What a credit card skimmer looks like and where to find one
A credit card skimmer is a small device that reads and records your card data when you swipe or insert it. Most skimmers are thin enough to fit inside a card slot — roughly the size of a USB stick or smaller — and they sit on top of or inside the legitimate card reader. At a gas pump, ATM, or payment terminal, a skimmer may look like a slightly raised or loose piece of plastic around the slot, or it may be nearly invisible if installed inside the machine.
The most common skimmers are external overlays that slide over the real card slot. They are usually black, gray, or silver plastic and may have a slight bulge or seam where they meet the machine. Some are designed to match the machine's color and finish so closely that the difference is hard to spot unless you look closely or try to wiggle the card slot itself. Others are obviously out of place — a plastic frame that does not fit flush with the machine's surface, or a device with visible wiring.
Skimmers are most often found at gas pumps (especially the outdoor ones), ATMs in low-traffic areas, parking garages, and standalone payment terminals in restaurants or retail stores. They are less common at staffed checkout counters because a cashier is watching, but they do appear there occasionally. The device itself does not need power in most cases — it straightforward stores the data until someone retrieves it, though some newer skimmers transmit data wirelessly to a nearby receiver.
Key Takeaways
- External skimmers look like a raised or loose plastic frame around a card slot and may be black, gray, or designed to match the machine's color.
- The fastest way to spot one is to push, pull, and wiggle the card slot itself — a skimmer will move or feel loose, while a real slot will not.
- Skimmers hide most often at gas pumps, ATMs in quiet locations, and standalone payment terminals away from staff.
- If you find a skimmer, do not remove it; instead, alert the business owner or manager and report it to local police.
How to check a card slot for a skimmer
The most reliable test is physical: try to move the card slot itself. Place your fingers on the edges of the slot and gently push, pull, and wiggle. A real card slot is bolted or welded to the machine and will not move. A skimmer is glued or magnetically attached on top and will shift, click, or feel loose. This test works on gas pumps, ATMs, and most payment terminals.
Look for visual signs next. Check whether the card slot sits flush with the rest of the machine or if there is a gap, seam, or raised edge around it. Shine a light into the slot and look for a second reader inside — a skimmer often sits just above the real one. Check whether the plastic around the slot matches the rest of the machine in color, texture, and wear. A new overlay on an old machine will stand out.
At a gas pump, also inspect the keypad. Some skimmers include a fake keypad overlay that captures your PIN. If the keypad feels loose, has a different texture than the rest of the pump, or looks newer than the machine, do not use that pump. Move to a different one or go inside to pay the cashier instead.
Where skimmers are most likely to be installed
Gas pumps are the single most common target, especially pumps at the edge of a station or in rural areas where fewer people use them and staff do not monitor them as closely. Outdoor pumps are easier to access than indoor ones. ATMs in parking garages, convenience stores, and remote locations are also frequent targets because they operate 24/7 and may not have surveillance or regular checks.
Standalone payment terminals in restaurants, bars, and small retail shops are vulnerable because they are often left unattended or are straightforward to access from the customer side. Vending machines with card readers and parking meters that accept cards are less common targets but still at risk. Staffed checkout counters are the safest because a cashier is present, though skimmers have been found there too.
The pattern is consistent: skimmers go where there is less supervision, less foot traffic, and less chance of when ready discovery. If you are using a card reader in a quiet or remote location, take extra time to inspect it.
Internal skimmers and why they are harder to spot
Some skimmers are installed inside the machine itself, hidden behind the card slot. These internal skimmers are harder to detect because there is no external overlay to see or feel. They are usually installed by someone with access to the machine — a dishonest technician, employee, or someone who has broken into the machine.
You cannot reliably spot an internal skimmer by looking at the outside of a machine. Your best defense is to use machines that are monitored regularly, such as ATMs inside banks or payment terminals at busy, staffed locations. If you must use a remote machine, consider using a contactless payment method (like a phone or watch) instead of inserting your card, or withdraw cash from a bank teller and pay with cash.
