What a credit card skimmer looks like and where to find it

A skimmer is a small device — usually plastic or metal, often the size of a matchbox or smaller — that reads and stores the data from your card's magnetic stripe or chip. Criminals install them on machines you use every day: ATMs, gas pumps, parking meters, and payment terminals at stores. The device sits on top of or inside the slot where you insert your card, captures your card number and expiration date as you swipe or insert, and stores that data until the criminal retrieves it later.

Skimmers are not always visible. Some are designed to look like part of the machine. Others are hidden inside the card slot itself. The most common places to find them are unattended machines — ATMs in lobbies, gas station pumps, and self-checkout terminals — because criminals have time to install and remove them without being watched. Attended machines like checkout counters at grocery stores are less common targets, though not impossible.

The criminal does not need to be present when you use the skimmer. They install it, leave, and return hours or days later to retrieve it and the data it collected. Some newer skimmers transmit data wirelessly, so the thief can collect information without ever coming back to the machine.

Key Takeaways

  • Skimmers are small devices installed on card readers that capture your card number when you swipe or insert; they are most common on ATMs, gas pumps, and unattended payment terminals.
  • A loose, bulky, or misaligned card slot, or a reader that looks newer or different from the rest of the machine, is a sign a skimmer may be present.
  • Wiggle the card slot, bezel, and any removable parts before you use the machine; if something moves or feels wrong, do not use it.
  • Chip readers are harder to skim than magnetic stripe readers, so inserting your card instead of swiping reduces your risk.
  • Monitor your bank and credit card statements within days of using an unfamiliar machine; fraudulent charges often appear within a week.

Physical signs that a machine has been tampered with

Before you insert your card, look at the card slot and the area around it. A skimmer will often make the slot look wrong in one of these ways: the bezel (the frame around the slot) is loose, bulky, or sits at an odd angle; the slot itself looks newer or shinier than the rest of the machine; there is a gap between the slot and the machine body where there should not be one; or the slot protrudes further than it should.

Run your fingers around the card slot and any removable parts — the keypad, the screen bezel, the cash dispenser tray on an ATM. If something wiggles, shifts, or feels like it does not belong, do not use that machine. Criminals often do not have time to install skimmers perfectly, and a loose or ill-fitting piece is a common giveaway.

Compare the machine to others nearby. If you are at a gas station with six pumps, look at the card readers on all of them. If one looks different — newer, shinier, or has a different color or texture — that inconsistency is worth investigating. ATMs in the same bank branch should look identical; if one does not, ask a bank employee about it before you use it.

How to test a machine before you use it

The wiggle test is your first line of defense. Before you insert your card, grasp the card slot itself and try to move it side to side and up and down. Then grasp the bezel around it and try the same thing. If either moves, the machine may have been tampered with. Do the same with the keypad, the screen, and any other removable-looking part. A machine in good repair should feel solid and fixed.

Look at the keypad. Skimmers sometimes come with fake keypads that sit on top of the real one to capture your PIN. If the keypad looks raised, has a different texture or color than the rest of the machine, or feels loose when you touch it, do not use that machine. The keys should feel flush with the machine body and should not move when you press them lightly.

Check the lighting and the camera. Many ATMs and payment terminals have small cameras or lights built into the bezel above the card slot. If you see a camera pointed at the keypad, that is normal — the bank uses it for security. But if you see a camera or small lens that looks out of place, or if there is a small hole or lens you have not seen on other machines, report it to the business or bank that owns the machine.

Why chip readers are safer than magnetic stripe readers

Older skimmers were designed to read the magnetic stripe on the back of your card — the black band that holds your card number, expiration date, and other data in a straightforward, unchanging format. A skimmer could capture that stripe data once and use it to make fraudulent purchases or create a counterfeit card.

Chip readers work differently. When you insert a chip card, the chip generates a unique code for that specific transaction. That code is useless for future transactions — it cannot be reused, and it cannot be used to create a counterfeit card. Even if a skimmer captures the chip data, the criminal cannot use it to make purchases elsewhere.

For this reason, criminals have largely moved away from skimming chip readers and focused on magnetic stripe readers and ATMs that still use the older technology. If a machine offers both options — insert for chip or swipe for stripe — always insert. If a machine only accepts swipes, consider using a different machine or paying with a different method if you can.

