Credit card skimming involves the illicit installation of devices on payment terminals to capture magnetic stripe data, which criminals then use to create cloned cards or conduct unauthorized transactions. According to the Federal Bureau of Investigation (FBI), consumers should inspect card readers for loose parts, misaligned security seals, or unusual attachments before inserting their payment cards.
How Skimming Devices Work
Skimmers are sophisticated electronic overlays designed to mimic the appearance of legitimate card readers. Once attached, these devices intercept the data transmitted when a card’s magnetic stripe is read. The Federal Trade Commission (FTC) notes that while modern EMV chip technology has made cloning more difficult, many skimmers now target the physical insertion slot to capture data before the chip can initiate a secure transaction. In some cases, criminals also install pinhole cameras near the keypad to record Personal Identification Numbers (PINs) as users enter them.
Identifying Compromised Terminals
The most effective defense against skimming is physical inspection. Before using an ATM, gas pump, or point-of-sale terminal, check for these signs of tampering:
- Loose or Bulky Components: If the card reader feels loose, wobbly, or appears to stick out further than adjacent parts of the machine, it may have an overlay.
- Security Seal Discrepancies: Many gas stations use tamper-evident security tape over the cabinet panels. If the tape is broken, misaligned, or shows signs of having been peeled back, do not use the pump.
- Visual Mismatches: Look for differences in color, material, or design between the card reader and the rest of the machine. A mismatched reader often indicates a third-party device has been placed over the original.
- Keypad Resistance: If the keypad feels stiff or requires unusual pressure to register a keystroke, it may be a "PIN pad overlay" designed to capture your input.
Steps to Take If You Suspect Fraud
If you encounter a suspicious terminal, the Department of Justice advises against using it. Report the device immediately to the store manager, the bank operating the ATM, or the local police.
If you suspect your card information has already been compromised, take these steps immediately:
- Monitor Your Statements: Review your bank and credit card statements for any unauthorized charges, no matter how small.
- Contact Your Financial Institution: Notify your bank or credit card issuer immediately to report the potential compromise. Most institutions will cancel your card and issue a new one to prevent further loss.
- Place a Fraud Alert: If you believe your identity is at risk, you can contact one of the three major credit bureaus—Equifax, Experian, or TransUnion—to place a fraud alert on your credit file. This forces lenders to take extra steps to verify your identity before opening new accounts.
Reducing Risk at the Point of Sale
Beyond inspecting terminals, consumers can minimize their exposure by changing how they pay. Using "contactless" payment methods, such as Apple Pay, Google Pay, or tap-to-pay credit cards, significantly reduces risk. Because these methods use tokenization—a process that replaces sensitive card data with a unique, one-time digital code—the information captured by a skimmer becomes useless to a criminal. When possible, choose indoor ATMs over standalone machines in isolated areas, as indoor terminals are typically monitored more closely and are harder for criminals to tamper with undetected.