What is credit card skimming and how can you avoid it?

Credit card skimmers are small, illegal devices that fit on top of real card readers at self-service sale terminals in order to steal your personal data. They are designed to blend in with the rest of the machine, making them tough to spot. According to FICO data published in 2024, the number of compromised cards from skimming surged by 96% from 2022 to 2023.

How do credit card skimmers work?

A credit card skimmer reads the magnetic strip on your card when you insert it into the terminal. The skimmer can also capture your PIN if the criminal placed a fake keypad over the real one or installed a hidden camera. The thief then scoops up the information and sells it or uses it themselves. In some cases, the devices can wirelessly transmit the data.

You may encounter these deceptive devices at gas pumps, ATMs, metro station ticket kiosks, or other point-of-sale (POS) systems that are largely unattended. Credit card skimming is sometimes referred to as ATM skimming since ATMs are such popular targets. However, if your card leaves your sight at a restaurant or department store, an employee could also use a skimmer to get your card info and related personal data.

How to spot a credit card skimmer

Though credit card skimmers are designed to be inconspicuous, there are ways to identify them so you can keep your credit card details safe and even help protect against identity theft. One way to spot a skimmer is to use the SCAN method, which teaches you what to look for when approaching an ATM or other unattended POS terminals.

Here's a breakdown of the SCAN method, which you can use to help identify a card skimmer:

• Scan the area for hidden cameras pointed directly at the keypad. ATMs often have cameras for security, so don’t immediately panic if you see one in the area—just be sure to cover your hand while entering your PIN.
• Compare the card reader and keypad to the rest of the machine. The colors and styles should all match, and the graphics should be aligned and unobscured.
• Assess for obvious signs of tampering. The panels may be broken or dented, or a security seal may be broken.
• Nudge the card reader and keypad. Card skimmers and fake keypads are meant to be removed, so if they feel loose, you may have spotted a skimmer.

If the machine doesn’t look right, report it to a clerk on duty (if there is one) and go to another location.

How to avoid credit card skimming

In addition to learning how to detect a card skimmer device, you can modify your behavior to avoid becoming a victim of this type of credit card fraud. Below are a few ways to exercise caution to help protect yourself, your funds, and maybe even your identity.

Go inside to pay or withdraw cash

Identity thieves look for undetected, uninterrupted access to point-of-sale terminals where they’re less likely to be found. That’s why gas pumps are appealing—they’re away from the watchful eye of the clerks.

Instead of paying for your gas at the pump or using an ATM, take the extra minute to go inside for the transaction. When you pay at a POS terminal that sits right next to a clerk, you’re much less likely to encounter a skimmer.

If you can’t go inside to make a transaction, check out your location to ensure there are no skimmers. It’s usually more difficult for a scammer to install a skimmer on a machine in brightly lit areas where many people pass through.

Use a contactless credit card

Use a credit card—preferably with a chip—if you have one. Here’s why:

If a thief skims your card information, it can be a pathway to using the info to make fraudulent purchases online, or cloning it to use in person. Thieves may also steal credit card information to sell on the dark web.

Under U.S. Regulation E, if you report unauthorized electronic fund transfers within 60 days after your statement is sent, your liability is limited. But if someone uses your account and you don't report it after 60 days, you may face unlimited liability for additional unauthorized transfers that occur after that point. The card issuer (usually your bank) may offer stronger protections than required by law.

Using a credit card with chip technology or another type of contactless payment, like Apple Pay, can make it harder for thieves to skim your data in the first place. That’s because chip cards create a unique, one-time transaction code for each sale, which is harder for identity thieves to replicate. But if a thief still gets your credit card info, they can use only that existing account to make unauthorized charges, instead of a debit card that connects to your bank account directly.

Cover and pull on the keypad before entering your PIN

In addition to skimmer devices, identity thieves may also install hidden pinhole cameras to capture your personal identification number (PIN). To protect your PIN, use your other hand to cover your fingers as you enter your PIN into the machine.

Another way identity thieves can get your PIN is by placing keypad overlays on the keypad to record your keystrokes. Before entering your PIN, tug on the sides of the keypad to check for an overlay.

Monitor your accounts regularly

Regularly check your financial statements to help catch fraudulent charges and bank scams.

Set up notifications on your checking account and credit cards. Set alerts that tell you every time a charge is more than $100 or every time there’s a “card not present” transaction. Your phone will tell you via text or email. It’ll only take seconds to remember whether you made the charge.

What to do if your card is skimmed

If an identity thief gains access to your credit card information via skimming, they can use it to make purchases online, generate fake credit cards, or even sell the information on the dark web.

If you see fraudulent charges on your statement or suspect somebody skimmed your credit card, follow these steps:

• Alert your credit card issuer: Report suspicious activity to your card company immediately. Many credit cards have zero liability for fraud, which means you’ll likely not be responsible for paying back fraudulent charges if you report within 60 days.
• Place a credit freeze on your report: A credit freeze prevents identity thieves from using your credit report to create new accounts or open new lines of credit in your name.
• File a police report: Report the credit card skimming incident to your local police station. If you suspect a credit card skimmer in a specific location, report it immediately so the police can investigate and help prevent theft from happening to others.

Protect your accounts and identity against scammers

Credit card skimming devices can be tricky to spot and avoid. A reliable identity theft protection service like LikeLock Advanced helps monitor your personal information and credit cards, then notifies you if your personal data is potentially exposed or shows up on dark web sites. Subscribe to LifeLock today for extra peace of mind and added protection should the worst happen.

FAQs

How common is credit card skimming?

According to FICO, 315,000 cards were skimmed in 2023 alone. Credit card fraud, which includes skimming, is a commonly reported type of identity theft.

What does a credit card skimming device look like?

A credit card skimming device is designed to blend in, so the look changes depending on the point-of-sale terminal it’s connected to. However, because a card skimmer covers up the real card reader, you may be able to tell that it’s a skimmer if it’s overly bulky, isn’t sealed at the ends, or doesn’t fit the design of the rest of the terminal.

Do credit card skimmers need your PIN?

Yes, identity thieves need your PIN to successfully withdraw cash from ATMs, and they’ll often install hidden cameras or keypad overlays to obtain it. However, they don’t need your PIN to use your card information to make fraudulent purchases online, for instance.