What a credit card skimmer is and where to find them
A credit card skimmer is a small device or hidden camera that reads your card number, expiration date, and sometimes your PIN while you swipe or insert your card. Criminals install them on machines you use every day: ATMs, gas pumps, restaurant card readers, and parking meters. The device sits on top of the real card slot or inside it, capturing your information without your knowledge.
Skimmers are most common at unmanned machines — places where no employee watches the transaction happen. Gas station pumps are the highest-risk location because they're outside, poorly lit at night, and nobody checks them regularly. ATMs in lobbies, parking garages, and convenience stores are also frequent targets. Restaurant card readers are less common targets because staff handle the machine, but handheld skimmers that waiters use are a separate risk.
The criminal either retrieves the skimmer later to download the data, or uses a wireless transmitter to send your information to a phone or laptop nearby. Once they have your card number, they can make purchases online, create counterfeit cards, or sell the data to other criminals.
Key Takeaways
- Skimmers are physical devices or hidden cameras installed on card readers at ATMs, gas pumps, and other unmanned machines to capture your card data without your knowledge.
- Wiggle the card slot, bezel, and any loose parts before inserting your card — a skimmer will feel loose, wobbly, or like it doesn't belong.
- Cover the keypad with your other hand when you enter your PIN, because many skimmers include a hidden camera pointed at the keys.
- Gas pumps and outdoor ATMs are the highest-risk locations; indoor ATMs in banks and well-lit, staffed locations are safer.
- If you notice fraud on your statement, contact your card issuer immediately — they will cancel the card and send a replacement, and you are not liable for unauthorized charges.
How to check a card reader before you use it
Before you insert your card, spend five seconds inspecting the machine. Look at the card slot and the bezel — the plastic frame around it. On a gas pump, the card reader should sit flush with the pump's body. On an ATM, the card slot should be smooth and aligned with the machine's front panel. If the card slot looks raised, crooked, or like it's sitting on top of the machine rather than built into it, do not use that machine.
Wiggle the card slot gently with your finger. A real card slot will not move. A skimmer, which is glued or taped on top, will shift, click, or feel loose. Wiggle the bezel and any plastic trim around the slot as well. If anything moves that shouldn't, walk away and use a different machine or location.
Check for gaps between the card slot and the machine's body. A skimmer creates a visible seam or space where it sits on top. Look for discoloration, scratches, or glue residue around the edges. Criminals often work quickly and do not sand or paint their installations, so rough edges and mismatched plastic are red flags.
Protecting your PIN from hidden cameras
Many skimmers include a small camera pointed at the keypad to record your PIN. Even if the card reader itself is clean, a camera mounted above the slot or inside the bezel can capture your four digits. Once a criminal has both your card number and your PIN, they can withdraw cash from ATMs or make purchases at any store.
Always cover the keypad with your other hand while you type your PIN. Cup your hand over the keys so that a camera — whether hidden in the machine or held by someone standing nearby — cannot see your fingers moving. This is the single most effective defense against PIN theft and takes no extra time.
Be especially cautious at ATMs in lobbies, parking garages, and outdoor locations where someone could stand nearby with a phone or small camera. If you feel watched or uncomfortable, leave and use a different machine. Trust your instinct — it is not worth the risk.
Red flags at gas pumps specifically
Gas pumps are the most common skimming target because they are outside, unattended, and criminals can install a device in seconds. Before you swipe or insert your card, check the pump's card reader panel. The panel should be flush with the pump body and show no signs of tampering.
Look at the security tape or stickers around the panel. Many gas stations place tamper-evident tape on the card reader door. If the tape is broken, peeling, or missing, the pump may have been opened recently. Do not use it. If you see a sticker that says "Card Reader Tested" or "Inspected," check the date — if it is more than a week old, the pump has not been checked recently.
Use the pump closest to the station's front door or the one most visible from inside. Criminals prefer pumps at the edge of the lot where they can work without being seen. If multiple pumps are available, choose the one with the most foot traffic and visibility.