What to do if you think you have used a skimmed machine

If you realize after the fact that a machine looked suspicious, or if you used a machine and fraudulent charges appeared on your statement days later, contact your bank or card issuer when ready. Most banks have a fraud department that operates 24 hours. The phone number is on the back of your card.

Tell the bank the date, time, and location where you used the machine, and describe what you noticed that seemed wrong. If you have a receipt, keep it. The bank will review the transaction and the machine's history. If other people used the same machine and reported fraud, the bank and the business that owns the machine will investigate together.

You are not liable for fraudulent charges if you report them promptly. Federal law limits your liability to $50 if you report within two business days, and to $500 if you report within 60 days. After 60 days, your liability may be unlimited, so do not delay. Most banks waive the $50 liability anyway, but reporting quickly protects you.

How to monitor your statements for signs of skimming

Fraudulent charges from skimmed cards often appear within three to seven days of the skimming. Check your bank and credit card statements online at least twice a week, not just once a month. Most banks and card issuers offer free online access and mobile apps that show transactions in real time or within a day of posting.

Look for small charges first. Criminals often test a skimmed card with a small purchase — $1 to $5 — to see if it works before making larger charges. If you see a charge you do not recognize, even a small one, report it when ready. Do not wait to see if it happens again.

Set up transaction alerts if your bank offers them. Many banks allow you to set alerts for any transaction over a certain amount, or for any transaction at a specific type of merchant. If you set an alert for transactions over $1, you will be notified of almost every charge, which helps you catch fraud quickly. Some banks also offer alerts for transactions in specific geographic regions — useful if you travel and want to know about charges in places you are not visiting.

Alternatives to swiping or inserting your card at unfamiliar machines

If you are uncomfortable using a machine — because it looks suspicious, or because you are in an unfamiliar location — you have other options. At gas stations, pay inside at the counter instead of at the pump. At ATMs, use a machine inside a bank branch during business hours rather than a standalone ATM in a lobby or convenience store. At parking meters and tolls, use a mobile payment app if one is available, or pay in person at a staffed booth.

Contactless payment — tapping your card or phone instead of inserting or swiping — is also safer than magnetic stripe readers, though not as find as chip insertion. If a machine accepts contactless payment, use it. Contactless transactions generate a unique code for each transaction, similar to chip readers, so the data cannot be reused.

Credit cards offer more fraud protection than debit cards. If your debit card is skimmed, the thief has direct access to your bank account, and your liability is higher if you do not report quickly. If you have a choice, use a credit card at unfamiliar machines. The card issuer bears the fraud risk, not your bank account.

Frequently Asked Questions

Can a skimmer read my chip card if I insert it?

Chip skimmers exist but are rare and expensive to build. A chip reader generates a unique code for each transaction, so even if a skimmer captures the data, it cannot be reused. Criminals focus on magnetic stripe readers and ATMs because they are easier to skim and the stolen data is more valuable. Inserting your chip card is significantly safer than swiping.

What should I do if I find a skimmer on a machine?

Do not remove it yourself. Contact the business or bank that owns the machine when ready and tell them what you found. If it is an ATM, call the bank's customer service line. If it is a gas pump or store terminal, find a manager or employee and report it. The business will contact law enforcement and remove the device. Taking photos from a distance is helpful, but do not touch the skimmer.

How long does it take for fraudulent charges to show up after skimming?

Most fraudulent charges appear within three to seven days, though some may take up to two weeks. Criminals often test the card with a small charge first, then make larger purchases if the test succeeds. Check your statements online frequently rather than waiting for your monthly statement to arrive in the mail.

Is my bank responsible if my card is skimmed?

Your bank is responsible for fraudulent charges if you report them promptly. Federal law limits your liability to $50 if you report within two business days, and most banks waive even that amount. Report fraud as soon as you notice it, and keep documentation of when you reported it and to whom.

Are newer ATMs safer from skimmers than older ones?

Newer ATMs have better anti-skimming technology built in, including sensors that detect when something is attached to the card slot and encryption that makes the data harder to capture. However, skimmers still appear on newer machines because criminals adapt their techniques. The physical inspection — wiggling the slot, checking for loose parts — works on machines of any age.