Credit card skimmers are devices that enable thieves to steal card data and use it for fraudulent transactions. They're added to card reader devices to capture your information. Here's what you need to know to protect yourself from skimming.
A credit card skimming device reads the magnetic stripe on your credit or debit card when you slide it into a card reader at an ATM, gas pump or other point of sale. The skimmer then stores the card number, expiration date and cardholder's name. These stripes even appear on chip-enabled cards.
What happens when your credit card
is skimmed? Tom Kellermann, head
cybersecurity strategist for
cybersecurity firm VMware Carbon
Black, says hackers use stolen data to
rack up fraudulent charges online or
over the phone, sell your data, or
create counterfeit cards.
According to FraudWatch International, an internet security organization specializing in online fraud and phishing, skimmed data typically is:
Bankrate
How to settle credit card debt
How do credit card skimmers work?
Transmitted to other countries, where the information is copied onto counterfeit cards.
Used to make internet or over-the-phone purchases. This is known as "card not present" fraud.
Used to carry out identity theft. This occurs when a criminal relies on your stolen personal data to set up accounts or take out loans in your name.
If you made a purchase with a debit card, your personal identification number might have been stolen as well, enabling crooks to drain your bank account. David Tente, executive director, USA, Canada and Americas of the ATM Industry Association, says thieves can accomplish this by installing a phony keypad over the real keypad to capture the PIN or by installing a tiny pinhole camera to watch you enter the PIN.
What does a credit card skimmer look like?
Credit card skimmers can be tough to spot, as they often look like regular card readers. But being vigilant can help you identify these fraudulent readers designed to steal your information.
You may have found a skimmer if the card reader looks different from others in the same location – for example, a reader that is bigger at one gas pump than those at nearby pumps. Readers with card skimmers attached may not feel as secure. If you're able to wiggle the reader, it could have a skimmer attached.
Aside from ATMs and gas pumps, card skimming devices pop up at ticket kiosks, parking meters and other spots where you can swipe a credit or debit card. A retail or restaurant employee equipped with a handheld skimmer might even steal your card information when your card is out of your sight.
Chip credit cards are designed to be safer than magnetic stripe cards, encrypting payment information so it's not so easy to steal. They can offer another layer of security, but they aren't iron-clad – especially if you have transactions where you have to use the magnetic stripe instead of the chip.
New credit cards issued in the U.S. are typically chip cards, and millions of merchant locations now accept them. But they aren't used for every transaction, and the vulnerable magnetic stripe on the back of your card can be used as a fallback.
Skimmers are especially common at gas stations because credit card chip readers at self-service pumps won't be required until October 2020.
Even at locations where chip readers are in use, chip technology isn't always used.
Alan Brill, senior managing director in the cyber-risk practice of Kroll, a division of Duff & Phelps, says he's seen multiple cases at businesses when a chip didn't seem to work, so the merchants swiped the card instead. "They shrugged, ran the (magnetic stripe) and the transaction went through."
Responding to the rise of chip-equipped cards, thieves are also devising new methods – namely devices called "shimmers" – to swipe your debit and credit card information.
A shimmer is a small, thin chip that's tucked inside the slot of a card reader. By contrast, a skimmer often is fitted over a card reader, making it easier to see.
"The shimmer is extremely subtle and difficult to spot. It is also able to steal the card data from a chip-based card, thereby bypassing the enhanced security of the new smart-chip system," says David Kennedy, founder and senior principal security consultant of TrustedSec, an information security consulting company. The shimmer records the card data, which then is used to produce a magnetic strip card, he says.
Are chip credit cards safe from credit card skimming?
While credit card issuers use fraud detection technology and may shut down your card at the first sign of fraud, they don't catch everything. You might not know your card has been skimmed until you notice fraudulent transactions on your account.
If you notice card fraud, contact your issuer right away to limit your liability and cut off card access. Alert the business where you believe the card skimming occurred so a manager can check the reader and prevent additional theft. Contact your local law enforcement agency, the consumer division of your state attorney general's office and the Federal Trade Commission. This might not fix your situation, but it could prevent someone else from being skimmed.
What should you do if your card is skimmed?
A little caution can go a long way in protecting yourself from credit card skimmers. For example, at a gas pump:
How can you protect yourself from credit card skimmers?
If you use a debit card, run it as a credit card without using the PIN. If you must use the PIN, cover your hand when typing the number, in case hidden cameras are watching.
Look for a broken security seal. Many gas stations now place security seals over the cabinet panel. When the panel is opened, the label will read "void," a tipoff that tampering has occurred.
Look for unusual features in the card reader. The reader at the pump you are using should look like other readers at the station. Also, you should not be able to wiggle the reader.
Pay inside. This might help you bypass the skimmer altogether.
Keep in mind that spotting a skimmer can be difficult. This is especially true at gas stations, where a skimmer might be inside a pump and not visible to the naked eye.
