Card skimming is a form of identity theft. Thieves use devices attached to ATMs, self-service gas pumps, or other card-reading devices to steal card details and PINs. This information can then be used to clone credit and debit cards, make purchases, or withdraw funds. Card skimming is a common and fast-growing crime, but you can protect yourself by understanding how skimmers work, taking action to avoid them, and detecting theft as quickly as possible if it occurs.
What Are Card Skimmers?
Skimmers are devices that read credit and debit card details. Some devices record keystrokes, others record information from the magnetic strip on your card. These devices may be used along with hidden cameras that record PINs.
Skimmers can be attached to any device that reads credit and debit cards, such as ATMs, self-service gas pumps, and automated checkout systems at convenience stores. Older devices that use a magnetic strip instead of an embedded EMV chip are particularly vulnerable. Most self-service gas pumps still use magnetic strips, and gas stations are among the most common locations for skimming.
Skimmers are designed to fit closely over or inside the original faceplate of the machine and can be very difficult to detect.
How Do Card Skimmers Work?
Understanding how card skimmers work can help you protect yourself. There are several types of skimming devices out in the wild:
- Card reader overlays fit over the card slot and read your card’s data as it’s inserted.
- PIN capture overlays are placed over the unit’s original keypad and record PINs as they are entered.
- Hidden cameras can be mounted near or beside an ATM or other card reading device.
- Fake faceplates cover the entire faceplate of the machine and may combine a card reader overlay, a PIN capture device, and a camera.
- Shimming is a new technique. Thieves insert a thin recorder in the card slot that intercepts and records the information from the embedded chip on your card. This is then used to clone a magnetic strip-style card. Shims can be inserted quickly and are very difficult to detect.
Some skimmers have to be retrieved by the thieves, others transmit information via Bluetooth, allowing thieves to download the stolen information without approaching the device. A single gas pump equipped with a skimmer can capture details of 30 to 100 cards a day.
How to Avoid Skimming
Skimmers use sophisticated devices, but you can still protect yourself if you know how to avoid exposure:
- Thieves are most vulnerable when they are installing their devices, so they tend to avoid machines where they are likely to be seen. Use ATMs and gas stations that are in busy, well-lit, easily observed areas.
- If there’s a sign directing you to use a specific ATM or gas pump, avoid it. Thieves may try to direct customers to tampered units.
- At a gas station, use the pumps that are in well-lit areas easily observed from the station’s office.
- Pay with cash when you can. Some gas stations will even give you a discount for cash payments.
- Pay inside the gas station office. Thieves are less likely to tamper with the terminals there.
- Use a chip reader rather than a swipe machine, if one is available.
- Use a mobile payment system like Google Pay, Apple Pay, or other mobile wallet apps.
- Use a credit card rather than a debit card. If your credit card details are stolen, you are often not liable for purchases made with stolen details. If your debit card details are stolen, thieves can drain your account completely and your liability is dependent on the bank.
- Before you use a card reading device, look for signs of tampering. Look for intact stickers or seals on machines. Look for glue, loose wires, or anything that looks unusual or out of alignment. Small holes or objects placed close to a machine could conceal hidden cameras. If something looks wrong, report it and don’t use the machine.
- A tampered machine may feel wrong when you use it. If the card reader slot feels loose, don’t use it. If it’s difficult to insert your card, remove it. A keypad that feels thicker or less responsive than usual may have been tampered with. If something feels wrong, stop the transaction and report it.
- Skimmer Scanner is an Android app that scans for Bluetooth signals that match the profile used by skimmers. Download the app and use it at gas stations or ATMs.
Spot a Skim Fast to Limit Damage
No matter how careful you are, you can still be a victim of identity theft. Detecting the theft quickly can help you limit the damage.
Always review your credit card and bank statements as soon as you get them. Look for suspicious charges or withdrawals. If you spot something that shouldn’t be there, contact your credit card issuer or bank immediately to report the theft.
Check your credit reports and scores regularly. An unexpected dip in your credit can be an early warning of identity theft. If you see a suspicious change in your credit, get your report and look for accounts on your record that aren’t yours or bills you didn’t incur. If you find suspect information, you’ll need to place a fraud alert on your credit report, contest the charges, report the theft, and begin the process of recovering from identity theft.
Stay Aware of Identity Theft
Card skimming is a form of identity theft. Many card skimmers will sell your data to other criminals rather than using it themselves. The information may not be used against you for weeks or months, but as long as it’s out there, you’re at risk.
Identity thieves often combine information from multiple sources, including social media profiles, directories, and other public sources, to create a detailed profile that can be used for many different financial crimes. Thieves can combine skimmed credit card details with real and fake information to create a synthetic identity in your name.
If you travel often and you regularly use unfamiliar gas stations and ATMs, you may face an elevated risk of identity theft. You might consider using a credit monitoring or identity theft protection product. Credit monitoring can alert you quickly if there’s suspicious activity. Identity theft protection carries an even more robust set of protective methods, including dark web searches that can spot any attempt to sell your details.
Credit monitoring and identity theft protection aren’t free but recovering from identity theft can be much more expensive. If you can detect theft early, or even detect the sale of your information before it’s used, you could save yourself a large amount of money and an enormous amount of time and trouble. If you think you face an elevated risk of card skimming or other identity crimes, credit monitoring or identity theft monitoring could be a worthwhile investment.
