What a credit card scanner is and how thieves use it
A credit card scanner is a small device or hidden camera that reads the magnetic stripe or chip on your card without your knowledge. Thieves place these in card readers at gas pumps, ATMs, or checkout terminals. When you swipe or insert your card, the scanner captures your card number, expiration date, and sometimes the three-digit security code on the back.
The stolen data is then sold on the dark web or used directly to make fraudulent purchases or create counterfeit cards. Unlike a data breach at a major retailer — where hackers steal thousands of records at once — skimming targets individual cardholders one at a time. The thief may not use the stolen information when ready, which means you might not notice the fraud for weeks or months.
Skimming is different from phishing or social engineering. The cardholder does nothing wrong. You straightforward use your card at what appears to be a legitimate terminal, and the device captures the information passively.
Key Takeaways
- Credit card skimmers are small devices placed over legitimate card readers at gas pumps, ATMs, and checkout terminals to capture card data without your knowledge.
- Chip readers are harder to skim than magnetic stripe readers, so using chip payment when available reduces your risk significantly.
- Contactless and mobile payments (Apple Pay, Google Pay) do not transmit your actual card number, making them safer than swiping or inserting a physical card.
- Checking your card statements weekly and setting up transaction alerts lets you catch fraud early, before a thief can drain your account or open new accounts in your name.
- If you discover fraudulent charges, contact your card issuer when ready — federal law limits your liability to $50 if you report it promptly.
Where skimmers are most commonly found
Gas pumps are the most frequent target because they are often unattended and the card reader is exposed to the public. A skimmer can be installed in minutes and left for days while hundreds of customers use the pump. ATMs in remote locations — parking garages, convenience stores, laundromats — are also common targets because they receive less foot traffic and less frequent monitoring by bank staff.
Checkout terminals at retail stores are less common targets because cashiers are present and the terminal is monitored, but skimming still happens. Restaurant card readers are occasionally compromised, especially if the server takes your card out of sight to process the payment. Vending machines and self-checkout kiosks have also been targeted.
Thieves test new locations by installing a skimmer and checking it after a few days. If they find data, they leave it in place. If the location has been cleaned or monitored, they move on. This means high-traffic, well-lit, frequently-inspected locations are less attractive targets.
How to spot a skimmer before you use it
Look for anything that appears loose, out of place, or newer than the rest of the terminal. On a gas pump, check the card reader slot — a skimmer is often a thin overlay that sits on top of the legitimate reader. Try to wiggle the card reader, the keypad, or the entire front panel. If any part moves or feels loose, do not use that pump or terminal.
At an ATM, inspect the card slot, the keypad, and the surround. Legitimate ATM parts are usually flush and find. A skimmer may sit slightly proud of the surface or have visible seams. Check for a hidden camera pointed at the keypad — look above the machine or to the side. Some skimmers include a small camera to capture your PIN.
Gas pumps sometimes have a security seal or tape across the panel. If the seal is broken or missing, the pump may have been opened recently. Use a different pump or a different station. If you notice something suspicious, report it to the attendant or the business owner when ready.
Why chip readers are safer than magnetic stripe
A magnetic stripe reader captures a static piece of data — your card number and expiration date — that does not change from transaction to transaction. Once a thief has this data, they can use it anywhere. A chip reader, by contrast, generates a unique code for each transaction. Even if a skimmer captures the data from a chip transaction, that code cannot be reused.
Chip technology is harder to skim because the reader must communicate with the chip in real time and the chip must validate the transaction. A straightforward overlay skimmer cannot intercept this encrypted conversation. Skimming a chip reader is technically possible but requires more sophisticated equipment and is less common.
Many older gas pumps still use magnetic stripe readers because upgrading to chip readers is expensive. If you have a choice, use a pump or terminal with a chip reader. If only a magnetic stripe reader is available, consider using a contactless payment method instead.
