What a credit card skimmer is
A credit card skimmer is a small device or hidden software that captures the information from your card's magnetic stripe or chip when you swipe or insert it. The person who installed it reads that data later — either by retrieving the physical device or accessing it remotely — and uses your card number, expiration date, and sometimes your PIN to make unauthorized purchases or sell the information to other criminals.
Skimmers are not the same as data breaches at major retailers. A breach happens when hackers break into a company's computer system and steal thousands of card numbers at once. A skimmer is a physical trap set on a single machine — a gas pump, ATM, or card reader — that catches your information one transaction at a time.
The device itself is often thin enough to fit over the real card slot without looking obviously wrong. Some are nearly invisible. Others are more obvious but installed in places where you are less likely to inspect closely, like the inside of a parking meter or a self-checkout kiosk.
Key Takeaways
- Skimmers are physical devices or software overlays placed on card readers to steal your card number, expiration date, and sometimes your PIN when you swipe or insert your card.
- Gas pumps, ATMs, and self-checkout machines are common targets because they are often unattended and harder to monitor than cashier stations.
- You can reduce your risk by using card readers at the pump or ATM that feel loose or look different from others nearby, checking for physical tampering before you insert your card, and covering the keypad when you enter your PIN.
- If you notice unauthorized charges, contact your card issuer immediately — federal law limits your liability to $50 if you report fraud within two business days.
Where skimmers are most commonly found
Gas pumps are the most frequent target. A skimmer placed on the outside card reader can capture your information while the pump itself processes the transaction normally. You pay and leave without knowing anything went wrong. ATMs — especially those in remote locations like convenience stores or parking garages — are also common targets because they operate 24/7 with minimal staff oversight.
Self-checkout machines at grocery stores and retail shops have become increasingly targeted in recent years. The card reader is exposed and often not monitored closely by store staff. Parking meters, vending machines, and standalone payment kiosks are also vulnerable. Anywhere a card reader sits unattended and receives minimal inspection is a potential target.
Skimmers are less common at staffed checkout counters because a cashier is watching the machine and can spot obvious tampering. They are also rare at major bank branches, which have security cameras and regular maintenance checks.
How to spot a skimmer before you use it
Before you insert or swipe your card, spend a few seconds inspecting the card reader. Wiggle it gently — a skimmer may feel loose or shift slightly because it is mounted over the real reader. Look at the edges where the reader meets the machine; a skimmer often leaves a visible seam or gap. Compare the card reader to others on nearby pumps or machines; if one looks different in color, material, or fit, do not use it.
Check for signs of forced entry or damage around the card slot. Look for glue residue, scratches, or misaligned panels. Some skimmers are installed by opening the machine and placing a device inside the card reader itself, so any evidence of tampering is a warning sign.
If you are using an ATM, check the keypad as well. A skimmer can include a fake keypad overlay that captures your PIN as you type. If the keypad feels loose, looks raised, or appears to be a different material or color than the rest of the machine, do not use that ATM.
Protecting your PIN when you use a card reader
Even if a skimmer captures your card number, it cannot complete a transaction without your PIN. Cover the keypad with your hand or body as you enter your PIN, blocking any hidden camera that might be pointed at the keys. Do this at every card reader — gas pumps, ATMs, self-checkout machines, and payment kiosks.
Use your other hand to shield the keypad, or position yourself so your body blocks the view. This simple habit makes it much harder for a criminal to capture your PIN even if a skimmer is present. If you notice a camera pointed at the keypad or any device that looks out of place above or beside the keypad, do not complete the transaction.
What to do if you see a skimmer
If you spot a device that looks like it does not belong — something loose, protruding, or obviously glued onto a card reader — do not attempt to remove it. Report it to the business or property owner immediately. At a gas station, tell the attendant. At a bank ATM, call the bank's customer service number on the back of your card or posted on the ATM itself. At a retail store, find a manager.
Provide a clear description of what you saw and where it is located. Take a photo if you can do so safely, but your primary goal is to alert someone who can inspect it and take it down. The business can then check their machines for similar devices and notify customers if fraud has occurred.
What happens if your card information is stolen
If you notice unauthorized charges on your statement, contact your card issuer immediately — call the number on the back of your card. Under federal law, your liability is limited to $50 if you report the fraud within two business days of discovering it. If you report it after two business days but within 60 days, your liability can be up to $500. After 60 days, you may not be protected at all.
Your card issuer will cancel your card, investigate the fraudulent charges, and issue you a replacement card. Most issuers remove fraudulent charges from your account while they investigate, so you do not have to pay them. Keep records of all communications with your issuer, including the date, time, and name of the person you spoke with.
You should also check your credit report for signs of identity theft — fraudsters sometimes use stolen card information to open new accounts. You can request a free credit report from each of the three major credit bureaus (Equifax, Experian, and TransUnion) once per year at annualcreditreport.com.
Frequently Asked Questions
Can a skimmer steal my information if I use chip technology instead of swiping?
Chip readers are harder to skim because the chip technology encrypts your data differently than the magnetic stripe. However, some skimmers can still capture information from chip cards, and many machines still have a magnetic stripe as a backup. Using the chip when available is safer, but you should still inspect the reader and cover your PIN.
Is contactless payment safer than using a card reader?
Contactless payment — tapping your phone or card near a reader — does not require you to insert or swipe your card, so a traditional skimmer cannot capture your information. However, contactless technology has its own security risks. Using it when available is generally a good idea, but it is not foolproof.
What if I used a card at a pump or ATM and later found out it had a skimmer?
Contact your card issuer right away, even if you have not yet seen fraudulent charges. The issuer can monitor your account closely and cancel your card before criminals use the stolen information. Report the skimmer location to the business or bank so they can remove it and check for fraud.
Can I get my money back if a skimmer was used on my debit card?
Debit cards have less protection than credit cards under federal law. You have 60 days to report fraud, but your liability can be higher. Report it immediately to your bank. Many banks offer fraud protection similar to credit cards, but the terms vary, so check your account agreement or call your bank to understand your coverage.
Do I need to worry about skimmers at online checkout or in-app payments?
No. Skimmers are physical devices placed on card readers in the real world. Online and in-app payments do not use card readers, so skimmers cannot be installed on them. Your risk online comes from phishing, weak passwords, and compromised websites — different threats that require different protections.