What to do if you find a skimmer
Do not remove the skimmer yourself. Removing it may destroy evidence, and you could be blamed for tampering with the machine. Instead, alert the business owner, manager, or staff member when ready. Tell them exactly where the device is and what you observed. If it is a gas station, speak to the attendant or manager. If it is an ATM, contact the bank that owns it — the phone number is usually on the machine.
You can also report the skimmer to local police by calling the non-emergency line or visiting a police station. Provide the location, a description of the device, and the time you found it. If you took a photo, share it with police and the business owner.
After reporting a skimmer, monitor your card for unauthorized charges. If you used that card at the machine before finding the skimmer, contact your card issuer and ask them to watch for fraud. Most card companies will not hold you liable for unauthorized charges if you report them quickly, but the sooner you act, the better.
Signs your card may have been skimmed
Unauthorized charges on your statement are the clearest sign. These may appear within days or weeks of using a compromised machine. Charges may be small test transactions (a few dollars) to confirm the card works, followed by larger purchases. You might also see charges from unfamiliar merchants or in locations you have never visited.
A second sign is a call or email from your card issuer asking about unusual activity. Banks monitor for patterns that suggest fraud and will often contact you before charges post. If your issuer calls, answer their questions honestly and ask them to cancel your card and issue a replacement.
If you notice any of these signs, contact your card issuer when ready. Provide the date and location where you think the card was compromised. Ask the issuer to cancel the card, dispute the fraudulent charges, and send you a new card. You should also check your credit report for accounts opened in your name without your permission, which can happen if a skimmer was used to steal your full identity information.
Protecting yourself from skimmers
Use machines in high-traffic, well-lit, monitored locations whenever possible. ATMs inside banks are safer than standalone ATMs in parking lots. Gas pumps near the station entrance are safer than pumps at the edge of the property. Payment terminals at busy stores with staff present are safer than remote terminals.
Inspect every card slot before you use it. Make it a habit: push, pull, wiggle, and look. It takes 10 seconds and can prevent fraud. If anything feels wrong or looks out of place, do not use that machine.
Consider using contactless payment methods when available — tap your phone, watch, or card instead of inserting it. Contactless payments do not require you to insert your card into a slot, so skimmers cannot read the data. If your card issuer offers a contactless card, request one.
Monitor your statements regularly, at least weekly. Set up alerts with your card issuer so you are notified of charges over a certain amount or charges in certain categories. The faster you spot fraud, the faster you can report it and limit your liability.
Frequently Asked Questions
Can a skimmer steal my PIN?
Yes, if the skimmer includes a fake keypad overlay. The overlay captures your PIN as you type it. This is why you should inspect the keypad as carefully as the card slot — look for loose, raised, or mismatched plastic. If the keypad feels wrong, do not use that machine.
Will my bank refund me if my card is skimmed?
Most banks will refund unauthorized charges if you report them quickly, usually within 30 to 60 days of the charge appearing on your statement. Your liability is typically zero if you report fraud promptly. However, if you wait months to report it, the bank may deny the claim. Report suspected fraud as soon as you notice it.
Is it safer to use my debit card or credit card at a skimmer?
A credit card is safer. Credit card fraud is easier to dispute and you are not liable for unauthorized charges. Debit card fraud can drain your bank account when ready, and getting your money back takes longer. If you must use a card at a machine you are unsure about, use a credit card rather than a debit card.
Can I get skimmed if I use Apple Pay or Google Pay?
No. Contactless payment methods like Apple Pay and Google Pay do not expose your card number to the machine. The payment is encrypted and does not require you to insert your card into a slot. Using your phone or watch to pay is one of the safest ways to avoid skimmers.
What should I do if I see a skimmer but did not use that machine?
Report it anyway. Alert the business owner or manager, and if you feel comfortable doing so, call local police. You may prevent someone else from being skimmed. Do not remove the device yourself — let the business or police handle it.