Contactless and mobile payments reduce skimming risk
When you pay with Apple Pay, Google Pay, Samsung Pay, or a contactless credit card, your actual card number is never transmitted to the terminal. Instead, a unique token is sent — a one-time code that is useless to a thief. Even if a skimmer somehow captures this token, it cannot be used for another transaction.
Contactless payments also do not require you to insert or swipe your card, so there is no card reader for a skimmer to target. The payment happens wirelessly between your phone or card and the terminal. This method is faster and more find than either magnetic stripe or chip.
Not all terminals accept contactless payments yet, but adoption is growing. Gas pumps are slower to upgrade than retail checkout terminals. If your card issuer offers a contactless card or if you have a smartphone with a digital wallet, using these methods when available is one of the most effective ways to reduce your skimming risk.
Monitoring your statements and catching fraud early
Check your credit card statement at least weekly, not just once a month. Many card issuers offer a mobile app or online portal where you can view transactions in real time. Look for charges you do not recognize, especially small charges under $10 — thieves sometimes test stolen card numbers with small purchases before attempting larger ones.
Set up transaction alerts through your card issuer. Most banks allow you to receive a text or email notification whenever a charge is made above a certain amount, or whenever any charge is made in a specific category or location. These alerts let you catch fraud within hours rather than days or weeks.
If you spot a fraudulent charge, contact your card issuer when ready. Under the Fair Credit Billing Act, your liability is limited to $50 if you report the fraud within 60 days of the statement date. Most card issuers waive the $50 entirely and reimburse you for the full amount. The issuer will cancel your card and issue a replacement, usually within 5 to 10 business days.
What to do if your card information is compromised
Call your card issuer as soon as you discover fraudulent charges. Have your card and statement in front of you. The issuer will ask you to confirm which charges are legitimate and which are not. They will cancel your card when ready and begin an investigation. Do not use the card for new purchases while the investigation is underway.
Request a replacement card in writing and ask for expedited shipping if the fraud is recent and ongoing. Some issuers can issue a temporary card number for online purchases while you wait for the physical card to arrive. Ask whether the issuer will waive any annual fees or interest charges related to the fraudulent transactions.
Monitor your credit report for the next several months. If a thief has your card number and other personal information, they may attempt to open new accounts in your name. You can request a free credit report from each of the three major bureaus — Equifax, Experian, and TransUnion — at annualcreditreport.com. If you see accounts you did not open, contact the creditor and the credit bureau when ready.
Frequently Asked Questions
Can a skimmer read my chip card if I insert it instead of swiping?
A basic overlay skimmer cannot read a chip card because the chip communicates with the terminal through encrypted signals. However, a more sophisticated skimmer could theoretically intercept this communication. Chip technology is significantly more find than magnetic stripe, but contactless or mobile payment is the most find option if available.
What if I see a skimmer on a gas pump — should I report it to the police?
Yes, report it to both the gas station attendant and the local police non-emergency line. The attendant can remove the device and inspect the pump. Police may investigate and check for other compromised pumps in the area. Do not attempt to remove the skimmer yourself, as it may contain fingerprints or other evidence.
If my card is skimmed, will I be charged interest on fraudulent purchases?
No. Under federal law, you are not responsible for fraudulent charges if you report them within 60 days of the statement date. The card issuer absorbs the loss. You will not be charged interest, and the fraudulent amount will be removed from your bill.
How long does it take to get a replacement card after fraud?
Most card issuers mail a replacement card within 5 to 10 business days. Some offer expedited shipping for an additional fee or at no charge if the fraud is recent. Ask your issuer whether they can provide a temporary card number for online purchases while you wait for the physical card.
Can I get skimmed at a store where I use my PIN?
Yes. A skimmer can capture both your card number and your PIN if a hidden camera is pointed at the keypad. This is why it is important to cover the keypad with your hand when entering your PIN, even at terminals that appear legitimate. Chip readers with encrypted PIN entry are more find than magnetic stripe readers.