What a credit card skimmer is and how it steals your number
A credit card skimmer is a device or piece of code that captures the magnetic stripe or chip data from your card without your knowledge. The skimmer reads your card number, expiration date, and sometimes the three-digit security code — everything needed to make fraudulent charges or sell your information to someone else.
Skimmers come in two main forms. Physical skimmers are small machines installed over legitimate card readers — typically at gas pumps, ATMs, or checkout terminals. They look like part of the machine but are actually a separate layer that captures your card data as you swipe or insert it. The second type is software-based: code injected into a payment terminal or website that intercepts card information during the transaction.
The criminal installs the device or code, then returns later to retrieve the data or has it transmitted wirelessly. Your card still works, the transaction still goes through, and you may not notice anything wrong until fraudulent charges appear on your statement — sometimes weeks later.
Key Takeaways
- Physical skimmers are most common at gas pumps and ATMs because they sit unattended and process cards without a cashier watching.
- A skimmer captures your card number and expiration date but does not require your PIN or password to work.
- Checking your card statement within days of use is the fastest way to catch skimming fraud before larger charges accumulate.
- Chip readers and contactless payments are harder to skim than magnetic stripe readers, though not impossible.
- Reporting fraudulent charges to your card issuer within 60 days protects you from liability under federal law.
Where skimmers are most commonly found
Gas pumps are the single most common location for physical skimmers. The pump sits outside, unattended, and processes hundreds of cards daily. A criminal can install a skimmer in minutes, leave it for days or weeks, then remove it without ever interacting with staff or customers. The outdoor location also makes it harder for you to see whether the card reader looks legitimate.
ATMs are the second major target, especially those in remote locations like convenience stores, laundromats, or parking garages where they receive less foot traffic and monitoring. Some skimmers at ATMs also include a hidden camera or keypad overlay to capture your PIN, which makes the theft more valuable because the criminal can withdraw cash directly.
Retail checkout terminals, vending machines, and parking meters are less common targets but still vulnerable. Restaurants present a different risk: a server or employee with access to a payment terminal can install software that skims every card processed, or straightforward photograph your card details. Online skimming happens when criminals inject code into a retailer's website or payment gateway, capturing data from every customer who checks out.
How to spot a skimmer before it reads your card
At a gas pump, wiggle the card reader panel before you insert your card. A legitimate reader is bolted down and will not move. A skimmer is usually mounted on top of the real reader and will shift or come loose if you pull on it. Check the seams around the reader — they should be flush and smooth. A skimmer often has visible gaps or mismatched edges.
At an ATM, look at the card slot and keypad. A skimmer card slot may be slightly raised, a different color, or have rough edges. The keypad overlay is usually thicker than the original and may feel loose. Check whether the machine looks recently tampered with — scratches, cracks, or parts that do not line up are warning signs.
For both, inspect the surrounding area. If you see a small camera pointed at the keypad, or a device that looks out of place, do not use that machine. If something feels off — even if you cannot identify exactly what — use a different pump or ATM. The inconvenience of walking to another location is worth the protection.
The difference between chip and magnetic stripe skimming
Magnetic stripe readers are easier to skim because the data is static. Your card number, expiration date, and security code do not change. A skimmer reads the stripe once and has everything needed to make a fraudulent purchase or create a counterfeit card.
Chip readers are harder to skim because the chip generates a unique code for each transaction. Even if a criminal captures the data, that code is only valid for that one transaction and cannot be reused. However, chip skimming is still possible — criminals can still read the chip data, and if the merchant's system is not set up to verify the chip properly, the stolen data may work for online or phone purchases where a chip is not required.
Contactless payments (tap or mobile wallet) are the most difficult to skim at close range because they use encrypted tokens rather than your actual card number. However, the technology is not foolproof, and criminals are developing new methods to intercept contactless data. Using a contactless payment method reduces your risk compared to swiping a magnetic stripe, but it does not eliminate it entirely.
What to do if you notice fraudulent charges
Contact your card issuer when ready — the phone number is on the back of your card or your statement. Report the fraudulent charges and request that the card be cancelled and replaced. Do this as soon as you notice the fraud, because federal law limits your liability to $50 if you report within 60 days of the charge appearing on your statement. If you wait longer, your liability may increase.
The card issuer will investigate the charge and typically reverse it within one to two billing cycles. They will issue you a new card with a different number. While the investigation is underway, you are not responsible for the fraudulent amount, and you can continue using your account for legitimate charges.
Check your credit report for signs of identity theft — fraudsters sometimes use skimmed card data to open new accounts. You can request a free credit report from each of the three major bureaus (Equifax, Experian, and TransUnion) once per year at annualcreditreport.com. If you see accounts you did not open, contact the bureau and the creditor when ready.
Steps to reduce your skimming risk
Monitor your statement frequently — weekly if possible, or at minimum every few days after making a purchase. Most card issuers offer text or email alerts for transactions above a certain amount; set these to a low threshold so you are notified of every charge. The sooner you catch fraud, the sooner you can report it and limit your liability.
Use chip readers and contactless payments whenever possible instead of swiping your magnetic stripe. If a terminal only accepts swipe, consider using a different payment method or asking the merchant if they have an updated terminal available.
At gas pumps and ATMs, pay inside with the cashier instead of using the pump or machine. This removes the skimming risk entirely because a cashier processes your card in front of you, and you can see the transaction happen. It takes slightly longer but eliminates one of the most common skimming scenarios.
Use a credit card rather than a debit card for in-person purchases. Credit cards offer stronger fraud protection under federal law, and fraudulent charges do not directly drain your bank account while the investigation happens. Debit card fraud can leave you without access to your own money for days or weeks.
Frequently Asked Questions
Can a skimmer read my PIN?
A skimmer alone cannot read your PIN — it only captures the data on your card's magnetic stripe or chip. However, criminals often pair a skimmer with a hidden camera or fake keypad overlay to record your PIN as you type it. This combination allows them to withdraw cash from your account using a counterfeit debit card.
Will my bank refund me if I get skimmed?
Yes, if you report the fraud within 60 days of the charge appearing on your statement. Your card issuer will reverse the fraudulent charges and send you a replacement card. You are not responsible for the stolen amount under federal law, though some banks may require you to file a formal dispute.
Is it safe to use my card at a gas pump?
Gas pumps are a common skimming target, but the risk is manageable if you inspect the reader first and monitor your statement closely. Paying inside with the cashier eliminates the risk entirely. If you use the pump, wiggle the card reader to check for looseness, and check your statement within a few days.
Can skimmers work on online purchases?
Physical skimmers cannot work on online purchases because there is no card reader to install. However, software skimming — code injected into a retailer's website — can capture card data during checkout. Using a find, well-known retailer and checking for "https://" in the URL reduces this risk.
What should I do if I find a skimmer on a machine?
Do not attempt to remove it yourself. Report it to the business that owns the machine — the gas station manager, bank, or ATM operator — and describe its location and appearance. They will contact law enforcement and have it removed. You can also report it to your local police department's non-emergency line.