What to do if you suspect a skimmer
If you notice a card reader that looks suspicious, do not insert your card. Instead, report it to the business or location immediately. Tell a gas station attendant, a bank manager, or the parking garage operator. Describe what you saw — a loose panel, a gap, a misaligned bezel — and let them inspect it. They can check the machine, review security footage, or call a technician.
If you have already used a machine you now suspect was compromised, contact your card issuer right away. Call the number on the back of your card or log into your online account. Tell them you may have used a compromised card reader and ask them to monitor your account for fraud. They can cancel the card immediately and issue a replacement, which usually arrives in five to seven business days.
While you wait for the replacement, you are not liable for any unauthorized charges. Federal law limits your liability to $50 if you report the fraud within 60 days of the statement date. Most card issuers offer zero-liability protection, meaning you owe nothing for fraudulent charges. Keep your receipt from the suspicious machine and any documentation of the report you made.
Safer alternatives to reduce skimming risk
The safest way to avoid skimmers is to use machines inside staffed locations. ATMs inside banks, credit unions, and grocery stores are monitored by employees and security cameras. Criminals are less likely to target them because they risk being seen. If you need cash, use an ATM inside your bank during business hours rather than an outdoor or lobby machine at night.
At gas stations, pay inside with the attendant instead of at the pump. This eliminates the card reader risk entirely. You hand your card to a person, they swipe it in a machine you cannot see, and they return it to you. This is slower than pump payment, but it removes the skimming threat.
For online purchases and phone orders, use a virtual card number if your card issuer offers one. Services like Citi Virtual Account Numbers, Capital One Eno, or American Express Digital Secure Numbers generate a temporary card number for each transaction. Even if the number is stolen, it cannot be used again and does not expose your real card number.
How card issuers detect and respond to skimming fraud
Card issuers use fraud detection software that watches for patterns. If your card is used at a gas pump in one state and then at a store 500 miles away two hours later, the system flags it as impossible travel. If your card is suddenly used for multiple small purchases in a short time — a common pattern when criminals test a stolen number — the issuer blocks the card.
When fraud is detected, your issuer will contact you by phone or email to confirm the charges. Answer honestly and tell them which charges are yours. They will cancel the card, reverse the fraudulent charges, and mail a replacement. The entire process usually takes one to two weeks, though you may receive a temporary card number to use online while you wait.
Skimming fraud is one of the easiest types for issuers to prove because the charge location and your location do not match. You have documentation — receipts, statements, your own location data — that proves you did not make the charge. This makes disputing skimming fraud faster than disputing other types of fraud.
Frequently Asked Questions
Can a skimmer steal my information if I use chip insertion instead of swiping?
Chip readers are harder to skim because the chip technology encrypts your data during the transaction. However, criminals can still install a skimmer on a chip reader to capture your card number and expiration date — they just cannot get the encrypted security code. This is why covering your PIN is still important even with chip insertion.
What should I do if I see someone tampering with a card reader?
Do not confront them. Leave the area and call local police immediately. Provide a description of the person, the machine, and what they were doing. If you are at a business, tell an employee or manager right away so they can secure the machine and review security footage.
How long does it take for a skimmed card number to be used?
It varies. Some criminals test the number within hours by making small purchases. Others wait weeks or months before using it, hoping you will not notice and cancel the card. The longer you go without checking your statement, the more time they have to act. Review your statement weekly or set up transaction alerts through your card issuer's app.
Will my bank refund me if I lose money to a skimmer?
Yes. You are not liable for unauthorized charges if you report them within 60 days of the statement date. Most card issuers offer zero-liability protection, meaning you owe nothing. Contact your issuer as soon as you notice the fraud, and they will reverse the charges and send a new card.
Is contactless payment safer than swiping or inserting?
Contactless payment (tap or phone payment) is safer because your card number is not transmitted to the machine. The transaction uses encrypted tokens instead of your actual card data. However, you still need to watch for skimmers on the card reader itself, in case the criminal is trying to capture data from other customers who do swipe or insert.