible for the full amount of transfers that occur after that window closes.3eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
In practice, both Visa and Mastercard offer zero-liability policies that go beyond the federal minimums, covering unauthorized transactions on U.S.-issued cards processed through their networks at no out-of-pocket cost to you.6Visa. Zero Liability These policies have conditions: you need to have taken reasonable care with your card and must notify your bank promptly. Certain commercial cards, prepaid cards, and transactions not processed through the respective network may not qualify. The gap between the $50 statutory cap and true zero liability rarely matters for individual consumers, but it is one more reason to call your bank the moment something looks wrong.