How Does Credit Card Skimming Work?

Credit card skimming is a form of fraud in which a thief hides a skimmer (a small device fitted over a real card reader) to copy the data on your card's magnetic stripe, while a tiny camera or fake keypad captures your PIN. The stolen details are used to clone your card. Inserting the chip or tapping to pay largely defeats it.

Every card transaction, whether you are buying gas, grabbing cash at an ATM, or tapping at a checkout, comes with a little flicker of unease. For some, it is watching the balance drop. For most, though, it is the quieter fear of losing personal data, and with it your hard-earned money.

That fear is not paranoid. Anyone who gets hold of your card number and PIN can drain your account, leaving you a lot more broke than you were yesterday. According to the FBI, skimming alone costs banks and consumers more than $1 billion a year.

But how would a stranger get your card details in the first place? There are several ways, and credit card skimming is one of the most common.

What Is Credit Card Skimming?

Credit card skimming is a type of credit card fraud in which a thief uses a hidden device to copy your card details, such as the card number, the cardholder's name and the expiration date, and pairs them with your secretly recorded PIN. The thief then drains money from the account or sells the data on. These devices most often turn up where you swipe or insert a card without a clerk watching closely: ATMs, gas pumps and self-checkout terminals.

How Does Credit Card Skimming Work?

The black stripe (also called a magstripe) on the flip side of your credit card stores all the information required by a crook to steal your money. The stripe includes the name of the cardholder, the card number, expiration date and CVV code. The magstripe is made of tiny iron-based magnetic particles and is divided into two or three individual tracks. Each particle can be magnetized in a different direction, depending on the information it encrypts. To learn more about how the magstripe on a credit card works, read Magnetic Strips: How do magnetic strips on credit cards work?

Credit Card Skimmer

At the heart of a skimming operation is (surprise!) a skimmer. A skimmer is a scanning device that a thief fits over the real card reader on an ATM, a gas pump or a checkout terminal. Because most machines of a given type share the same design, criminals can mass-produce skimmers that match the genuine readers almost perfectly. They are built so well that most customers never notice them. So whenever you swipe or insert your card, you unknowingly run it through the skimmer first, which quietly copies your data on its way to the real reader.

Skimmers are capable of reading the magstripe on credit cards and storing the information encoded in them. Some skimmers can store the data from hundreds of cards. Information from basic skimmers must be manually extracted, increasing the risk of getting caught in the process. However, some advanced skimmers can be remotely accessed and are capable of transmitting data wirelessly.

Tiny Hidden Camera Or A Counterfeit Keypad

Stolen card details are far less useful, however, without the PIN. To grab it, thieves use either a tiny camera or a counterfeit keypad. The camera is usually hidden in an inconspicuous spot and camouflaged to the naked eye, angled to record people punching in their code. Others go a step further and fit a counterfeit keypad overlay (even harder to spot) that sits on top of the real keys and logs every number pressed.

Once a criminal has both the card data and the PIN, they can encode the stolen details onto a blank magnetic-stripe card and use that counterfeit clone at an ATM or store to siphon off your hard-earned money.

Shimmers: The Chip-Card Version

As banks shifted from the magnetic stripe to the EMV chip, criminals adapted. The newer trick is "shimming." A shimmer is a paper-thin device, barely thicker than a sheet of foil, that a thief slips deep inside the card slot itself. When you insert your chip card, the shimmer sits between the chip and the reader and quietly records the data passing between them. Because it lives inside the slot, a shimmer is almost impossible to spot from the outside, unlike a bulky skimmer you can sometimes wiggle loose.

Here is the reassuring part, though: the data a shimmer captures is far less useful than what a magnetic-stripe skimmer grabs. Each time you use the chip, it generates a one-time cryptographic code that is valid for that single transaction only, so the intercepted data cannot simply be replayed to clone a working chip card. That single design choice is the main reason skimming has become so much harder since chip cards took over.

How To Prevent Credit Card Skimming?

The single best defense is to stop handing over magnetic-stripe data at all. Whenever a terminal lets you, insert the chip or tap your card (or use a phone wallet like Apple Pay or Google Pay) instead of swiping. The chip's one-time code and the wallet's tokenized number give a skimmer nothing it can reuse. Save swiping for the rare reader that accepts nothing else.

Beyond that, you can often spot a tampered machine before you ever use it. Before inserting your card, give the reader a firm wiggle. Genuine readers are bolted in solidly, so a slight shake won't budge them, but a skimmer fitted on top may feel loose or wobbly. If the card slot moves, walk away and find another machine rather than risk getting skimmed.

Next, look for any hidden cameras around the machine before inserting the PIN. The most common areas where someone would install a hidden camera include just above the keypad, on top of the ATM and the areas near the screen. Also, if the keypad appears to be flimsy or the keys are wobbly, don’t use the machine.

The machines most prone to tampering are the ones nobody is watching: gas pumps and ATMs tucked away from foot traffic or staff. At the pump, pick one close to the building and in plain view of the cashier, and look for a security seal over the panel (many read "void" if the panel has been opened to plant a skimmer). When you can spare a few minutes, walk inside and pay at the counter instead of at the pump, since attended terminals are far less likely to be rigged. And whatever you use, check your statements often, because the earlier you catch a fraudulent charge, the easier it is to claw the money back.

A Final Word

Fortunately, banks and card networks keep adding defenses. The old plain card slots have given way to more intricate housings that are harder for a crook to cap with a skimmer, and tamper-evident seals on ATMs and pumps make a forced panel easier to notice.

The biggest change, though, is the EMV chip (the small square chip on the front of your card). Unlike the magnetic stripe, which holds the same static data every time, the chip generates a fresh one-time cryptographic code for each transaction. That intercepted code is useless for the next purchase, which makes chip transactions far tougher to clone than a swipe. The shift mattered enough that, since the US "liability shift" of October 2015, a merchant who still forces a swipe when a chip was available can be left holding the bill for counterfeit fraud. Contactless tap-to-pay goes one step further, sending a tokenized number rather than your real card number at all.

Still, for every new lock the banks fit, crooks eventually pick at it (which is why shimmers and Bluetooth-enabled skimmers keep appearing). So insert or tap rather than swipe, cover your hand when you key in your PIN, and keep an eye on your statements… better safe than sorry!