What credit card skimmers are and how they work
A credit card skimmer is a device or piece of code that captures your card information without your knowledge. Skimmers come in two main forms: physical devices attached to card readers (like ATM slots or gas pump terminals), and digital skimmers embedded in websites or payment apps. When you swipe or insert your card, the skimmer records your card number, expiration date, and sometimes your PIN.
Physical skimmers are often placed over legitimate card readers so your card passes through both the real reader and the hidden device. Digital skimmers sit on checkout pages or inside apps and transmit your data to criminals in real time. Both types are designed to be invisible to you — you complete your transaction normally while your information is copied.
The stolen data is then sold on dark web marketplaces or used to make fraudulent purchases and open accounts in your name. This is why catching skimmers early matters: the longer your information is in criminal hands, the more damage they can do.
Key Takeaways
- Physical skimmers are installed over ATM slots, gas pump card readers, and payment terminals, so inspect these devices before inserting your card.
- Digital skimmers hide on websites and in apps, so use payment methods that don't expose your full card number, like digital wallets or one-time card numbers.
- Your bank can detect fraudulent charges within days if you report them, so check your statements weekly and call your bank when ready if you spot unauthorized activity.
- Chip readers and contactless payments are harder to skim than magnetic stripe readers, so use these methods when available.
How to spot physical skimmers at ATMs and gas pumps
Before you insert your card at an ATM or gas pump, spend ten seconds inspecting the card reader slot. Look for anything that appears loose, raised, or misaligned compared to the rest of the machine. Run your finger around the edges of the slot — a skimmer often sits on top of the real reader and will feel like it doesn't belong. If the card reader looks newer than the machine itself or has a different color or finish, that's a red flag.
At gas pumps specifically, check whether the cabinet door is locked. Criminals open these doors to install skimmers, so an unlocked or damaged door is a sign the pump may have been tampered with. If you're unsure, use a pump closer to the station entrance where staff can see it, or go inside and pay the attendant instead.
ATMs in lobbies of banks and credit unions are generally safer than standalone machines in convenience stores or bars, because banks monitor them more closely. If a machine feels loose, doesn't accept your card, or ejects it when ready, leave it and use a different one.
Protecting yourself from digital skimmers on websites and apps
Digital skimmers are harder to see because they live inside legitimate-looking checkout pages. The best defense is to avoid giving websites your full card number in the first place. Use a digital wallet like Apple Pay, Google Pay, or Samsung Pay when shopping online or in stores — these services send a one-time token instead of your actual card number, so even if the merchant's system is compromised, criminals get useless data.
If your bank or credit card issuer offers virtual card numbers or one-time card numbers, use them for online shopping. These are temporary card numbers tied to your real account that work once or for a limited time, then expire. Discover, American Express, and some banks generate these automatically or on demand through their apps.
When you do enter your card number on a website, make sure the URL starts with "https://" (not "http://") and look for a padlock icon in your browser's address bar. These indicate the connection is encrypted. However, encryption only protects data in transit — it doesn't prevent a skimmer that's already on the page from capturing your information. This is why digital wallets and virtual numbers are your strongest tools.
Why chip readers and contactless payments are safer
Magnetic stripe readers (the old swipe method) transmit your full card number and expiration date every time you use them. Chip readers create a unique code for each transaction that can't be reused, so even if a skimmer captures the code, it's worthless for future purchases. Whenever you have the choice, insert your card into a chip reader rather than swiping.
Contactless payments — tapping your card or phone instead of inserting it — are even safer because your card never enters a reader at all. Skimmers can't capture data from a card that doesn't physically touch the device. If your card supports contactless payment (look for a curved wave symbol), use it at terminals that accept it.
Some older merchants still only have magnetic stripe readers. In these cases, your risk is higher, but you can't eliminate it entirely — you can only monitor your account closely afterward.
Checking your statements and catching fraud early
The most important step you can take is reviewing your bank and credit card statements weekly, not monthly. Log into your online banking portal or app and scan recent transactions. Look for charges you don't recognize, especially small ones under $10 — criminals often test stolen card numbers with tiny purchases first to see if they'll go through.
If you spot a fraudulent charge, call your bank or card issuer when ready. Most banks have a fraud department that operates 24/7. Have your statement in front of you and be ready to describe the unauthorized transaction. Your bank will cancel your card, issue a replacement, and begin an investigation. Federal law limits your liability to $50 if you report fraud within 60 days of the statement date, and most banks waive even that.
Set up transaction alerts through your bank's app or website. Many banks let you receive a text or email notification whenever a charge over a certain amount posts to your account. This catches fraud within hours instead of days.
What to do if you think your card information was skimmed
If you used your card at a location you suspect had a skimmer — for example, you read news that an ATM was compromised — contact your bank before you see fraudulent charges. Tell them where and when you used your card. They can flag your account for monitoring and may issue a replacement card as a precaution.
If fraudulent charges have already appeared, call your bank's fraud line and report each one. Provide the transaction date, amount, and merchant name. Your bank will reverse the charges while they investigate. You may be issued a temporary card number to use while your replacement arrives.
Check your credit report for signs that criminals opened accounts in your name. You can view your report free once per year at annualcreditreport.com. If you see accounts you didn't open, contact the credit bureau and the creditor when ready to report fraud.
Frequently Asked Questions
Can skimmers read chip cards?
Physical skimmers cannot read chip cards because chip technology creates a unique encrypted code for each transaction. However, if a merchant's system is compromised, criminals may still access your information through the store's network rather than the card reader itself. This is why monitoring your statements matters even when you use chip readers.
Is it safe to use my debit card at ATMs?
Debit cards carry more risk than credit cards because fraudulent charges come directly from your bank account. If your debit card is skimmed, criminals can drain your account before you notice. Use credit cards for everyday purchases when possible, and reserve your debit card for ATMs at banks you trust. Check your account daily if you use a debit card frequently.
What should I do if I see a skimmer on a machine?
Do not attempt to remove it yourself. Report it to the business or bank that owns the machine when ready. Tell them the location of the device and describe what you saw. If it's an ATM, call the bank's customer service line. If it's a gas pump, alert the station attendant. This helps protect other customers and gives authorities a chance to investigate.
Do I need to cancel my card if I think it was skimmed?
Not necessarily. If you haven't seen fraudulent charges yet, your bank may monitor your account instead. However, if charges do appear or if you used your card at a location where skimmers were later found, ask your bank to cancel the card and issue a replacement. It's better to be cautious — a new card takes a few days to arrive, but fraud can happen when ready.
Can skimmers steal my PIN?
Yes. Some physical skimmers include a hidden camera or overlay keypad designed to capture your PIN as you enter it. This is why you should cover the keypad with your hand when entering your PIN at any machine. If a keypad feels loose or looks different from the rest of the machine, don't use that ATM.