Card Skimmers: How to Spot Them and What to Do If You're Hit

You fill up your tank, swipe your card and drive off. A week later your checking account is short several hundred dollars, drained at ATMs in a city you’ve never visited. Somewhere along the way, a card skimmer copied your card and a camera or fake keypad captured your PIN.

Skimming is an old crime that keeps adapting. The devices are smaller, some sit inside the machine where you can’t see them, and they can be installed in seconds. The good news is that a few habits block most of the risk, and federal law limits what you owe if you act fast.

This guide shows what skimmers look like at gas pumps, ATMs and store checkouts, how to protect yourself, and what to do step by step if you’ve been hit.

What a card skimmer is and how it works

A skimmer is a device that captures the data from your card when you use it at a legitimate machine. Criminals then use that data to create counterfeit cards or make fraudulent purchases. If they also get your PIN, they can withdraw cash from your account at an ATM.

Most skimming setups have 2 parts:

• A card reader that copies your card’s data. It may be an overlay that fits over the real slot, or a thin device pushed deep inside the slot.
• A PIN capture tool such as a pinhole camera aimed at the keypad, or a fake keypad overlay placed on top of the real one.

According to the US Secret Service, ATM skimmers are often inserted deep in the card slot and are hard to see from outside. Point-of-sale (POS) skimmers are plastic overlays that fit over a store terminal’s top or just its keypad and chip reader, and can capture card data and debit PINs.

You may also hear the term “shimmer.” That’s an extremely thin device slipped into a chip reader slot to try to capture chip data. Chip cards are much harder to counterfeit than magnetic stripes, but criminals try anyway, which is why tap-to-pay is generally the safer option.

Where skimmers show up

The FBI advises choosing a gas pump closer to the store and in view of the attendant, because those are less likely to be targeted. The Secret Service suggests using ATMs inside financial institutions, in camera-monitored bays or near drive-up windows.

How to spot a skimmer in 30 seconds

You don’t need to be an expert. Take a quick look and a gentle tug before you pay.

At a gas pump

1. Check the security seal on the pump panel if there is one. A broken or tampered seal is a warning sign.
2. Wiggle the card reader. It shouldn’t move. If it’s loose or sticks out, don’t use it.
3. Compare with the next pump. A reader that looks different from the others at the same station is suspicious.
4. Look at the keypad. If it feels thick, spongy or raised, it may be an overlay.

At an ATM

1. Look for loose or crooked parts around the card slot and keypad.
2. Check for mismatched colors or materials, scratches or glue residue.
3. Watch for broken lights, raised PIN pads and stickers in unusual places, which the Secret Service lists as red flags.
4. Scan for tiny holes or odd attachments above the keypad that could hide a camera.

At a store terminal

1. Gently pull on the corners of the terminal or its keypad shroud, as the Secret Service recommends. Nothing should lift or move.
2. Check tamper seals if the store uses them.
3. If anything seems off, don’t use it and tell the cashier or manager.

Key takeaway: If a card reader moves, looks different from nearby machines or has broken seals, walk away. Thirty seconds of checking can save you hours of disputes.

Habits that protect you even when you can’t see the skimmer

Some skimmers are invisible from outside. These habits help regardless:

• Use tap-to-pay or a mobile wallet. The FBI says tap-to-pay transactions are more secure and less likely to be compromised. Mobile wallets like Apple Pay or Google Pay use a one-time token instead of your actual card number.
• Insert your chip instead of swiping when tap isn’t available. Avoid the magnetic stripe.
• Use a credit card at gas pumps and stores rather than a debit card. The Secret Service notes this protects your PIN and keeps thieves away from your checking account.
• Shield your PIN with your other hand every time.
• Pay inside at the gas station counter if the pump looks questionable.
• Turn on transaction alerts through your bank’s app so you see charges right away.
• Watch EBT cards too. Benefits cards that rely on magnetic stripes have been a major target for skimming, so use your state’s card-lock or alert tools if available.

What to do if your card was skimmed

If you see charges you don’t recognize, or your bank flags suspicious activity, move quickly. With debit cards especially, your timing affects how much you could lose.

Step-by-step response

1. Call your card issuer’s fraud line using the number on the back of your card or in your banking app. Report the unauthorized charges, then ask them to cancel the card and issue a new one with a new PIN.
2. Lock or freeze the card in your banking app if you can’t reach the issuer right away.
3. Review recent transactions and list every charge or withdrawal you didn’t make.
4. Follow up in writing. Many issuers ask for a written fraud claim or affidavit. Keep copies and note dates and names.
5. Change your online banking password if you suspect broader compromise, and turn on two-factor authentication.
6. Report it to local police if you lost money, as the Secret Service recommends. Tell the merchant or ATM owner where you think it happened, so the device can be removed.
7. Update automatic payments linked to the old card number.
8. Keep watching your statements for at least the next 2 cycles.

If thieves also got personal information such as your Social Security number, freeze your credit and review our guide to protecting yourself from identity theft.

What you owe: credit vs. debit card protections

Federal law treats credit and debit cards differently, which is why many security experts suggest credit cards for higher-risk places like gas pumps.

Many card networks and banks offer zero-liability policies that go further than the law, but those are voluntary and have conditions. The bigger practical difference is cash flow. With a credit card, disputed charges come off the bank’s money while they investigate. With a debit card, the money leaves your checking account immediately, which can cause bounced payments while you wait.

Where to start today

• Turn on real-time alerts for every card and bank account you use.
• Add your cards to a mobile wallet and use tap-to-pay where it’s accepted.
• Use a credit card, not debit, at gas pumps and unattended terminals.
• Save your card issuer’s fraud number in your phone.
• Make the 30-second check a habit: seal, wiggle, compare, shield.

Business owners who run card terminals should also inspect devices regularly and train staff to spot tampering. Our guide to PCI DSS compliance for small business covers terminal security, and how to accept payments on your website covers the online side.

The bottom line

Card skimmers are hard to see, but a quick inspection, tap-to-pay and using credit instead of debit block most of the risk. If you’re hit, call your issuer right away, get a new card and PIN, and dispute every unauthorized charge in writing. Acting within days, not weeks, keeps your losses as close to $0 as possible.

This is general information, not legal advice.

Sources

• FBI: Skimming — how skimmers work, gas pump and ATM tips, tap-to-pay guidance
• US Secret Service: ATM and POS Terminal Skimming — device types, warning signs, reporting steps for cardholders and businesses
• FTC: Lost or Stolen Credit, ATM, and Debit Cards — federal liability limits for credit and debit cards
• CFPB: Regulation E § 1005.6 Liability of consumer for unauthorized transfers — debit card liability tiers and timelines
• CFPB: Regulation E § 1005.11 Procedures for resolving errors — 10-business-day, 45-day and 90-day investigation timelines
• FTC: Watch out for card skimming at the gas pump — gas pump seal and card reader checks