Skimmers take whatever they can access through your debit card number and PIN

A skimmer is a device or software that captures your debit card information—usually the card number, expiration date, and sometimes your PIN. What happens next depends on what they got and how quickly you notice. They don't automatically drain your entire checking account. Instead, they either make small purchases that slip past you, or they sell your card details to someone else who does. The damage is real, but it's not when ready or unlimited.

The key difference between a skimmer and other fraud is that skimmers work passively. A criminal installs a device on an ATM or gas pump, or uses malware on a website, and collects card data from dozens of people over weeks. They're not targeting you specifically—they're casting a wide net. Once they have your number, they test it with small charges to see if it works, then either escalate or move on to the next card.

Your checking account itself—the actual balance sitting in the bank—is harder to touch than your debit card number. That's the distinction that matters. Your card is a key to the account, but it's not the account. Skimmers get the key, not the lock.

Key Takeaways

  • Skimmers capture your debit card number and PIN, not your account login or password, so they cannot access your online banking directly.
  • Fraudsters typically test stolen card numbers with small purchases first, then escalate to larger charges if the card stays active.
  • Your bank's fraud detection usually catches unusual activity within hours or days, which is why many skimmed cards are caught before major damage occurs.
  • You are not liable for unauthorized debit card charges if you report them within two business days of discovering the fraud.
  • Checking your account regularly—at least weekly—is the fastest way to catch skimmer fraud before it spreads.

How skimmers actually use your card number once they have it

Once a skimmer has your debit card number and PIN, they have a few options. The simplest is to create a counterfeit card—they encode your number onto a blank card and use it at stores or ATMs. This works until you notice the charge and report it, or until the card expires. The second option is to sell your number to someone else on the dark web, where it trades for anywhere from a few dollars to $50 depending on how much data came with it. The third is to use your number for online purchases, which requires only the card number, expiration date, and CVV (the three-digit code on the back).

What they cannot do with just your card number is log into your online banking account or transfer money directly from your checking account. That requires your username, password, and usually a second authentication step—a code sent to your phone or generated by an app. A skimmer doesn't get those. If a criminal has your username and password, that's a different attack: they phished you, or they bought your credentials from a data breach. That's more dangerous than a skimmer, because they can move money without ever touching your debit card.

The typical pattern is small charges first. A skimmer will test your card with a $1 or $2 purchase at a gas station or online retailer. If it goes through and you don't report it when ready, they escalate. They might charge $50, then $100, then try to max out the card. If you catch it early, the damage stays small.

Why your bank usually stops skimmer fraud before you do

Banks run fraud detection software that flags unusual activity. If your card is normally used in one city and suddenly charges appear in another state, or if you make one purchase a week and suddenly there are five in an hour, the system catches it. The bank may decline the transaction, freeze your card, or call you to confirm. This happens automatically, without you having to do anything.

The timing varies. Some banks catch fraud within hours. Others take a day or two. A few slower systems might miss it for a week, which is why checking your account yourself matters. You are your own backup. If you log in weekly and scan your transactions, you'll spot a skimmer charge before the bank's system does in many cases.

When the bank does catch it, they typically reverse the charge when ready and issue you a new card. You don't pay for the fraudulent transaction. The bank eats the loss, which is why they have fraud detection in the first place—it's cheaper to catch fraud early than to fight chargebacks and refund disputes later.

What happens to your checking account balance during skimmer fraud

Your actual account balance—the money sitting in your checking account—only goes down by the amount of fraudulent charges that post. If a skimmer makes a $50 charge and your balance is $2,000, you now have $1,950. That's it. They don't get access to the full $2,000 just because they have your card number. The card is a spending tool, not a master key to the account.

The risk is that multiple charges add up quickly. If a skimmer makes ten $100 charges in a day, that's $1,000 gone. If your account has overdraft protection linked to a savings account or credit line, the bank may cover charges that exceed your balance, and you'll owe that money back. If you don't have overdraft protection, charges may be declined once you hit zero, which stops the bleeding but can trigger overdraft fees anyway.

This is why catching skimmer fraud fast matters. The longer it goes undetected, the more charges post and the deeper the hole. But there's a ceiling: they can only charge what your card will allow, and your card has a daily limit set by your bank (often $500 to $2,500 per day for debit cards, though this varies).

Steps to take if you think your card has been skimmed

First, call your bank's fraud line when ready. The number is on the back of your card or in your online banking portal. Tell them you suspect fraud and ask them to freeze or cancel the card. They will do this right away—it takes seconds. Do not wait for the bank to call you.

