What a credit card skimmer is and where you'll find one
A credit card skimmer is a small device that reads and stores your card number when you swipe or insert it. The thief installs it on top of the real card reader — at an ATM, gas pump, or checkout terminal — so your card passes through both the skimmer and the legitimate reader. You see a normal transaction go through. The skimmer silently copies your data.
Skimmers are most common at ATMs and gas pumps because those machines sit unattended and the thief can install and retrieve the device without a cashier watching. But they also turn up at restaurant payment terminals, vending machines, and parking meters. The device itself is usually plastic or metal, roughly the size of a deck of cards, and designed to look like part of the machine.
Some skimmers also include a hidden camera or keypad overlay to capture your PIN. The thief returns later to remove the skimmer and sell the stolen card data, or uses it themselves to make fraudulent charges or create counterfeit cards.
Key Takeaways
- Skimmers are installed over the real card slot on ATMs and gas pumps; they look like they belong there but feel loose or sit slightly proud of the machine's surface.
- Tug on the card reader, keypad, and any plastic trim before you use the machine — legitimate parts are bolted down and won't move.
- Gas pumps with visible damage, mismatched colors, or panels that don't fit flush are higher risk than well-maintained machines.
- Use ATMs inside banks during business hours rather than standalone machines in parking lots or convenience stores, where maintenance is less frequent.
- Check your bank and credit card statements within a few days of any transaction to catch fraud early, before the thief has time to use your full card number.
How to physically inspect a machine before you use it
Start by looking at the card slot and keypad from an angle. A skimmer sits on top of the real reader, so it will stick out slightly or sit at an odd angle compared to the rest of the machine. Run your eye along the seams where the card slot meets the machine's body — they should be tight and even. If there's a gap, or if the plastic looks newer than the rest of the machine, that's a sign something has been added.
Next, tug gently on the card slot itself. Legitimate card readers are bolted to the machine's frame and won't budge. A skimmer is usually glued or magnetically attached, so it may shift, click, or feel loose. Do the same with the keypad and any plastic trim around it. If anything moves when it shouldn't, use a different machine.
Look for physical damage or poor fit. Panels that don't line up, mismatched paint or plastic color, visible screws or tape, or signs of glue around the edges all suggest someone has opened the machine. Gas pumps in particular should have tight seams and consistent finish — if one pump looks rougher than the others next to it, skip it.
Red flags specific to gas pumps and ATMs
Gas pumps are skimmed more often than any other machine because they're outside, unattended, and the thief can work at night. Look for pumps that are visibly older or less maintained than others at the same station. Check whether the pump's door (the panel you open to insert your card) closes and latches properly. A door that's hard to close, doesn't latch, or has been pried open is a warning sign.
At ATMs, prefer machines inside a bank or credit union during business hours. Standalone ATMs in parking lots, convenience stores, and laundromats are skimmed more often because the bank doesn't monitor them as closely. If you must use a standalone machine, choose one in a well-lit, high-traffic area rather than a dark corner or isolated location.
Both ATMs and gas pumps should have a security camera visible nearby. If you don't see one, or if the camera looks broken or pointed away from the machine, that's a sign the location isn't being actively monitored. Thieves prefer machines without cameras.
How to protect yourself while using the machine
Cover the keypad with your hand or body while you enter your PIN. Even if there's no camera on the skimmer, someone may be watching from nearby. This is the single most important step — your PIN is the only thing standing between a thief and your account.
Use chip readers instead of swipe slots when you have a choice. Chip technology is harder to skim because the data changes with each transaction, while a magnetic stripe stores the same number every time. If the machine has a chip slot, insert your card there rather than swiping.
At gas pumps, pay inside with the cashier instead of at the pump if you're concerned about the machine. This takes longer but eliminates the skimming risk entirely. If you do pay at the pump, use a pump near the station entrance where the cashier can see it, rather than one at the far end of the lot.
What to do if you think you've been skimmed
Check your bank and credit card statements within a few days of any transaction. Fraudsters often test a stolen card number with a small charge ($1 to $5) before making larger purchases. If you see an unfamiliar charge, contact your card issuer immediately — most banks have a fraud line on the back of your card.
Report the suspected skimmer to the business that owns the machine. Tell the manager or cashier which specific pump or ATM you used and when. They can inspect the machine and alert their maintenance team. You can also report it to the FBI's Internet Crime Complaint Center (IC3) at ic3.gov, though local police reports are more likely to lead to action.
If fraud does occur, federal law limits your liability to $50 if you report it within 60 days of the statement date. Most card issuers waive even that $50 if you report it promptly. You won't be charged for fraudulent transactions, but you may need to wait while the bank investigates and reissues your card.
Chip cards, contactless payments, and other ways to reduce risk
Chip technology makes skimming much harder. When you insert a chip card, the machine reads an encrypted code that's different every time. A skimmer can still capture the data, but it can't be used to create a counterfeit card or make online purchases. If your card has both a chip and a magnetic stripe, always use the chip slot.
Contactless payments (tap or mobile wallet) eliminate the skimming risk entirely because your card never touches the machine. If your card supports contactless and the terminal has a contactless reader, use it. The same goes for mobile payment apps like Apple Pay or Google Pay — the merchant never sees your actual card number.
For ATM withdrawals, consider using a teller inside the bank instead if you need cash. Yes, it's slower, but it removes the skimming risk. If you do use an ATM, withdraw only what you need and check your balance frequently so you notice fraud quickly.
Frequently Asked Questions
Can a skimmer steal my PIN?
A skimmer can read your card number, but it can't steal your PIN unless it also includes a hidden camera or keypad overlay. That's why covering the keypad with your hand while you type is so important — it blocks any camera that might be pointed at it. Your PIN is the only thing protecting your account once your card number is compromised.
How long does it take for a thief to use a stolen card number?
It varies. Some thieves test the card with a small charge within hours. Others wait days or weeks before making larger purchases, hoping you won't notice right away. This is why checking your statement within a few days of any transaction matters — the sooner you spot fraud, the sooner you can stop it and the less damage occurs.
Will my bank refund fraudulent charges?
Yes. Federal law limits your liability to $50 if you report fraud within 60 days of the statement date, and most card issuers waive even that. You won't be charged for fraudulent transactions, but the bank may take a few days to investigate and credit your account while they verify the charges weren't made by you.
Is it safer to use my debit card or credit card at a skimmer?
Credit cards offer stronger fraud protection than debit cards. With a credit card, the fraud is between you and the card issuer, and you're not liable. With a debit card, the thief has direct access to your bank account, and while you're protected by law, getting your money back can take longer. Use a credit card for in-person transactions when possible.
What should I do if I see a skimmer on a machine?
Don't remove it yourself. Report it to the business owner or manager immediately and tell them which machine it's on. They can contact their maintenance team and the police. You can also report it to the FBI's IC3 at ic3.gov. The sooner the machine is inspected, the sooner other customers can be warned.