The way we pay has evolved greatly over the years, from barter to coins and then later to paper money and checks. Each of those payment methods had its own weaknesses and vulnerabilities: Checks can be forged, money can be stolen, and, unfortunately, you can’t conveniently carry enough chickens for large purchases.
For the better part of the last decade, carrying physical cash has been on the decline, with credit cards becoming the preferred payment method for many of us. For all of the convenience credit cards bring, they aren’t without vulnerabilities. One persistent threat to card users is something known as skimming — the use of an illicit card reader to steal the data from your credit card. Unlike many other threats, this is one you can often spot and avoid if you know what to look for.
Here, we’ll break down what credit card skimming is and how you can keep your card info away from scammers. Let’s get into it!
What is Skimming?
While skimming is something most of us have probably associated with pool maintenance, credit card skimming has become a way for scammers to get all of your credit card info without needing to physically steal the card from you.
There are two types of skimming:
- Physical Skimming: Criminals attach skimmers — devices that look like credit card terminals, but send information to whoever installed them — to common locations like ATMs, gas pumps, and point-of-sale systems.
- Digital Skimming: Criminals use phishing techniques (or cyberattacks) to quietly steal payment information, either through fake checkout screens or compromised e-commerce platforms.
Avoiding digital skimming is mostly about steering clear of phishing, smishing, quishing, and every other fill-in-the-blank-ing that involves victims clicking links or scanning malicious QR codes. If you’re curious about those, feel free to check out the linked articles (just click on the word you’re interested in) to learn more.
Today, however, we’ll be focusing on physical skimming, so let’s get back to that!
What’s a Skimmer?
Like we mentioned above, skimmers are devices that criminals install on payment terminals that look exactly like the real terminal. Think the kind you use at gas stations, ATMs, or really any other place you might swipe your credit card.
How Do Skimmers Work?
Criminals often construct a card reader of their own, designing it to resemble and fit over the machine’s legitimate card reader. When you insert your credit card, it’s read by the legitimate machine and everything seems to work as it should (which is why you’re still able to buy gas, for example), but the skimmer also gets access to all the information stored on your card.
The criminals then either return periodically to retrieve data from the skimmer manually or have the information wirelessly sent to them. Once they have your name, credit card number, and security code, they can then go on an online shopping spree or may even go so far as to create a working duplicate of your card to use in person (or sell on the dark web).
What Does a Skimmer Look Like?
Skimmers look just like whatever payment terminal they fit over. Meaning you often won’t notice anything out of the ordinary with a quick glance or swipe of your card.
How to Spot a Skimmer
Although skimmers aren’t immediately identifiable, the good news is that a little investigating can go a long way.
Here are some tips to spot a credit card skimmer:
- Inspect the payment terminal: The illicit reader needs to be installed over the legitimate one, so give the machine a good once-over before inserting your card. If it looks misaligned or weird in some way, it might be worth taking a few extra precautions before feeding it your credit card.
- Try to wiggle the card reader: Legitimate card readers won’t be loose or easy to move. If you can wiggle the terminal, it’s likely that you’ve just discovered a skimmer.
- Check for broken security seals: On a gas pump, there’s often a security seal right at eye level to show whether the panel has been opened and tampered with. The access panels on ATMs usually have similar seals, though they’re not as obvious.
Tips for Avoiding Credit Card Skimmers
Knowing how to spot a skimmer is important in situations where you’re options are limited, but if you’re worried about it, there are some things you can do to reduce your odds of a skimmer encounter:
- Use a contactless credit card that allows tap to pay.
- Go inside when paying or withdrawing cash.
- After giving the PIN pad a good wiggle/pull, cover the keypad before entering your PIN.
Debit Card Skimmers
Getting your credit card info can give criminals a chance for a little shopping; getting your debit card information can give them a big payday. Because debit cards give access to all of your funds, criminals also want your PIN if they can get it. To do this, they’ll either install a new keypad over the legitimate one on bank ATMs, mount a small camera somewhere with a good vantage point of the PIN pad, or even do a little “shoulder surfing,” where they appear to be casually waiting to use the machine but are actually watching or even recording you enter your PIN.
Where Are Common Places for Skimmers?
We’ve talked about gas stations and ATMs quite a bit, but not every location is an equal target. Generally, skimmers are likelier at less-trafficked locations, where constant interruptions are less likely.
Busy, well-lit spots are problematic for the criminals, so they favor quieter locations with less lighting and few or no security cameras. Inside stores, they’ll gravitate to machines that aren’t monitored by security cameras and are blocked from the cashier’s view (good store design can eliminate that risk).
At gas stations, the outermost pumps (facing away from the cashier) are relatively easy to meddle with without being seen. Again, watch for a lack of lighting and the absence of security cameras. If the location seems favorable to skimmers, scrutinize it closely.
What To Do If You Spot a Credit-Card Skimmer
If you believe you’ve spotted a skimmer in the wild, your first response should be the obvious one: Don’t use that machine. Next, report the incident to your local police — because you have, after all, detected a crime in progress — and, if it’s during regular business hours, to the business’s management. There is a possibility that a rogue staffer may sometimes be an active participant in the skimming scheme, so simply reporting it to whoever’s working might not get the job done.
What To Do If Your Card Has Been Compromised
If you’re warned that your card may have been compromised, either from Spokeo Protect or news coverage of a skimming ring, there are some steps you should take.
- Alert your credit card issuer: Let your credit card company know immediately, so they can freeze the card and work on reversing any fraudulent charges.
- Place a credit freeze or credit lock: If you suspect you’re at risk but haven’t yet seen any illicit activity on your card, you might place a credit freeze or credit lock with the credit-reporting agencies. That makes it harder for scammers to open up new credit in your name.
- File a fraud alert with the credit-reporting agencies: Place a fraud alert with the main credit-reporting agencies and report your problem to the FTC’s ReportFraud website (or IdentityTheft.gov, if your credit-card problem seems to be part of a larger identity-theft issue).
- File a police report: In order to help stop the criminals from claiming more victims, file a report with your local police station. This can also potentially help you get fraudulent charges reversed in the case of an investigation by your bank.
Ultimately, protecting yourself from this kind of crime comes down to your own vigilance: both in person whenever you use your cards and by paying attention to your own accounts and credit report. Unlike so many risks of modern life, this is one you can — at least in part — manage and control.
Cyrus Grant is a writer from Southern California with a background in law and dispute resolution. When he isn’t writing, he can be found deep-diving into the latest technology trends or simply spending time at the beach.