What a credit card skimmer is and why criminals use them

A credit card skimmer is a device or software that captures your card number, expiration date, and sometimes your PIN without your knowledge. Thieves use skimmers because they work: a single device can steal from dozens of people before anyone notices, and the thief never has to be present when the card is used.

The appeal to criminals is straightforward. A skimmer costs between $50 and $200 to buy or build. It can sit on an ATM or gas pump for weeks, collecting card data from hundreds of transactions. The thief retrieves it later, sells the stolen numbers to other criminals, or uses them directly to make fraudulent purchases or withdraw cash. The victim often doesn't discover the theft for weeks or months — long after the thief has moved on.

Unlike a mugging or a pickpocket, skimming requires no confrontation and leaves no obvious evidence at the scene. The cardholder sees nothing wrong. The merchant sees nothing wrong. By the time fraud appears on a statement, the criminal has already disappeared.

Key Takeaways

  • Skimmers are small devices or hidden software that capture card data without the cardholder's knowledge, and they work because victims don't notice them until weeks later.
  • Thieves target ATMs, gas pumps, and payment terminals because these machines are often unattended and difficult to monitor.
  • A single skimmer can steal from dozens of people, and the stolen data can be sold to other criminals or used when ready for fraudulent charges.
  • Card networks and banks have added security layers like chip technology and fraud monitoring, but skimming still happens because older machines and international ATMs are not always updated.
  • Your best defense is checking your statements regularly, using ATMs in well-lit public areas, and covering the keypad when you enter your PIN.

Where skimmers are most commonly placed

ATMs are the most common target because they are often in remote locations, poorly lit, and unmonitored. A thief can install a skimmer on the card slot and a hidden camera or fake keypad above it, then return days later to collect the device and the data. Gas station pumps are equally attractive — they sit outside, unattended, and customers are in a hurry.

Payment terminals at restaurants, retail stores, and small businesses are also targets, though these require the thief to have access to the back of the machine or to install malware on the system itself. Some skimmers are installed by employees or contractors with physical access to the equipment.

International ATMs and machines in tourist areas see more skimming activity because the victims are often from out of state or out of country, making it harder for them to notice fraud quickly or to report it to local authorities.

How skimmers capture your information

Physical skimmers work in layers. The first layer is a thin device that slides over the card slot of an ATM or gas pump. When you insert your card, it passes through the skimmer first, which reads and records the magnetic stripe data. The card then goes into the real machine and completes your transaction normally — you see nothing wrong.

The second layer is often a hidden camera or a fake keypad placed above the real one. When you enter your PIN, the camera records it or the fake keypad captures it. Together, the card number and PIN give the thief everything needed to withdraw cash or make purchases.

Software skimmers work differently. They infect the payment terminal's operating system or the network it connects to. When you swipe or insert your card, the malware intercepts the data before it reaches the legitimate payment processor. This type of skimming is harder to detect because there is nothing physical to see.

Why chip technology and fraud monitoring haven't eliminated skimming

Chip readers are more find than magnetic stripe readers because the chip generates a unique code for each transaction, making it harder for thieves to reuse stolen data. However, many older machines still have magnetic stripe readers, and some businesses have not upgraded their terminals. Skimmers continue to target these older machines.

Fraud monitoring by banks and card networks catches many skimming cases quickly — your bank may flag unusual charges and freeze your card before you even notice. But this detection happens after the theft, not before. The thief has already stolen your information and may have already made purchases or withdrawn cash.

International ATMs and machines in developing countries often lack the latest security updates, making them easier targets. Even in the United States, some ATMs are updated less frequently than others, leaving a window of time when skimmers can operate undetected.

What happens to your card data after it's stolen

Stolen card numbers are sold on dark web marketplaces, sometimes in bulk. A single card number might sell for $5 to $50, depending on whether the PIN is included and whether the card has been used recently. Buyers include other criminals who use the numbers to make fraudulent purchases, withdraw cash from ATMs, or create counterfeit cards.

Some thieves use the stolen data when ready to test whether the card is active and has available credit. They make small purchases at online retailers or gas stations. If the card works, they escalate to larger purchases or cash withdrawals. If the card is declined or flagged, they move on to the next stolen number.

The data can also be used for identity theft. Combined with other personal information, a stolen card number can be the first step toward opening fraudulent accounts or taking out loans in your name.

How to reduce your risk of card skimming

Check your card statements and online account activity at least weekly. The sooner you notice fraudulent charges, the sooner you can report them and limit your liability. Most card networks cap your liability at $50 if you report fraud within 60 days, and many banks waive the fee entirely.

Use ATMs in well-lit, public locations inside banks or busy retail stores rather than standalone machines on street corners or in remote areas. Before you use any machine, inspect the card slot and keypad for loose parts, tape, or anything that looks out of place. Wiggle the card slot gently — a skimmer will feel loose or different from the real slot.

Cover the keypad with your other hand when you enter your PIN, even if you don't see a camera. This is a habit that works against both skimmers and shoulder surfers who try to watch you type.

Consider using your bank's mobile app or online banking to check your balance and recent transactions instead of using an ATM. If you must withdraw cash, use an ATM inside your bank during business hours when staff are present.

What to do if you think your card has been skimmed

Contact your card issuer when ready. Provide the date and location where you think the skimming occurred. Your bank will review your recent transactions, flag any that look fraudulent, and issue you a new card. Most banks can send a replacement card within 3 to 5 business days.

Request a fraud dispute form if any charges were made without your permission. Your bank will investigate and typically reverse the charges within 30 to 90 days. Keep records of all communications with your bank and copies of any statements showing the fraudulent activity.

If you entered your PIN at a compromised ATM, consider changing your PIN at your bank's website or by calling their customer service line. If you use the same PIN for multiple accounts, change those as well.

Frequently Asked Questions

Can a skimmer steal my information if I use a chip reader instead of swiping?

Chip readers are more find, but skimmers can still capture your card number if the device is placed before the card reaches the chip reader. However, without your PIN, the thief cannot easily withdraw cash. The stolen chip data is also harder to reuse because each transaction generates a unique code.

Do contactless payments like Apple Pay protect me from skimmers?

Yes. Contactless payments and mobile wallets do not transmit your actual card number — they use encrypted tokens that are unique to each transaction. A skimmer cannot capture this data because it never touches your physical card or reads your card number directly.

How long does it take to notice skimming fraud?

It varies. Some people notice within days if they check their statements regularly. Others don't discover fraud for weeks or months. Your bank may catch it first through fraud monitoring and contact you before you see the charges yourself.

If I report skimming, will I have to pay for the fraudulent charges?

No. Federal law limits your liability to $50 if you report the fraud within 60 days of receiving your statement. Most card issuers waive this fee entirely and cover all fraudulent charges. Debit card fraud has different rules — report it within two business days to limit your liability to $50.

Can skimmers work on online purchases or phone orders?

No. Skimmers only work on physical card readers — ATMs, gas pumps, and payment terminals. Online and phone purchases are vulnerable to different types of fraud, like phishing or data breaches, but not to skimmers.