Card skimming: how skimmers work and how to spot them

What a skimmer actually is

A skimmer is a small device illegally installed on or inside a card reader — an ATM, a point-of-sale terminal, or a fuel pump — that copies the data from your card’s magnetic stripe as you swipe. The Federal Trade Commission describes them as illegal card readers that “grab data off a credit or debit card’s magnetic stripe without your knowledge.”

Some skimmers read the stripe and store the data for later download; others transmit it wirelessly to a nearby thief. The stolen data is either sold or used to make a counterfeit card that works in stores and online. The FDIC notes that with that data, “a thief can go on an online shopping spree or sell that valuable data to other con artists.”

The one thing skimmers cannot do is get your PIN by reading your card — which is why skimming setups so often pair the card reader with a hidden camera or a fake keypad overlay that records the number you type.

Where skimmers hide

Gas pumps are the classic target because they are unattended, outdoor, and identical to one another — a skimmer attached to one pump can sit there for weeks. The FTC’s gas-pump warning is blunt: check that the pump panel is closed and shows no signs of tampering, compare the card reader to the other readers at the station, and try to wiggle it before inserting your card. If it moves, tell the attendant and use a different pump.

ATMs are the second most common hiding spot. Thieves fit a card-reader overlay over the slot where your card goes, and it reads your card as it passes through. The FDIC recommends looking for anything loose, crooked, scratched, or with visible glue or tape, and being suspicious of a card reader that does not let your card slide in easily.

Retail point-of-sale terminals get skimmed too, especially fast counters and checkout areas where you are in a hurry. The same inspection applies everywhere: if the reader looks different from the ones nearby, pay inside or use another register.

Why you never notice at the time

Skimming produces no immediate sign. Your card still works, the transaction still goes through, and the skimmer’s reader copies the stripe data in the same swipe that processes your payment. The FDIC points out that criminals also target low-dollar amounts as a test — a small charge that looks like nothing to you confirms the stolen card works before they spend at scale.

The gap between the skim and the fraud is part of the design. Thieves often wait weeks or months before using the stolen data, so the purchase you cannot explain usually has no connection to where you were that day. That delay is why the first sign of skimming is almost always an unexpected charge on a statement — not anything that happened at the terminal.

If you think your card was skimmed

1. Call your card issuer immediately Report the card compromised so it can be frozen or replaced. Reporting quickly matters most for debit cards, where liability grows the longer you wait.
2. Review recent transactions Look for small test charges as well as large ones. Report every transaction you do not recognize, no matter the size.
3. Update stored payment details Any merchant with the old card number on file — subscriptions, app stores, ride apps — needs the new number once the card is reissued.
4. Report the terminal Tell the business whose machine you suspect, and file a report at ReportFraud.ftc.gov. The details you provide help others.

Liability limits when your card is compromised

Federal law caps what you can lose on a compromised card, and the limits depend on card type and how fast you report. The FTC’s guidance on lost and stolen cards covers the full breakdown: report a lost debit card before it is used and you owe nothing; report within two business days and your maximum loss is $50; wait longer and the cap rises to $500.

Credit cards are more forgiving: the Truth in Lending Act caps liability at $50 for unauthorized use, and most issuers go further and waive it entirely with a zero-liability policy. The practical rule from every agency is the same — report promptly, because your liability literally grows with delay.