What a credit card skimmer is and why thieves use them
A credit card skimmer is a device or software that captures your card number, expiration date, and sometimes your PIN without your knowledge. Criminals use skimmers because they work: a single skimmer can steal from dozens of people before anyone notices, and the thief never has to be present when the card is used.
Skimmers are attractive to criminals because they create distance between the theft and the use of the stolen data. The person who installs the skimmer at a gas pump or ATM is often not the person who sells the card numbers online or uses them to make purchases. This separation makes the crime harder to trace and reduces the risk to any single person in the chain.
The stolen card data itself has market value. Card numbers sell for $5 to $50 each on underground forums, depending on whether they include a PIN or have been tested to confirm they work. A skimmer that captures 100 cards can generate hundreds or thousands of dollars with minimal effort or cost to the criminal.
Key Takeaways
- Skimmers capture your card information without your knowledge at ATMs, gas pumps, and payment terminals, then criminals sell or use the data to make unauthorized charges.
- Physical skimmers are devices placed over the real card slot; digital skimmers are malware installed on payment terminals or websites that intercept data as you enter it.
- Criminals prefer skimmers because one device can steal from many people, the thief is not present during the actual fraud, and stolen card numbers have resale value.
- Your bank or card issuer is responsible for refunding unauthorized charges, but you must report the fraud quickly to limit your liability and stop further theft.
How physical skimmers are installed and what they capture
A physical skimmer is a thin device placed over the legitimate card slot on an ATM, gas pump, or payment terminal. When you insert your card, the skimmer reads the magnetic stripe or chip and stores the data. Many skimmers also include a hidden camera or a fake keypad overlay to capture your PIN as you type it.
Gas pumps are the most common target because they are outdoors, often unattended, and the card slot is easy to access. ATMs in remote locations—parking garages, convenience stores, laundromats—are also frequent targets. Retail terminals are less common because store staff are usually nearby and terminals are checked more regularly.
The data is stored in the skimmer's memory until the criminal retrieves it, sometimes days or weeks later. If the skimmer also captured your PIN, the thief can use the card at an ATM to withdraw cash directly. Without the PIN, they typically sell the card number to someone else or use it online where a PIN is not required.
Digital skimmers and how they work on websites and terminals
A digital skimmer is malware installed on a payment terminal or website that intercepts card information as you enter it. Unlike a physical device, you cannot see it, and it leaves no trace on the machine itself.
On websites, a digital skimmer is often injected into the checkout page through a compromised plugin, third-party script, or a breach of the website's code. When you enter your card number to complete a purchase, the skimmer copies the data before it is encrypted and sent to the payment processor. The website owner may not know the skimmer is there.
On payment terminals in stores, digital skimmers are installed when someone with access to the terminal—an employee, a technician, or someone who gained physical access—loads malware onto the device. The terminal continues to work normally, but every card swiped is logged and transmitted to the criminal.
Why skimmers are hard to detect and remove
Physical skimmers are designed to look like part of the machine. A well-made skimmer fits snugly over the real card slot and matches the color and material of the terminal. Many people do not inspect the card slot before using it, and even those who do may not notice a thin overlay.
Digital skimmers are even harder to spot because they are invisible. A website may look and function normally while a skimmer runs in the background. Payment terminals show no sign of malware. The only evidence is often the unauthorized charges that appear on your statement days or weeks later.
Removing a physical skimmer requires someone to physically inspect and disassemble the terminal. Removing a digital skimmer requires identifying the malware in the code, which can take weeks or months if the breach is not discovered quickly. During that time, every transaction is compromised.
What happens after your card information is stolen
Once a skimmer captures your card data, the criminal has several options. If they also have your PIN, they may withdraw cash from an ATM immediately. If they only have the card number, they typically sell it to someone else or use it to make online purchases, phone orders, or in-person purchases at stores that do not require a PIN.
Unauthorized charges often appear within days, but sometimes weeks pass before the stolen card is used. This delay makes it harder to remember where the card was compromised. By the time you notice the fraud, the criminal may have already moved on to other victims.
Your card issuer—your bank or credit card company—is responsible for refunding unauthorized charges. Federal law limits your liability to $50 if you report the fraud promptly, and most issuers waive even that amount. However, you must report the fraud as soon as you notice it. The longer you wait, the harder it is to prove the charges were not yours.
Why banks and merchants have not eliminated skimmers
Chip technology and EMV readers were designed to make skimming harder. A chip card is more difficult to clone than a magnetic stripe card, and the data changes with each transaction. However, many merchants still accept magnetic stripe cards as a fallback, and criminals have adapted by using skimmers to steal chip data as well.
Physical security is expensive. Inspecting every ATM and gas pump regularly, upgrading terminals to be tamper-resistant, and training staff to spot skimmers costs money. Many smaller merchants and independent ATM operators do not have the resources to do this consistently.
Digital security is also imperfect. Websites and payment terminals are compromised through employee negligence, unpatched software, weak passwords, and third-party vulnerabilities. No system is 100 percent secure, and criminals are constantly finding new ways to breach them.
How to reduce your risk of being skimmed
Inspect the card slot before you use it. Wiggle the card reader, the keypad, and any moving parts. If something feels loose, does not match the rest of the terminal, or looks like it was added on top, do not use that machine.
Use ATMs in well-lit, high-traffic locations inside banks or busy stores. Avoid isolated ATMs in parking garages or alleys. Gas pumps at busy stations are safer than those at remote locations.
Cover the keypad with your hand when you enter your PIN. This prevents hidden cameras from recording it. If a keypad feels unusual or loose, do not use it.
Monitor your statements regularly. Check your bank and credit card accounts at least weekly, either online or through your mobile app. Report unauthorized charges immediately. The sooner you report fraud, the sooner your issuer can stop further charges and refund what was stolen.
Use contactless payment or mobile payment apps like Apple Pay or Google Pay when possible. These methods do not expose your full card number to the terminal, making skimming much harder.
Frequently Asked Questions
Can a skimmer steal my money directly from my bank account?
A skimmer captures your card number, not your PIN or bank account credentials. If the skimmer also captured your PIN, a thief can use the card at an ATM to withdraw cash. Otherwise, they can only use the card number for purchases or sales to other criminals. Your bank account itself is not directly compromised unless the thief also has your online banking password.
How long does it take to notice a skimmed card?
Unauthorized charges can appear within hours or days, but sometimes weeks pass before the stolen card is used. The delay depends on whether the criminal uses the card immediately or sells it to someone else first. Checking your statements weekly helps you catch fraud sooner, which limits your liability and stops further charges faster.
What should I do if I find a skimmer on an ATM or gas pump?
Do not attempt to remove it yourself. Contact the bank or business that owns the machine and report what you found. If it is a gas pump, tell the attendant inside. If it is an ATM, call the bank's customer service number on the back of your card. Take a photo if you can do so safely, but your main goal is to alert the owner so they can inspect and secure the machine.
Will my bank refund me if my card is skimmed?
Yes. Federal law requires your card issuer to refund unauthorized charges, and your liability is limited to $50 if you report the fraud promptly. Most banks and credit card companies waive the $50 fee entirely. Report the fraud as soon as you notice it to protect yourself and stop further unauthorized use.
Is a debit card or credit card safer from skimmers?
Credit cards are safer because your liability is limited and the issuer's money is at risk, not yours. With a debit card, the thief has direct access to your bank account, and while you are protected by law, the refund process can take longer and your account may be frozen during the investigation. Use a credit card for in-person purchases when possible.