What a credit card skimmer is and where you'll find one
A credit card skimmer is a small device or hidden software that captures your card number, expiration date, and sometimes your PIN when you swipe or insert your card. Skimmers are physical devices attached to ATMs, gas pumps, or card readers at checkout counters — places where you hand your card to a machine or a person you don't know. They work silently: you complete your transaction normally, but a copy of your card data goes to the criminal running the skimmer.
The most common locations are gas station pumps (especially at night or at smaller stations), ATMs in lobbies or convenience stores, and self-checkout terminals. Some skimmers are so thin they fit between the card slot and the machine's outer casing. Others are installed inside the machine itself by someone with access to the equipment. A few criminals also use handheld skimmers — small readers they swipe your card through when you hand it to them at a restaurant or retail counter.
Skimmers don't require internet connection at the moment of use. Many store the stolen data on a chip inside the device, which the criminal retrieves later. Others transmit the data wirelessly to a nearby phone or receiver. Either way, your card information leaves your hands without your knowledge.
Key Takeaways
- Skimmers are physical devices or software that copy your card data when you swipe or insert your card at ATMs, gas pumps, or checkout terminals.
- Gas station pumps and standalone ATMs are the highest-risk locations because they are often unattended and harder for banks to monitor regularly.
- You can reduce your risk by using ATMs inside bank branches, paying inside at gas stations instead of at the pump, and checking card readers for loose or misaligned parts before inserting your card.
- If you notice unauthorized charges, contact your card issuer immediately — federal law limits your liability to $50 if you report fraud within 60 days.
- Skimmers work even on chip readers and contactless payments if the criminal has installed hardware inside the machine, so no payment method is completely risk-free.
How skimmers capture your information
When you insert or swipe your card, a skimmer reads the magnetic stripe or chip and copies the data encoded there. This includes your card number, expiration date, and cardholder name. Some skimmers also have a hidden camera or overlay keypad that captures your PIN as you type it.
The criminal then uses this stolen data to make purchases online, create counterfeit cards, or sell the information to other criminals. Because the skimmer operates independently of the legitimate payment system, the bank's fraud detection doesn't catch it at the moment of skimming — it only catches it later when the stolen card is used in a way that looks suspicious (a purchase in a different city minutes after a local transaction, for example).
Where skimmers are most commonly found
Gas station pumps are the single most targeted location. Many pumps are outdated, use older locks, and sit unattended for hours. A criminal can install a skimmer in minutes and return days later to retrieve it. Overnight and early-morning hours are highest-risk because fewer people are around and fewer cameras are actively monitored.
Standalone ATMs — the kind in convenience stores, bars, or lobbies rather than inside a bank branch — are the second-highest-risk location. These machines are often serviced by third-party companies, creating more opportunities for someone to install a device. ATMs inside bank branches are lower-risk because the bank controls access and monitors them more closely.
Self-checkout terminals and unattended card readers at retail stores are also targets, though less common than gas pumps. Handheld skimmers used by employees or criminals posing as employees at restaurants and retail stores are harder to detect because you don't see the device — you only hand your card over.
How to spot a skimmer before you use it
Before you insert or swipe your card, look at the card reader itself. A skimmer is often a separate piece attached to the outside of the machine. Check whether the card slot looks loose, sits at an odd angle, or appears to be a different color or material than the rest of the machine. Try to wiggle it gently — a legitimate reader is flush and solid; a skimmer often has some give.
Look for a camera or small lens pointed at the keypad. Criminals sometimes hide a pinhole camera in a brochure holder, light fixture, or the machine's frame to record your PIN. If something looks out of place or newly installed, don't use that machine.
At gas pumps specifically, check the pump door and the card reader area. Skimmers are often installed on the outside of the pump, so a loose or misaligned panel is a red flag. If you're unsure, go inside and pay the attendant instead — this also reduces your risk because you control when your card is out of your sight.
What to do if you think you've been skimmed
If you notice a charge you didn't make, contact your card issuer immediately. Most card companies have a fraud department that operates 24/7. You can find the number on the back of your card or on your monthly statement. Report the unauthorized charge and request a new card with a different number.
Under the Fair Credit Billing Act, your liability for unauthorized charges is capped at $50 if you report the fraud within 60 days of the charge appearing on your statement. Many card issuers waive the $50 entirely. The sooner you report it, the faster the investigation moves and the sooner you get a replacement card.
Ask your issuer whether they can tell you where the skimmed data was used. This information helps law enforcement identify which machines or locations are compromised. If the skimmer was at a gas station or ATM you recognize, you can also report it to the business that operates the machine.
Reducing your skimming risk in daily transactions
Use ATMs inside bank branches whenever possible. These machines are accessed through a locked door and monitored more closely than standalone machines. If you must use a standalone ATM, use one in a well-lit, busy location during daylight hours.
At gas stations, pay inside at the counter instead of at the pump. This adds a few minutes to your transaction but removes the risk of a skimmer on an unattended pump. If you must pay at the pump, inspect the card reader first and consider using a debit card with a PIN rather than a credit card — this gives you the same fraud protections but with a different account number.
When you hand your card to a server at a restaurant or retail worker, watch where they take it. If they disappear into a back room or use a handheld device you can't see, you have no way to know if they're skimming it. This is a known risk, but the fraud protections on your card still apply if unauthorized charges appear later.
Monitor your statements regularly — weekly if possible, rather than waiting for the monthly bill. Many card issuers offer text or email alerts for transactions over a certain amount. Set up these alerts so you're notified immediately if your card is used.
Skimmers and different payment methods
Chip readers are more secure than magnetic stripe readers because the chip generates a unique code for each transaction, making it harder for criminals to reuse the stolen data. However, if a skimmer is installed inside the machine itself (rather than on top of it), it can still capture your chip data.
Contactless payments (tap or mobile wallet) are also more secure because your full card number is never transmitted to the merchant. However, a skimmer that captures your card number from the chip or stripe still works if you've swiped or inserted your card at that machine previously.
The safest approach is to use a combination: pay with contactless or mobile wallet when available, use chip readers when you must insert your card, and avoid swiping the magnetic stripe. But understand that no payment method is completely risk-free if a skimmer is present.
Frequently Asked Questions
Can a skimmer read my chip card?
Yes, if the skimmer is installed inside the machine. A skimmer on the outside of a card reader typically captures magnetic stripe data, but internal skimmers can read chip data too. Chip technology makes it harder for criminals to reuse the stolen data, but the data can still be stolen.
Will my bank refund me if I'm skimmed?
Yes, in almost all cases. Federal law limits your liability to $50 if you report the fraud within 60 days, and most card issuers waive the $50 fee. You must report the unauthorized charge to your issuer, not to the police or the business where the skimmer was located.
How long does it take for a skimmed card to be used?
It varies. Some criminals use the stolen data within hours; others wait days or weeks to avoid immediate detection. Many test the card with a small purchase first to confirm it works before making larger charges. This is why monitoring your statement weekly, not monthly, matters.
Can I get skimmed at a restaurant or store?
Yes, if an employee or criminal uses a handheld skimmer when you hand them your card. You can't see this happening, but your fraud protections still apply if unauthorized charges appear. Paying with contactless or mobile wallet reduces this risk because your full card number isn't transmitted.
What should I do if I find a skimmer on a machine?
Don't remove it yourself. Contact the business that operates the machine (the bank for an ATM, the gas station for a pump) and report the location and description. You can also report it to local police, though they may not investigate. The business will remove it and check whether other machines in the area are compromised.