Card Skimming: How to Spot It and What to Do Afterward

What card skimming is

Card skimming is the use of a hidden electronic device to record card data at a payment machine. The U.S. Secret Service describes it as criminal groups installing hidden electronic devices that record cardholder information at ATMs and point-of-sale terminals. The machine still works, the purchase goes through, and the data is copied on the way past.

Most setups have two parts. One reads the card. The other captures the PIN, usually a pinhole camera aimed at the keypad or a thin fake keypad laid over the real one. The FDIC lists card-reader overlays, hidden cameras, PIN-capture overlays, and full faceplates that hide several devices at once.

A fuel pump or an ATM is a public machine that a customer cannot open or inspect inside. Missing a device says nothing about the person using the machine. The check below is worth doing because it is cheap and fast, not because skipping it makes anyone responsible for a crime.

The five-second check at a fuel pump

At a fuel pump, the check is a tug, a look at the seal, and a look at the keypad. It takes about five seconds and it catches the loose external devices, which are the common ones. It will not catch a device installed inside the pump cabinet.

1. Pull on the card reader. A reader that shifts, rocks, or comes away from the housing is a reason to move to another pump and tell the attendant.
2. Look at the security seal on the cabinet panel. The FTC notes that many stations put security seals over the cabinet panel, and that the label reads “void” once the panel has been opened. A broken, voided, or missing seal is the clearest outside signal there is.
3. Compare the pump with the one next to it. Devices usually go on one or two pumps, not all of them. A reader, keypad, or bezel that does not match its neighbors is worth a second look.
4. Look at the keypad. The FDIC warns that a keypad overlay might be fake if it looks too thick or different from what you are used to seeing. Spongy keys or a raised edge both count.
5. Prefer the pump in view of the counter. Installing a device takes time and privacy, so the pumps farthest from the window get chosen more often.

If you can, tap the card or use the chip instead of swiping. The Secret Service recommends contactless payment or the card’s EMV chip instead of the magnetic stripe. If a pump only takes a swipe, paying inside at the register is an option.

What to check at an ATM

At an ATM, check the card slot, the area above the keypad, and anything that looks stuck on rather than built in. The Secret Service also suggests choosing the machine carefully: use ATMs inside financial institutions, in interior bays with security cameras, or closest to the drive-up window.

The FDIC says to be suspicious if your card does not easily go into the machine, or if the card reader appears loose, crooked or damaged, or if you notice scratches, glue, adhesive tape or other possible signs of tampering. It also names brochure holders and small plastic additions as common hiding places for a camera. Cover the keypad with your other hand while typing the PIN. That defeats a camera, though not a keypad overlay, which is why the keypad gets its own look.

Why the magnetic stripe is the target

The magnetic stripe carries the same static data every time it is read, which is what makes a copy useful. A chip transaction and a tap transaction each produce a value tied to that single transaction, so a recording of one is far less useful for making another. That is why both the Secret Service and the FTC point people toward the chip and toward tap-to-pay.

Copied stripe data can be written onto a blank card and used where swipes are still accepted, or used for a purchase online if what was captured is enough. The FTC also suggests, at a fuel pump, running a debit card as credit so no PIN is entered. Card data alone is a problem. Card data plus a PIN is a larger one, because a PIN opens the door to cash withdrawals from a checking account.

What to do if you think your card was copied

Call the card issuer first, before anything else, and ask for the card to be closed and reissued. The protections that limit what you owe are tied to how quickly you report, so that call is the step doing the most work.

1. Call the number on the back of the card or in the official app. Name the transactions you do not recognize by date and amount, and ask for the card to be closed and reissued. The OCC tells consumers to notify the bank immediately and identify the transactions you did not authorize, and says promptness is critical to limiting your liability.
2. Ask what the bank needs in writing. Many banks ask for a signed affidavit of unauthorized use. Ask for the deadline and the address, and send it inside that window.
3. Read the last few statements line by line. The CFPB warns that thieves might make low-dollar withdrawals or charges as a way to test a counterfeit card before using it for big-dollar transactions. A one dollar charge from an unfamiliar merchant is worth reporting.
4. Change the PIN used at that machine. If it was typed at the compromised terminal, treat it as known.
5. Turn on transaction alerts, covered in more detail in our guide to safe online banking.
6. Keep the paper trail. Dates, times, names, reference numbers, and copies of anything you sent.

If the charges hit a checking account rather than a credit card, treat it as an account problem and not only a card problem. Our guide on what to do when a bank account has been hacked covers the order of the first hour.

Debit card and credit card do not carry the same risk

A fraudulent credit card charge is money the issuer has not yet collected from you. A fraudulent debit card transaction is money already gone from a checking account while the bank investigates. The federal rules for the two are different, and that difference is why many people keep the debit card out of fuel pumps.

Credit cards

The FTC states that federal law limits your responsibility for unauthorized charges to $50. The CFPB adds that you are not responsible for unauthorized charges if someone stole only your credit card account number, which is the usual situation after skimming.

Debit cards

The FTC publishes the debit and ATM card limits as a schedule tied to when you report. Reporting within two business days of learning about the loss or theft caps your responsibility at $50. More than two business days but less than 60 calendar days after the statement was sent, the cap rises to $500. More than 60 calendar days after the statement was sent, you can be responsible for all the money taken.

After skimming the card is still in your wallet, so the clock that matters most is the 60-day one tied to the statement. The CFPB explains that for unauthorized transfers made without your card, failing to report within 60 days after the statement was sent can leave you paying for everything taken after that period. Neither rule promises every dollar back on a fixed date. They set the ceiling on what you can be asked to carry, and that ceiling moves with the reporting date.

How to notice a copied card early

Skimmed data is often used weeks after it is captured, and sometimes sold before it is used, so the gap between the machine and the first charge can be long. Noticing early comes down to an alert that reaches you without being asked for, plus a habit of reading the account.

Turn on transaction alerts in the bank or card app, with the threshold as low as the bank allows. A push notification arrives in seconds. A statement arrives in a month, and for a debit card the 60-day statement clock is what decides how much you can be asked to carry. Then check the account on a fixed rhythm, weekly for most people, looking for unfamiliar merchant names, small test amounts, and out-of-state ATM withdrawals. Using one card for fuel and in-person purchases and a different one for recurring bills also makes a compromise easier to contain.

Where to report a skimmer you found

Tell the business first, because it can shut down that pump or terminal in minutes, then tell law enforcement and your bank. A device left in place keeps collecting from everyone who uses the machine after you.

Do not try to remove the device yourself. It is evidence, and pulling at it can destroy what investigators need. The Secret Service, which runs skimming investigations with local police, tells cardholders to contact the card issuer’s fraud department immediately and consider filing a fraud affidavit with local law enforcement.

If money was taken, report the fraud to the FTC at ReportFraud.ftc.gov. Reports there feed a database used by federal, state, and local law enforcement. They do not recover money on their own, and nobody should sell you a report as a refund. If your information was used to open accounts rather than only to copy a card, IdentityTheft.gov is the free FTC recovery process for that. If the bank does not resolve an unauthorized transaction claim, you can complain to its federal regulator: the OCC through HelpWithMyBank.gov for national banks, or Federal Reserve Consumer Help when you are not sure which agency supervises it.

Card skimming FAQ