What a credit card skimmer looks like and where to find it
A credit card skimmer is a small device that reads and records the information on your card's magnetic stripe or chip. Criminals install them on machines you use every day — ATMs, gas pumps, and card readers at checkout counters — so they can steal your number without you knowing. The device sits on top of or inside the slot where you insert your card, captures your data as it passes through, and the thief retrieves it later.
Skimmers at ATMs are often the easiest to spot because they are added on top of the machine. Look for a card reader that seems loose, sits at an odd angle, or looks newer or shinier than the rest of the machine. At gas pumps, check whether the card reader panel is flush with the pump body or if it sticks out. Legitimate readers are usually recessed slightly into the pump; a reader that protrudes or looks like it was glued on is a warning sign.
Indoor card readers — at grocery stores, restaurants, or retail counters — are harder to spot because they are built into the machine. In these cases, your best defense is not visual inspection but the steps you take when you swipe or insert your card.
Key Takeaways
- Skimmers at ATMs and gas pumps often sit visibly on top of the machine; check for loose, protruding, or misaligned card readers before you insert your card.
- Wiggle the card reader gently — if it moves, shifts, or feels loose, do not use that machine and report it to the business or bank.
- Criminals often pair skimmers with hidden cameras or fake keypads to capture your PIN, so cover the keypad with your hand when you enter it.
- Skimmers at indoor checkout counters are built into the machine and invisible to you, so monitor your statements and set up transaction alerts instead.
- If you notice unauthorized charges, contact your card issuer right away; federal law limits your liability to $50 if you report fraud promptly.
How to test a card reader before you use it
Before you insert your card, try to move the card reader itself. Grip the edges of the reader panel and wiggle it gently side to side and up and down. A legitimate reader is bolted or screwed firmly to the machine and will not move. If the reader shifts, rocks, or feels loose, do not use it. This is the single most reliable test you can do in the moment.
Pay special attention to ATM card readers and gas pump readers, since these are the most common targets. At an ATM, the card slot should be flush with the machine's faceplate. At a gas pump, the reader should sit level and aligned with the pump body. If something looks off — if the reader is tilted, if there is a gap between the reader and the machine, or if the plastic looks like it was added later — move to a different machine.
If you find a loose reader, do not try to remove it yourself. Report it to the business or bank that owns the machine. Take a photo if you can, and tell a manager or call the customer service number on the machine.
Protecting your PIN from hidden cameras and fake keypads
Skimmers often work in pairs: the card reader captures your number, and a hidden camera or fake keypad captures your PIN. Without your PIN, the stolen card number is much harder for a thief to use. Protect yourself by covering the keypad with your other hand while you type your PIN — this blocks any camera that might be pointed at the keys.
Look for a fake keypad the same way you look for a fake card reader: check whether the buttons feel loose, whether the keypad sits at an odd angle, or whether it looks newer than the rest of the machine. A fake keypad is usually a thin overlay placed on top of the real one. If the buttons feel squishy, unresponsive, or different from what you remember, use a different machine.
At checkout counters where you enter your PIN on a terminal, the keypad is usually built into the machine and you cannot inspect it visually. In these cases, cover the keypad with your hand and shield your entry from view.
Where skimmers are most common
Gas pumps are the most frequent target for skimmers because they are outdoors, often unattended, and the thief can return days later to retrieve the device. ATMs in remote locations — parking garages, convenience stores, laundromats — are the second most common target for the same reason. Criminals avoid busy, well-lit locations with staff present because the risk of being caught is higher.
Skimmers at indoor checkout counters do exist but are rarer because they require the thief to have access to the machine itself, which is usually controlled by the business. When they do occur, they are often installed by an employee or someone posing as a technician.
If you use the same ATM or gas pump regularly, you will become familiar with how it looks and feels. This familiarity is your advantage — you will notice if something has changed.
What to do if you suspect you have been skimmed
If you notice charges on your statement that you did not make, or if your card is declined when you know you have funds, contact your card issuer immediately. Most credit card companies have a fraud department that operates 24 hours. The phone number is on the back of your card.
Tell the issuer the date and location where you last used your card, and describe the unauthorized charges. The issuer will cancel your card, investigate the charges, and send you a replacement card. Under federal law, your liability for unauthorized charges is limited to $50 if you report the fraud within 60 days of receiving your statement. Many issuers waive the $50 entirely.
After you report fraud, monitor your credit report for new accounts opened in your name. You can request a free credit report from each of the three major bureaus — Equifax, Experian, and TransUnion — once per year at annualcreditreport.com. If you see accounts you did not open, contact the bureau and the creditor immediately.
Using transaction alerts to catch fraud early
Most card issuers let you set up alerts that notify you by text or email when a charge is made. You can set alerts for all transactions, or only for charges above a certain amount. This means you will know within minutes if your card is used fraudulently, rather than waiting until your monthly statement arrives.
To set up alerts, log into your card issuer's website or app and look for "alerts" or "notifications" in the settings menu. You can usually choose which types of transactions trigger an alert — online purchases, international charges, large purchases, or all transactions. The more alerts you receive, the faster you will catch fraud, but you may also receive alerts for legitimate charges you forgot about.
Alerts are especially useful if you have been skimmed at a gas pump or ATM, because the thief may not use your card immediately. If you set up an alert and then see a charge you did not make within hours or days, you can report it before the thief makes additional purchases.
Chip readers and contactless payments reduce skimming risk
Newer card readers use chip technology instead of magnetic stripe readers. When you insert a chip card, the reader creates a unique code for that single transaction. Even if a skimmer captures the code, it cannot be reused for another purchase. Magnetic stripe readers, by contrast, capture the same information every time you swipe, so a skimmer gets a card number that works for any transaction.
Contactless payments — tapping your card or phone instead of inserting it — bypass the card reader entirely. The thief cannot install a skimmer on a contactless reader because there is no physical slot to insert a card. If your card and the merchant's reader both support contactless payment, use it instead of swiping or inserting.
Not all merchants have upgraded to chip or contactless readers yet, especially at gas pumps and older ATMs. If you have a choice between machines, choose one with a chip reader or contactless option. If you only have access to a magnetic stripe reader, inspect it carefully before you use it.
Frequently Asked Questions
Can a skimmer steal my information if I use a chip reader?
A skimmer can still capture your card number from a chip reader, but the number alone is much less useful to a thief. Chip technology creates a unique code for each transaction, so even if the skimmer gets your number, that code cannot be reused. Magnetic stripe readers are the real target because they capture the same data every time.
What should I do if I find a skimmer on a machine?
Do not try to remove it yourself. Take a photo if you can, report it to the business or bank that owns the machine, and tell a manager or call the customer service number on the machine. If you used that machine recently, contact your card issuer and ask them to monitor your account for fraud.
How long does it take for a thief to use a stolen card number?
It varies. Some thieves use the number within hours; others wait days or weeks. This is why transaction alerts are useful — they let you catch fraud quickly, even if the thief waits. The longer you wait to report fraud, the more charges may appear on your account.
Will my bank refund fraudulent charges?
Yes, but you must report them within 60 days of receiving your statement. Federal law limits your liability to $50, and most issuers waive that fee. If you report fraud after 60 days, you may be liable for all charges. Contact your issuer as soon as you notice unauthorized charges.
Is it safer to use my debit card or credit card at a gas pump?
Credit cards offer stronger fraud protection than debit cards. With a credit card, the issuer's money is at risk, so they investigate fraud aggressively. With a debit card, your own money is taken from your account, and you have to wait for the bank to refund it. If you have a choice, use a credit card at gas pumps and other high-risk locations.