What a credit card skimmer is and where you'll find one
A credit card skimmer is a small device or hidden software that captures the information from your card's magnetic stripe or chip without your knowledge. Criminals attach physical skimmers to card readers at gas pumps, ATMs, or store checkout terminals. They also install digital skimmers on websites or inside payment apps to intercept your data when you enter it. The goal is always the same: steal your card number, expiration date, and sometimes your PIN so they can make unauthorized charges or sell the information to other criminals.
Physical skimmers are the most common type you'll encounter. They're often placed on machines you use regularly — gas station pumps, parking meters, vending machines, and ATM facades. A skimmer can be as thin as a credit card itself and designed to look like part of the machine. Digital skimmers hide in the code of websites or payment systems and work silently in the background whenever you enter your card details online.
Key Takeaways
- Physical skimmers are small devices placed over card readers at gas pumps and ATMs that capture your card data when you swipe or insert your card.
- Digital skimmers are hidden in website code or payment apps and steal your information when you type it in during checkout.
- You can reduce your risk by using chip readers instead of swiping, paying inside at gas stations, and checking machines for loose or misaligned parts before using them.
- If you notice unauthorized charges, contact your card issuer when ready — federal law limits your liability for fraudulent charges to $50.
How physical skimmers capture your card information
When you insert or swipe your card at a compromised machine, the skimmer reads the magnetic stripe or chip and stores your card number and expiration date. Some skimmers also have a hidden camera or keypad overlay that records your PIN as you type it. The criminal then retrieves the device later, downloads the stolen data, and either uses it themselves or sells it on the dark web.
Gas pumps are the most frequent target because they're often unattended and located outside where a criminal can install a skimmer without being seen. ATMs in remote locations or inside convenience stores are also common targets. Retail checkout terminals are less frequently skimmed because they're monitored, but it still happens. Restaurant payment terminals that leave your card out of sight are another risk point.
How digital skimmers work on websites and apps
Digital skimmers are lines of malicious code injected into a website's checkout page or a payment app. When you enter your card details, the skimmer captures that information and sends it to the criminal's server before your legitimate payment processor ever sees it. You won't see any sign that this is happening — the page looks normal, the transaction processes normally, and you receive your confirmation email as expected.
Digital skimmers often target smaller online retailers or third-party payment plugins that have weaker security than major payment processors. They can also hide inside legitimate apps that have been compromised or inside fake apps designed to look like real services. The theft happens when ready and silently, so you may not discover it until you see a charge you didn't make.
Signs a machine might have a skimmer attached
Before you use any card reader, take a few seconds to inspect it. Look for anything that appears loose, misaligned, or newer than the rest of the machine. Try to wiggle the card slot, keypad, or any protruding parts — a skimmer will often feel slightly different from the machine itself because it's been added on top. Check whether the colors match or if there are visible seams where a skimmer has been glued on.
At gas pumps specifically, check the pump door to see if it shows signs of being forced open or if the lock looks damaged. Criminals often have to pry open the pump to install a skimmer inside. If the pump looks tampered with or if the card reader feels loose or wobbly, use a different pump or a different station. Trust your instinct — if something feels off about a machine, it probably is.
Steps to reduce your skimming risk
Use the chip reader instead of swiping whenever possible. Chip technology is much harder to skim because it creates a unique code for each transaction that can't be reused. If a machine only has a magnetic stripe reader, consider using a different payment method or location.
At gas stations, pay inside at the counter instead of at the pump. This removes the risk of a skimmer on an unattended pump. If you must use the pump, inspect it first and use your credit card rather than your debit card — credit cards offer stronger fraud protection.
For online shopping, buy from websites you recognize and trust. Look for the padlock icon in your browser's address bar and make sure the URL starts with "https://" rather than "http://". Avoid entering your card details on public WiFi networks. Use payment methods like PayPal or Apple Pay when available, which keep your actual card number hidden from the merchant.
Monitor your card statements regularly — weekly if possible — and set up transaction alerts with your card issuer so you're notified of charges when ready. The sooner you spot fraud, the sooner you can report it and stop further damage.
What to do if you think you've been skimmed
Contact your card issuer right away. Call the number on the back of your card or log into your online account to report the unauthorized charges. Your card issuer will cancel your current card and issue a replacement. Federal law limits your liability for fraudulent charges to $50, and most card issuers waive that fee entirely if you report the fraud promptly.
Ask your issuer to review your full statement for the past 30 to 90 days to catch any charges you might have missed. Request a new card number and ask whether your issuer offers a virtual card number for online shopping — this is a temporary number that works only once and protects your real card number from digital skimmers.
If you used a debit card and the fraud went through your bank account, report it to your bank as well. Debit card fraud protection is weaker than credit card protection, so act quickly. Keep records of all your communications with your card issuer and bank, including dates, times, and the names of representatives you spoke with.
Frequently Asked Questions
Can a skimmer steal my PIN?
Physical skimmers can capture your PIN if they include a hidden camera or a keypad overlay. Digital skimmers cannot capture your PIN because you don't enter it during online transactions. To protect your PIN at ATMs and gas pumps, cover the keypad with your hand as you type and inspect the keypad for loose or raised buttons before using it.
Will my bank refund me if I'm skimmed?
Yes, but the speed and amount depend on whether you used a credit card or debit card. Credit card fraud is typically refunded within two to three business days and your liability is capped at $50. Debit card fraud can take longer to refund and may leave your account empty during the investigation, so report it when ready.
Is chip technology completely safe from skimmers?
Chip readers are much harder to skim than magnetic stripe readers, but they're not impossible to compromise. Criminals are developing new methods to target chip technology, though they remain less common than stripe skimmers. Using chip readers is still your best defense against physical skimming.
Can I get skimmed at a restaurant when I hand my card to the server?
Yes, though it's less common than ATM or gas pump skimming. Some restaurants use handheld terminals that leave your card out of sight, creating an opportunity for a dishonest employee to skim it. Ask to use a table-side terminal if available, or keep your card in sight during the transaction.
How do I know if a website has a digital skimmer?
You usually can't tell just by looking at the page. Protect yourself by shopping only on websites you recognize, using the chip reader or a digital wallet like PayPal when available, and monitoring your statements closely. If you see a charge you don't recognize, report it to your card issuer when ready.