"Take a moment to pause before any transaction," says Kellermann. Even if you're in a rush to get gas or grab cash from an ATM, it pays to be vigilant.
Other ways to steer clear of skimming, or help you recover from it quickly, include:
Making purchases with chip-enabled cards.
Paying with cash instead of plastic.
Using an online or mobile payment service such as Apple Pay, Google Pay or PayPal.
Setting up alerts to monitor activity on your credit and debit cards.
Regularly reviewing your credit and debit card statements to check for suspicious transactions.
Picking gas pumps in well-lit areas within the line of sight of store employees. Scammers tend to install credit card skimming devices at pumps that are hard to see.
Avoiding ATMs in out-of-the-way locations.
Going to another ATM or gas pump when you suspect the presence of a credit card skimmer.
Credit card skimmers are devices that enable thieves to steal card data and use it for fraudulent transactions. They're added to card reader devices to capture your information. Here's what you need to know to protect yourself from skimming.
How Do Credit Card Skimmers Work?
A credit card skimming device reads the magnetic stripe on your credit or debit card when you slide it into a card reader at an ATM, gas pump or other point of sale. The skimmer then stores the card number, expiration date and cardholder's name. These stripes even appear on chip-enabled cards.
What happens when your credit card is skimmed? Tom Kellermann, head cybersecurity strategist for cybersecurity firm VMware Carbon Black, says hackers use stolen data to rack up fraudulent charges online or over the phone, sell your data, or create counterfeit cards.
According to FraudWatch International, an internet security organization specializing in online fraud and phishing, skimmed data typically is:
If you made a purchase with a debit card, your personal identification number might have been stolen as well, enabling crooks to drain your bank account. David Tente, executive director, USA, Canada and Americas of the ATM Industry Association, says thieves can accomplish this by installing a phony keypad over the real keypad to capture the PIN or by installing a tiny pinhole camera to watch you enter the PIN.
What Does a Credit Card Skimmer Look Like?
Credit card skimmers can be tough to spot, as they often look like regular card readers. But being vigilant can help you identify these fraudulent readers designed to steal your information.
You may have found a skimmer if the card reader looks different from others in the same location – for example, a reader that is bigger at one gas pump than those at nearby pumps. Readers with card skimmers attached may not feel as secure. If you're able to wiggle the reader, it could have a skimmer attached.
Aside from ATMs and gas pumps, card skimming devices pop up at ticket kiosks, parking meters and other spots where you can swipe a credit or debit card. A retail or restaurant employee equipped with a handheld skimmer might even steal your card information when your card is out of your sight.
Are Chip Credit Cards Safe From Credit Card Skimming?
Chip credit cards are designed to be safer than magnetic stripe cards, encrypting payment information so it's not so easy to steal. They can offer another layer of security, but they aren't iron-clad – especially if you have transactions where you have to use the magnetic stripe instead of the chip.
New credit cards issued in the U.S. are typically chip cards, and millions of merchant locations now accept them. But they aren't used for every transaction, and the vulnerable magnetic stripe on the back of your card can be used as a fallback.
Skimmers are especially common at gas stations because credit card chip readers at self-service pumps won't be required until October 2020.
Even at locations where chip readers are in use, chip technology isn't always used.
Alan Brill, senior managing director in the cyber-risk practice of Kroll, a division of Duff & Phelps, says he's seen multiple cases at businesses when a chip didn't seem to work, so the merchants swiped the card instead. "They shrugged, ran the (magnetic stripe) and the transaction went through."
Responding to the rise of chip-equipped cards, thieves are also devising new methods – namely devices called "shimmers" – to swipe your debit and credit card information.
A shimmer is a small, thin chip that's tucked inside the slot of a card reader. By contrast, a skimmer often is fitted over a card reader, making it easier to see.
"The shimmer is extremely subtle and difficult to spot. It is also able to steal the card data from a chip-based card, thereby bypassing the enhanced security of the new smart-chip system," says David Kennedy, founder and senior principal security consultant of TrustedSec, an information security consulting company. The shimmer records the card data, which then is used to produce a magnetic strip card, he says.
What Should You Do If Your Card Is Skimmed?
While credit card issuers use fraud detection technology and may shut down your card at the first sign of fraud, they don't catch everything. You might not know your card has been skimmed until you notice fraudulent transactions on your account.
If you notice card fraud, contact your issuer right away to limit your liability and cut off card access. Alert the business where you believe the card skimming occurred so a manager can check the reader and prevent additional theft. Contact your local law enforcement agency, the consumer division of your state attorney general's office and the Federal Trade Commission. This might not fix your situation, but it could prevent someone else from being skimmed.
How Can You Protect Yourself From Credit Card Skimmers?
A little caution can go a long way in protecting yourself from credit card skimmers. For example, at a gas pump: