Card Skimming

Card skimming is the theft of payment card data by a hidden device or malicious code placed where cards are used, such as an ATM, a fuel pump, a shop terminal or an online checkout page. The stolen data is used to make counterfeit cards or to shop online, and stolen PINs let criminals withdraw cash. Skimming is one of the oldest forms of card fraud and still feeds the market for stolen card numbers.

Classic skimming copies the magnetic stripe, which stores static data that is easy to clone. The spread of the EMV chip has made cloned cards much less useful wherever chip readers are used, so criminals have shifted toward "shimming" chip readers, attacking places that still accept the stripe, and skimming online through malicious code, often called e-skimming or digital skimming.

A card's magnetic stripe is like a page of writing that any reader can photocopy. A skimmer is a hidden photocopier slipped into the slot where you insert your card. It copies the page as the card goes in, and a tiny camera or a fake keypad records your PIN as you type it.

Later, the criminal writes the copied page onto a blank card and uses it like your own. A chip card is harder to copy, because the chip creates a fresh one-time code for every payment, a bit like a signature that changes each time. Online skimming skips the machine entirely: a hidden piece of code on a shop's checkout page sends a copy of what you type to the criminal.

• ATM skimming. An overlay is fitted over the card slot or a thin reader is pushed inside it, and a pinhole camera or keypad overlay captures the PIN. The result is cloned cards used to withdraw cash.
• Fuel pump and unattended terminal skimming. Devices are installed inside pump housings, often with a key that opens many pumps of the same model, and some transmit data over Bluetooth so the criminal never returns.
• Point-of-sale skimming. Tampered or swapped terminals in shops and restaurants, or handheld skimmers used by dishonest staff, copy cards during card-present payments.
• Shimming. A paper-thin device inserted into a chip reader sits between the card and the reader to capture chip data. Because the chip's one-time codes cannot simply be replayed, shimmed data is mainly useful where an issuer or terminal still falls back to stripe-style checks.
• E-skimming. Criminals inject malicious JavaScript into a merchant's checkout page, often through a compromised plugin or third-party script, to copy card details as customers type them. Campaigns of this kind are often grouped under the name Magecart.

The card networks used a liability shift to push the move to chips. In the United States, from October 2015 the party with the less secure technology, usually a merchant without a chip-capable terminal, became liable for counterfeit card fraud that a chip transaction would have prevented. Automated fuel dispensers received extensions and their liability shift took effect in April 2021, which is one reason fuel pumps remained a favourite skimming target for years. Europe, Canada and many other regions adopted chip and PIN earlier, and counterfeit fraud there moved to countries and channels where the stripe was still accepted.

Data security rules apply too. The Payment Card Industry Data Security Standard (PCI DSS), whose version 4.0.1 is in force with its future-dated requirements effective since 31 March 2025, requires merchants to inspect point-of-sale devices for tampering and to control and monitor scripts on payment pages, aimed squarely at e-skimming. The EMVCo specifications govern how chip and contactless payments authenticate cards.

For merchants and ATM operators, defences include tamper-evident seals and regular inspection of terminals, anti-skimming hardware that jams or detects foreign devices in card slots, and keeping devices in sight of staff. Online merchants handling e-commerce payments protect checkout pages with script inventories, content security policies and monitoring for unexpected code changes, and many hand card entry to a hosted page or tokenization service so card data never touches their own servers.

Card issuers spot skimming through common point of purchase analysis: when many cards that later suffer fraud were all used at one ATM or shop, that location is likely compromised, and the issuer can reissue every card used there. Anomaly detection also flags a stripe-read transaction on a card that normally uses its chip, or a card used in two distant countries within hours.

Cardholders reduce their risk by covering the keypad when entering a PIN, using tap-to-pay with a phone or contactless card, which never exposes the stripe, checking card slots for loose or bulky parts and turning on transaction alerts. Skimming losses on unauthorised transactions are usually refunded under card chargeback rules and consumer law, but cash taken through a debit card can take time to recover. Skimmed data is one of the main sources for card testing fraud and wider payment fraud, and the copying of cards is related to counterfeiting in the broader sense.

• PCI Security Standards Council: Document Library
• EMVCo