Second, ask the bank to reverse any fraudulent charges. If you report within two business days, you are protected under federal law and are not liable for unauthorized charges. If you wait longer, your liability can increase, though most banks will still help you if you report within 60 days. Get a confirmation number for the fraud report.

Third, request a new card. The bank will mail it to you, usually within 5 to 10 business days. Ask if they can expedite it. In the meantime, you can use your old card for online banking—it still works for that—or ask for a temporary card number for online shopping.

Fourth, check your credit report for new accounts opened in your name. Go to annualcreditreport.com (the official free site) and pull your report from all three bureaus: Equifax, Experian, and TransUnion. A skimmer usually doesn't have enough information to open new accounts, but if they do, you want to know fast. If you see accounts you didn't open, file a dispute with the credit bureau and consider placing a fraud alert on your file.

How to reduce your risk of getting skimmed

Check your account weekly. Log into your online banking and scan your transactions. You don't need to read every charge—just look for anything you don't recognize. This is the single most effective defense. Most people who catch skimmer fraud early do it by checking their account, not by waiting for the bank to call.

Use ATMs inside banks rather than standalone machines in convenience stores or gas stations. Skimmers target high-traffic machines where they can install a device and collect dozens of cards before anyone notices. Bank ATMs are monitored more closely and the machines are serviced more frequently.

Cover the keypad when you enter your PIN. Skimmers sometimes install tiny cameras above the keypad to record PINs. Shielding the keypad with your hand makes this harder.

Use your debit card less for in-person purchases. Credit cards offer stronger fraud protection in most cases, and you're not spending money directly from your checking account. If fraud happens on a credit card, the bank's money is at risk, not yours, so they fight harder to reverse it.

Enable transaction alerts on your checking account. Most banks let you set up notifications for charges over a certain amount, or for any charge at all. You'll get a text or email within minutes of a transaction posting. This gives you the fastest possible warning if your card is being used fraudulently.

Skimmers versus other ways your checking account can be compromised

A skimmer is one type of fraud, but not the only one. If someone has your online banking username and password, they can transfer money directly from your account without touching your debit card. If someone has your account number and routing number (printed on the bottom of your checks), they can set up unauthorized ACH transfers or bill payments. If you've been phished—tricked into entering your login on a fake website—a criminal can drain your account entirely.

These attacks are more dangerous than skimmers because they bypass your debit card's daily limits and go straight to the account. A skimmer is limited by what your card can spend. A direct account compromise has no such limit.

The good news is that these attacks are also rarer and easier to prevent. Don't share your account number or routing number with anyone you don't trust completely. Don't click links in emails claiming to be from your bank—go directly to the bank's website instead. Use a strong, unique password for online banking. Enable two-factor authentication if your bank offers it. These steps stop most account takeovers before they start.

Frequently Asked Questions

Can a skimmer drain my entire checking account in one day?

No. Skimmers are limited by your debit card's daily spending limit, which is usually $500 to $2,500 depending on your bank. They also can't access your account directly—only through the card. If you have $10,000 in your account and your card limit is $1,000 per day, a skimmer can charge at most $1,000 before the card is declined. The bank's fraud detection usually catches it before that.

If I report a skimmer charge, do I get my money back?

Yes, if you report it within two business days of discovering the fraud. The bank will reverse the charge and credit your account, usually within 5 to 10 business days. You are not liable for unauthorized debit card charges under federal law. If you report after two business days but within 60 days, the bank may still help you, but your liability can increase up to $500 per card.

How do I know if my card has been skimmed?

Check your account weekly for charges you don't recognize. Most skimmed cards show test charges of $1 to $5 first, followed by larger charges if you don't report them. You might also see charges in a city you didn't visit, or multiple charges in a short time. If your bank detects fraud, they'll call or text you. If you see anything suspicious, call your bank's fraud line when ready.

Is my checking account safer than my savings account from skimmers?

No. Skimmers target whichever account is linked to your debit card. If your debit card draws from your checking account, that's what's at risk. If you have a debit card linked to savings, that's at risk too. The account type doesn't matter—the card does. Keep your savings account separate and don't link it to a debit card if you want to reduce skimmer risk.

What if I don't have a debit card—can I still get skimmed?

Not in the traditional sense. Skimmers specifically target debit cards because they're physical objects that can be cloned or used to make charges. If you use only online banking and credit cards, you don't have a debit card to skim. You can still be defrauded through phishing, account takeover, or unauthorized ACH transfers, but those are different attacks and require different defenses.