What a credit card skimmer is and how it steals your data
A credit card skimmer is a device or piece of software that reads and records the information from your card's magnetic stripe or chip without your knowledge. Skimmers are placed on machines you use every day — ATMs, gas pumps, payment terminals at shops — or hidden in the checkout process online. When you swipe or insert your card, the skimmer captures your card number, expiration date, and sometimes your PIN.
The person who installed the skimmer retrieves the device later or accesses the data remotely, then sells the card information to someone else or uses it to make fraudulent purchases. You may not notice anything wrong until you see charges you did not make on your statement, sometimes weeks later.
Skimmers work because they sit between your card and the legitimate reader, intercepting the data before it reaches the real payment system. The machine may look and feel completely normal — that is the point. You have no way to know a skimmer is there just by looking.
Key Takeaways
- Skimmers are hidden devices or software that capture card data when you swipe or insert your card at ATMs, gas pumps, and checkout terminals.
- The most common physical skimmers are found on ATMs and outdoor gas pumps because they are less monitored than indoor checkout counters.
- Chip readers are harder to skim than magnetic stripe readers, so using chip payment when available reduces your risk.
- Checking your bank and credit card statements regularly is the fastest way to catch skimming fraud, often before the thief uses your card elsewhere.
- If you see unauthorized charges, contact your card issuer immediately — federal law limits your liability to $50 if you report it quickly.
Where skimmers are most commonly found
ATMs in remote locations — parking garages, convenience stores, laundromats — are the most frequent targets because they are checked less often and fewer people see them. Gas pumps at outdoor stations are also common targets, especially older pumps without built-in security cameras or tamper detection. The thief can install a skimmer, leave, and return days or weeks later to retrieve it without being noticed.
Indoor checkout terminals at shops are less common targets because staff members are present and cameras are usually running. However, skimmers can still be placed on self-checkout machines, especially in busy stores where staff attention is spread thin.
Online skimmers work differently — they are malicious code embedded in a website's payment page or injected through a compromised plugin. You cannot see these, and they capture data the same way a physical skimmer does. Websites that are not regularly updated or maintained are at higher risk.
How to spot a skimmer before it reads your card
Before you use any card reader, look for signs of tampering. On an ATM or gas pump, check whether the card slot, keypad, or any plastic panel looks loose, cracked, or like it does not fit flush with the machine. Wiggle the card slot gently — a skimmer device may move or feel different from the rest of the machine. Look for glue residue, scratches, or parts that appear newer than the rest of the machine.
At gas pumps, check the door to the pump's internal panel — if it is already open or the lock looks broken, use a different pump. Some newer pumps have a security seal that breaks if someone opens the panel; if the seal is broken, do not use that pump.
For online purchases, check that the website address begins with "https://" (the "s" means secure) and look for a padlock icon in your browser's address bar. These do not may provide the site is safe, but they are a basic sign that the connection is encrypted. Be cautious on unfamiliar websites, especially if you found them through a link in an email or social media.
Chip readers versus magnetic stripe — which is safer
Chip readers (also called EMV readers) are significantly harder to skim than magnetic stripe readers. A chip creates a unique code for each transaction that cannot be reused, so even if a thief captures the data, they cannot use it to make another purchase. Magnetic stripe readers, by contrast, store the same information every time, so a skimmer captures everything needed to make a fraudulent purchase.
Most U.S. cards now have both a chip and a magnetic stripe. When you have a choice, insert your card into the chip reader rather than swiping. If a machine only has a magnetic stripe reader and you are concerned about skimming, consider using a different payment method — contactless payment (tap or mobile wallet) or cash — if available.
Contactless payment and mobile wallets like Apple Pay or Google Pay are also safer because they do not transmit your full card number to the terminal. The payment is encrypted and tied to your phone, not your physical card.
What to do if you think you have been skimmed
Check your bank and credit card statements regularly — at least weekly if possible. Look for charges you do not recognize, even small ones. Thieves sometimes make a small test purchase first to confirm the card works before making larger charges.
If you see unauthorized charges, contact your card issuer immediately. Call the number on the back of your card or your bank's fraud line. Do not use a number from an email or website, because that could be a scam. Report the fraudulent charges and ask the issuer to cancel your card and send a replacement.
Under the Fair Credit Billing Act, your liability for unauthorized charges is limited to $50 if you report them within 60 days of the statement date. If you report fraud before any charges appear, your liability is zero. After you report the fraud, the issuer will investigate and typically remove the charges from your account within one to two billing cycles.
If the skimmer was at a specific ATM or gas pump, report the location to the bank or business that owns it. They can inspect the machine and alert other customers. You can also file a report with the Federal Trade Commission at reportfraud.ftc.gov, which helps law enforcement track skimming patterns.
Steps to reduce your skimming risk
Use ATMs and gas pumps in well-lit, busy locations during daylight hours when possible. ATMs inside banks or grocery stores are generally safer than standalone machines in parking lots or remote areas. At gas pumps, choose pumps closest to the station entrance where staff can see them.
Cover the keypad with your hand when you enter your PIN, whether at an ATM or a checkout terminal. This prevents cameras or people nearby from seeing your PIN, even if a skimmer has not captured it.
Set up account alerts with your bank and credit card issuers. Most banks allow you to receive a text or email notification whenever a charge is made, or whenever a charge over a certain amount is made. This way you will know immediately if your card is being used fraudulently, rather than waiting for your statement.
Monitor your credit report for signs of identity theft. You can view your credit report free once per year at annualcreditreport.com. If you see accounts you did not open, that is a sign someone has used your information for more than just card skimming.
Frequently Asked Questions
Can a skimmer steal my PIN?
Some skimmers can capture your PIN if they include a hidden camera or a fake keypad overlay that records which keys you press. This is why covering the keypad with your hand when you enter your PIN is important. If a thief has both your card number and your PIN, they can withdraw cash from your account or make purchases at terminals that require a PIN.
Will my bank refund me if I was skimmed?
Yes, if you report the fraud within 60 days of the statement date. Your liability is limited to $50 under federal law, and most banks waive even that $50 if you report it promptly. The bank will investigate and remove the unauthorized charges from your account. Report fraud as soon as you notice it to protect yourself fully.
Is contactless payment safer than inserting my chip card?
Contactless payment is generally safer because your full card number is not transmitted to the terminal. The payment is encrypted and tied to your phone or device. However, both contactless and chip payment are safer than swiping a magnetic stripe, which is what skimmers are designed to read.
What should I do if I find a skimmer on a machine?
Do not remove it yourself. Report it to the business or bank that owns the machine immediately. If it is an ATM, call the bank's customer service line. If it is a gas pump, tell a staff member inside the station. They will inspect the machine and contact law enforcement if necessary. You can also file a report with the Federal Trade Commission.
Can skimmers work on chip readers?
It is much harder to skim a chip reader because the chip creates a unique code for each transaction. However, some sophisticated skimmers can capture the data from a chip, though they cannot use it to make purchases the way they can with magnetic stripe data. This is why chip readers are considered safer, but using contactless payment or a mobile wallet is the most secure option when available.