Card skimming works by secretly copying your payment card information while a legitimate transaction goes through as normal. Criminals do it two ways: by attaching hidden hardware to an ATM, gas pump, or checkout terminal that records your card and PIN as you use it, or by planting malicious code on an e-commerce site that captures what you type into the checkout form. Either way, your card never leaves your hand, and most people don’t find out until fraudulent charges show up on a statement. Losses to consumers and banks run over $1 billion a year.1Federal Bureau of Investigation. Skimming
Physical Skimmers on ATMs, Pumps, and Terminals
A traditional skimmer is a shell that fits over the real card slot. Inside sits a magnetic read head that copies the data on your card’s stripe as you slide the card through. The captured data is either stored on a small memory chip or transmitted wirelessly to a receiver nearby. Criminals use 3D printers and custom molds to match the color and texture of the real hardware so the overlay blends in.
Cloning a card for swiped purchases only needs the stripe data, but debit fraud usually requires a PIN. Criminals grab PINs two ways. One is a pinhole camera, sometimes smaller than a pea, hidden in a false trim piece above the keypad and angled to record finger movements. The other is a thin keypad overlay. It looks and feels like the real buttons, but a pressure-sensitive circuit underneath logs every digit you press. Timestamps let the criminal match each PIN to the corresponding card swipe.
Location matters as much as the device. Gas pumps are a favorite target because the card reader sits far from the cashier’s view and pump cabinets often use universal keys that are easy to obtain. Standalone ATMs in vestibules, convenience stores, and on sidewalks see hundreds of card reads a day from people who don’t inspect the machine. Point-of-sale terminals inside retail stores are harder to reach, but a compromised employee or a distracted shift change can be enough, and a skimmer on a checkout terminal collects from every customer who pays there.
Shimming: Skimming Chip Cards
EMV chip cards made stripe skimming harder, so criminals adapted. A shim is a paper-thin flexible circuit that slides inside the reader slot and sits between your chip and the terminal’s chip contacts. Because it lives entirely inside the machine, there’s nothing visible from outside.
A shim can’t fully clone a chip; each chip transaction generates a unique code that won’t replay. What it captures is often enough to build a magnetic-stripe counterfeit that still works at older terminals that accept swipes. As swipe-only readers disappear, shimming becomes less useful, but it hasn’t gone away.
Digital Skimming on Websites
Online skimming uses no hardware at all. In attacks often called Magecart or formjacking, criminals inject malicious code into the checkout pages of e-commerce sites. As you type your name, card number, expiration date, and security code, the script copies each keystroke and sends it to a server the attacker controls. The real payment still processes normally, so nothing about the experience feels wrong.
These attacks frequently arrive through compromised third-party scripts: payment widgets, analytics tools, or chat features that a site loads from an outside vendor. Compromise the vendor once and every site using that script becomes a target. That is why a single incident can expose card data from dozens of merchants at the same time.
How to Spot a Skimmer Before You Pay
Physical skimmers survive because nobody looks for them. A few seconds of inspection changes that.
At ATMs and Gas Pumps
Grip the card reader housing and give it a firm wiggle before you insert your card. A legitimate reader is bolted in place and won’t shift or flex. If anything feels loose, bulky, or misaligned compared to the machine next to it, walk away and report it. Run your fingers along the edges of the keypad too. An overlay usually feels thicker or sits slightly higher than the surrounding surface.
At gas pumps, look for the security seal on the pump cabinet panel. An intact seal means the panel hasn’t been opened; a broken seal or one that reads “void” is a sign someone has been inside.2Federal Trade Commission. Best Practices to Foil Gas Station Skimmers When in doubt, pay inside at the register.
Use Contactless Payments When You Can
Tap-to-pay cards and mobile wallets like Apple Pay and Google Pay use tokenization: the terminal never receives your real card number, only a one-time code that is useless to anyone who intercepts it. Because your card never enters a reader slot, neither skimmers nor shims have anything to capture. If a terminal supports contactless, that is the safest option available to you.
When You Shop Online
Digital skimming is harder to catch because the malicious code runs invisibly in your browser. Stick with well-known retailers, and be suspicious if a checkout page suddenly looks different or asks for information it didn’t before. Many card issuers offer virtual card numbers that expire after one use, which limits your exposure if the site is compromised. Keeping your browser and its extensions current helps too, since some security tools flag known malicious scripts.
What You Owe if Your Card Gets Skimmed
Federal law caps your liability for unauthorized charges, but the rules for credit cards and debit cards are very different, and the gap is big enough to change how fast you need to act.
Credit Cards
Your maximum liability for unauthorized credit card charges is $50, and only for charges made before you report the card compromised.3Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card Once you notify the issuer, you owe nothing for anything that hits the account after that. Most major issuers waive even that $50 as a matter of policy.
Debit Cards
Debit card liability is time-sensitive and comes in three tiers under the Electronic Fund Transfer Act:
- Report the loss or theft within two business days of learning about it, and your liability caps at $50.
- Miss the two-day window but report within 60 days after your statement is sent, and your liability can reach $500.
- Wait longer than 60 days after the statement, and you can be liable for the full amount of any unauthorized transfers made after that deadline.
The money leaves your checking account immediately, and your ability to get it back depends on how quickly you speak up.4Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability If circumstances like hospitalization or extended travel kept you from reporting on time, your bank must extend those deadlines to a reasonable period.5Consumer Financial Protection Bureau. Regulation E 1005.6 – Liability of Consumer for Unauthorized Transfers
Once you report unauthorized debit transactions, your bank generally has 10 business days to investigate. It can extend that to 45 days, but only if it provisionally credits your account within the initial 10 days so you’re not without your money during the review.6eCFR. Electronic Fund Transfers – Regulation E
What to Do if You’ve Been Skimmed
Speed matters, especially with debit. These steps protect the money still in the account and build the paper trail you may need if the fraud spreads.
- Contact your bank or card issuer right away. Report the unauthorized charges and ask for a new card number. Most banks waive replacement fees when the card was compromised, though rush delivery may cost $5 to $30. Freeze or lock the card in your bank’s app while you wait on hold to stop further charges.
- File a report with the FTC at IdentityTheft.gov or by calling 1-877-438-4338. The site produces an Identity Theft Report and a personalized recovery plan. Print and save both, and create an account so you don’t lose access when you leave the page.7Federal Trade Commission. Identity Theft Steps
- Consider a local police report. It isn’t always required, but it strengthens disputes with banks and creditors. Bring your FTC Identity Theft Report, a government-issued photo ID, proof of address, and any evidence of the unauthorized charges.7Federal Trade Commission. Identity Theft Steps
- Review your statements and pull your free annual credit reports. Skimming sometimes signals broader account compromise, so look for accounts or inquiries you don’t recognize.
- Freeze your credit if you think more than the card number was exposed. Place a security freeze with all three bureaus: Equifax (888-298-0045), Experian (888-397-3742), and TransUnion (800-916-8800). Freezes are free under federal law and stop anyone from opening new accounts in your name.8Administration for Community Living. New Law Provides Free Security Freezes, Increased Fraud Alert Protection
Most skimming cases end with a new card and a refund for the fraudulent charges. The people who get stuck in extended disputes are almost always the ones who waited too long to report, particularly on debit, where the liability clock starts running the moment your statement arrives.