Skimming is the theft of card data from the magnetic stripe or chip without the cardholder's knowledge
Skimming happens when someone uses a hidden device to read your card information while you're making a legitimate transaction. The skimmer captures the data on your card's magnetic stripe or chip—usually your card number, expiration date, and sometimes your name—without taking the card itself. You complete your purchase normally and leave, unaware that your information has been copied.
The stolen data is then used to make fraudulent purchases, either online or by creating a counterfeit card. Because the skimmer operates invisibly during a real transaction, you may not notice the theft until you see unauthorized charges on your statement days or weeks later.
Key Takeaways
- Skimmers are small devices placed over card readers at ATMs, gas pumps, or payment terminals that capture your card data during a normal transaction.
- Magnetic stripe cards are more vulnerable to skimming than chip cards, because the stripe data never changes and can be copied onto a blank card.
- Chip technology and contactless payments reduce skimming risk because the data changes with each transaction and cannot be reused.
- You are not responsible for fraudulent charges if you report them promptly, but your bank may take days to investigate and reverse them.
- Checking your statements regularly and using ATMs in well-lit, monitored locations are practical ways to reduce your exposure.
Where skimmers are typically found
Skimmers most often appear at ATMs and gas pump payment terminals because these are unattended machines where a thief can install a device and leave. The skimmer sits over the real card slot, so your card passes through the fake reader first. Some skimmers are so thin they are nearly invisible, while others are bulkier but still designed to look like part of the machine.
Skimmers also turn up at point-of-sale terminals in restaurants, retail stores, and small businesses, though less commonly. In these cases, a dishonest employee or someone with brief access to the terminal may install internal skimming hardware or software. Outdoor payment terminals—like parking meters or vending machines—are also targets because they sit unattended for long periods.
ATMs at convenience stores, grocery stores, and independent locations are higher-risk than ATMs inside bank branches, which have security cameras and staff presence. Gas pumps at smaller stations or those in remote areas see more skimming activity than pumps at major chains with visible monitoring.
How skimming differs from other card fraud
Skimming is passive data theft—the thief does not interact with you and does not need your PIN or signature. They straightforward copy your card information and leave. Other fraud methods require more direct involvement: a data breach at a retailer exposes thousands of cards at once, a phishing email tricks you into giving up your information, or a lost card is used by whoever finds it.
Skimming also differs because the thief has your full card number and expiration date but usually not your CVV (the three-digit security code on the back). This limits where they can use the data—they can make in-person purchases with a counterfeit card or use the number for online purchases at merchants that do not require the CVV. They cannot easily use it at merchants with strict security checks.
Because skimming targets the magnetic stripe, it became less common as chip technology rolled out. Chip cards generate a unique code for each transaction, so even if a thief copies the chip data, they cannot reuse it. Magnetic stripe data, by contrast, is static and can be copied onto a blank card and used repeatedly.
How banks and card networks reduce skimming risk
Card networks like Visa and Mastercard have pushed chip technology as the standard for in-person payments. Chip readers generate a one-time code that works only for that specific transaction, making the stolen data useless for future purchases. Most U.S. cards now include a chip, though the magnetic stripe remains as a backup for older terminals.
Contactless payments—tap or mobile wallet transactions—further reduce skimming risk because your card never enters a reader. The data transmitted is encrypted and transaction-specific, so even if intercepted, it cannot be reused. Apple Pay, Google Pay, and similar services use this technology.
Banks also monitor accounts for unusual activity. If your card is used in a location you do not normally visit or for a purchase pattern that does not match your history, the bank may flag the transaction and contact you. Fraud detection systems look for multiple small purchases (a common skimming pattern) or a sudden jump in spending.
ATM operators and gas stations install security cameras, use tamper-evident seals on machines, and conduct regular inspections. Some ATMs now have card readers that are harder to cover with a skimming device, and some gas pumps require you to enter a ZIP code before the pump activates, which adds a verification step.
What to do if you notice unauthorized charges
Contact your bank or card issuer as soon as you see a charge you did not make. Most card networks and banks offer zero-liability protection, meaning you are not responsible for fraudulent charges if you report them promptly. The sooner you report, the faster the investigation can begin.
Your bank will likely issue a new card with a new number and may place a temporary hold on your account while they investigate. The investigation typically takes 10 business days, though some banks complete it faster. During this time, the bank will contact the merchant where the fraudulent charge occurred and request documentation.
Once the bank confirms the charge was unauthorized, they will reverse it and credit your account. If the charge was made before you reported it, the bank may temporarily credit your account while the investigation continues, so you have access to the funds when ready.
Keep records of all communications with your bank, including the date and time you reported the fraud, the name of the person you spoke with, and any confirmation numbers. If the bank denies your claim, you can dispute it in writing and request a formal review.
Practical steps to reduce your skimming risk
Use ATMs inside bank branches or well-lit, monitored locations whenever possible. Before inserting your card, tug gently on the card reader and the keypad to see if either piece moves or feels loose—a skimmer is often not secured as firmly as the real hardware. If something feels off, use a different ATM.
At gas pumps, use the pump closest to the station entrance where staff can see it. Pay inside the station instead of at the pump if you are uncomfortable with the terminal. When you do use a pump, cover the keypad with your hand while entering your PIN so a hidden camera cannot capture it.
Check your bank and credit card statements at least weekly, either online or by paper statement. The sooner you spot unauthorized charges, the sooner you can report them. Many banks offer text or email alerts for transactions over a certain amount, which can help you catch fraud quickly.
Use chip readers instead of swiping the magnetic stripe whenever the option is available. If a terminal only has a magnetic stripe slot, ask the cashier if they have a chip reader or if you can pay a different way. Prefer contactless or mobile payments when they are offered.
Frequently Asked Questions
Can a skimmer steal my PIN?
A skimmer on the card reader itself cannot capture your PIN because you enter it on the keypad, not the card reader. However, some skimmers include a hidden camera or overlay keypad to record your PIN as you type. This is why covering the keypad with your hand while entering your PIN is important, especially at outdoor ATMs and gas pumps.
Will my bank refund me if my card is skimmed?
Yes, if you report the fraud promptly. Card networks and banks offer zero-liability protection for unauthorized charges. You are responsible only if you were negligent (for example, you shared your PIN with someone) or if you wait an unreasonably long time to report the fraud. Report suspected fraud as soon as you notice it.
Is a chip card completely safe from skimming?
Chip cards are much safer than magnetic stripe cards because the chip generates a unique code for each transaction. However, skimmers can still capture your card number and expiration date from the chip data, which limits their options but does not eliminate all risk. Contactless and mobile payments offer the strongest protection because no card data is transmitted to the terminal.
What should I do if I find a skimmer on an ATM?
Do not attempt to remove it yourself. Report it to the bank that owns the ATM or to the ATM operator when ready. Provide a description of the device and the location. If you have already used that ATM, contact your bank to monitor your account for fraud. The bank will send someone to inspect and remove the device.
Can skimmers work on online purchases?
No. Skimmers are physical devices placed on card readers, so they only work on in-person transactions. Online fraud uses different methods, such as phishing, data breaches, or stolen card numbers. This is one reason why chip and contactless payments are safer for in-person use—they reduce the risk of your full card data being captured.