How Credit Card Skimming Works

Thieves Use Credit Card Skimming to Steal Your Data

A woman using an ATM
© Thanasis Zovoilis / Creative RM / Getty

Victims of credit card skimming are completely blindsided by the theft. They notice fraudulent charges on their accounts or money withdrawn from their accounts, but their credit and debit cards never left their possession. How did the theft happen?

How Credit Card Skimming Works

Credit card skimming is a type of credit card theft where crooks use a small device to steal credit card information in an otherwise legitimate credit or debit card transaction.

When a credit or debit card is swiped through a skimmer, the device captures and stores all the details stored in the card's magnetic strip. Thieves use the stolen data to make fraudulent charges either online or with a counterfeit credit card. 

Credit card skimmers are often placed over the card swipe mechanism on ATMs and gas stations. With ATMs, the crooks may place a small, undetectable camera nearby to record you entering your PIN. This gives the thief all the information needed to make fake cards and withdraw cash from the cardholder's checking account.

Occasionally, certain retail and restaurant workers who handle credit cards are recruited to be part of a skimming ring. These workers use a handheld device to skim your credit card during a normal transaction. For example, we routinely hand our cards over to waiters to cover the check for a restaurant. The waiter walks away with our credit cards and, for a dishonest waiter, this is the perfect opportunity to swipe the credit card through a skimmer undetected.

Once the victim's credit card information is stolen, thieves will either create cloned credit card to make purchases in store, use the account to make online purchases, or sell the information on the internet.

Victims of credit card skimming are often unaware of the theft until they receive a billing statement or overdraft notices in the mail.

How to Prevent and Detect Credit Card Skimming

Simply using your credit card puts you at risk of becoming a credit card skimming victim. Credit card skimming incidents can be difficult to detect. Unless you know what you're looking for, it can be extremely difficult to detect skimming devices.

Catching fraudulent charges related to a skimming incident requires you to watch your accounts frequently. Monitor your checking and credit card accounts online at least weekly and immediately report any suspicious activity to your bank or credit card issuer.

Here are a few more tips for avoiding credit card skimming.

  • Watch where you shop. Restaurants, bars, and gas stations seem to be the places where credit card incidents happen most frequently. Retail store self-checkouts and ATMs, especially standalone ATMs (those that aren't at the bank) are also places that skimmers can be found.
  • Know how a credit card skimmer looks. Krebs on Security has a well-documented page on credit card skimming and several pictures of credit card skimmers that demonstrate how difficult it is to detect the devices, which have become smaller and more difficult to detect over the years.
  • Check ATMs before using them. At ATMs, skimmers often place a camera within view of the keypad to steal your PIN. Or, they place a fake keypad on top of the real one to record your keystrokes. When you're using an ATM, cover your hand as you type your PIN to keep a camera from catching a view of what you're typing. If the keys seem hard to push, eject your card and use another ATM. Use a bank-operated ATM, which is less likely to have a skimmer, rather than an ATM at a store or gas station.
  • Don't become a victim of "credit card cleaning" scams, where thieves claim to clean the magnetic strip on your credit card to help it work better. These thieves simply swipe your credit card through a credit card skimmer and take your credit card information.

How to Report a Credit Card Skimming Loss

Contact your bank or credit card issuer to let them know that your credit card information has been compromised. Call first, then follow up in writing. If only your credit card information has been stolen, you won't be liable for any fraudulent charges.

Place a fraud alert on your credit report. This forces businesses to confirm your identity before approving applications in your name.

Alert the Federal Trade Commission. They often work to break up large credit card skimming rings. Your complaint will help catch the thieves.