What a credit card skimmer is and where you'll find one
A credit card skimmer is a device or software that captures your card information without your knowledge when you swipe, insert, or tap to pay. The skimmer reads your card number, expiration date, and sometimes the security code — everything a fraudster needs to make unauthorized charges or sell your data.
Skimmers are most commonly found on ATM machines, gas pump terminals, and card readers at checkout counters. A criminal installs a thin overlay device over the real card slot, or places a hidden camera above the keypad to record your PIN. Some skimmers are internal — installed inside the machine itself by an employee or someone with access — making them impossible to spot by looking.
The information collected is either used when ready to make fraudulent purchases, or sold to other criminals on the dark web. Either way, you won't know your card has been compromised until charges appear on your statement or your bank alerts you to suspicious activity.
Key Takeaways
- Skimmers capture your card data at ATMs, gas pumps, and store checkout terminals, either through external overlay devices or hidden internal hardware.
- The most common skimmer locations are unattended machines like gas pumps and ATMs, where criminals have time to install and retrieve devices without witnesses.
- You cannot always see a skimmer by looking — internal skimmers and hidden cameras require you to check your statements and monitor your account regularly.
- If you discover fraudulent charges, contact your bank when ready; federal law limits your liability to $50 if you report within 60 days of your statement date.
Where skimmers are most commonly installed
Gas pumps are the single most targeted location for skimmers because they are outdoors, often unmonitored, and customers expect to insert their cards without an attendant watching. A criminal can install a skimmer in seconds and return days or weeks later to retrieve it and the data it has collected.
ATM machines are the second most common target, especially those in remote locations like convenience stores, laundromats, or parking garages where foot traffic is low and security cameras may be absent or poorly maintained. Standalone ATMs operated by independent companies rather than banks are at higher risk because they may have less frequent security checks.
Retail checkout terminals are less common targets because store staff are present and cameras are usually visible, but they do happen — particularly in restaurants where the card reader is taken away from your sight to process payment, or in small shops with minimal security.
How to check a machine before you use it
Before inserting your card, physically inspect the card slot and the area around it. Tug gently on the card reader itself — a skimmer overlay will feel loose or come away in your hand, while a legitimate reader is firmly attached. Look for any obvious seams, discoloration, or plastic that doesn't match the rest of the machine.
Check the keypad for loose keys or anything that looks raised or out of place. Some skimmers include a fake keypad overlay that sits on top of the real one. If anything feels wrong or looks different from other machines you've used, do not use that machine.
At gas pumps specifically, look for signs of tampering around the cabinet door where the card reader is housed. If the door looks forced open, scratched, or recently replaced, use a different pump or pay inside with cash.
Why monitoring your statements is your best defense
Even if you inspect a machine carefully, you cannot catch every skimmer — some are installed inside the machine where you cannot see them, and some are so well-made they are indistinguishable from the real equipment. This is why checking your bank and credit card statements regularly is more reliable than trying to spot every skimmer.
Review your statements at least weekly, either through your bank's app or website. Look for any charges you do not recognize, no matter how small. Fraudsters sometimes make a small test charge first (a dollar or two) to confirm the card works before making larger purchases. If you catch it early, your bank can stop the fraud before significant damage occurs.
Set up transaction alerts through your bank's app if available. Many banks allow you to receive a notification every time your card is used, or only when charges exceed a certain amount. This gives you real-time visibility and lets you report fraud within hours rather than days.
What to do if you find unauthorized charges
Contact your bank or credit card company when ready — do not wait for your monthly statement. Call the number on the back of your card or log into your online account to report the fraudulent charge. Have your statement or the specific transaction details ready when you call.
Your bank will typically cancel your current card and issue a replacement within 7 to 10 business days. They will also open a fraud investigation and may reverse the unauthorized charges while they investigate. Under federal law, your liability for fraudulent charges is limited to $50 if you report within 60 days of your statement date, and $0 if you report before any charges post to your account.
Request a new card number rather than a replacement with the same number. Ask your bank to flag your account for fraud monitoring, which adds extra verification steps to future transactions. If the skimmer was at a gas pump or ATM, consider reporting the location to the business or bank that operates it so they can inspect the machine.
The difference between skimmers and other card fraud methods
A skimmer is one way criminals steal card data, but not the only way. Card-not-present fraud happens when someone uses your card number online or over the phone without physically having the card. Data breachesPhishing
Skimmers are different because they require physical access to a machine you use regularly, and they capture data directly from your card's magnetic stripe or chip. This makes them harder to prevent through password changes or two-factor authentication — your only real defenses are physical inspection, statement monitoring, and quick reporting.
Frequently Asked Questions
Can a skimmer read my chip card, or only magnetic stripe cards?
Most skimmers target the magnetic stripe because it is easier to read and overlay devices are straightforward to install. Chip readers are harder to clone, but some advanced skimmers can read chip data. Tap and contactless payments are generally safer because the card never enters a slot, though skimmers targeting contactless payments do exist. Your best protection remains monitoring your statements regardless of payment method.
If I use a debit card at a skimmer, am I protected like I am with a credit card?
Debit card fraud protection is weaker than credit card protection. If you report within 2 business days, your liability is capped at $50. If you report after 2 days but within 60 days, you could lose up to $500. After 60 days, you may have no protection. This is why many financial advisors recommend using credit cards for in-person purchases — the liability limits are stronger and the fraud doesn't directly drain your bank account.
Should I cover the keypad with my hand when I enter my PIN?
Yes, this is a good habit. Covering the keypad with your other hand prevents hidden cameras from recording your PIN. Even if a skimmer captures your card number, they cannot use it without the PIN. This straightforward step takes no time and eliminates one vector of attack.
Is it safe to use ATMs in banks versus standalone ATMs?
Bank ATMs are generally safer because they are indoors, monitored by security cameras, and checked regularly by bank staff. Standalone ATMs in convenience stores or other locations are at higher risk because they may go longer without inspection. If you have a choice, use an ATM inside a bank branch during business hours when staff are present.