How to spot and avoid credit card skimmers

If you’re protective of your credit and debit card information, you’ve got good reason. You may have heard about illegal credit card skimmers that are installed at gas pumps, ATMs and other locations. 

These devices can steal credit and debit card information, costing financial institutions and consumers more than $1 billion each year, according to the FBI. Read on to learn more about what credit card skimmers do and how to spot them.

What you’ll learn:

• Illegally installing credit card skimmers is one way for fraudsters to steal financial information.

• Skimmers aren’t always easy to identify, but looking for signs of tampering can help.

• If you notice suspicious activity, call your card issuer immediately.

• Some ways to avoid potential credit card skimming include using contactless cards, digital wallets or cardless ATMs.

A credit card skimmer is a device that’s sometimes installed illegally on ATMs, fuel pumps or point of sale (POS) systems where credit or debit cards might be swiped. When customers swipe their cards using the card reader, the skimmer can scan or skim their card information. 

Fraudsters could then try to use the stolen data for: 

• Making unauthorized purchases online or over the phone

• Profiting by selling the data to other scammers

• Committing Identity theft

• Creating counterfeit cards

• Withdrawing funds from cardholders’ accounts

Skimmers are typically installed inside an ATM or fuel pump machine on its internal wiring. Other times, skimmers may be inside a card reader, fit on top of a card reader or on exposed cables. When a card is skimmed, its details—like the cardholder name, card number and expiration date—can be stolen via the card’s magnetic stripe. 

Credit card skimmers store the stolen data, and then the fraudster can download it to use in fraudulent ways. Some skimmers use Bluetooth devices to steal credit or debit card information, allowing the stolen data to be sent to the thief’s computer or phone.

An ATM skimmer may rely on other components, such as a hidden camera or keypad overlay, to capture a cardholder’s personal identification number (PIN).

While less common, there are thin devices called credit card shimmers that can be inserted inside chip-reading slots. Shimmers are generally invisible from the outside of a card-reading slot and can steal data from standard EMV chips—not just the card’s magnetic stripe.

Credit card skimmers aren’t meant to be seen, so you might not notice one at first glance. But there are some things you can do to spot signs of a skimmer before you swipe your card.

Check to see if the card reader and keypad look normal. Is there any piece of the machine that’s bulging, raised or out of alignment? Do the color and material of the card reader and keypad look consistent with the rest of the machine? Does it look like part of the machine is covering another part where it shouldn’t be? These signs could indicate that a skimmer was installed.

You can also try to feel around the card reader. If the machine feels like it’s coming apart in some places or like a piece of it isn’t sturdy or properly installed, that’s a sign that a skimmer could be in place. The Federal Trade Commission (FTC) suggests trying to give the card reader a little wiggle before inserting your card. If it moves, you can report it to an employee and find a new option or place of business.

Before using the keypad, try pulling its edges or seeing if it feels loose. If it doesn’t feel secure, that could be a sign that a keyboard overlay is in place to detect keystrokes.

At gas pumps, you can check for signs of tampering by looking at the security seal near the card reader. If the pump panel is open or the seal has been broken, the FTC says the label will show “void.” That’s a sign that there might be a skimmer installed. 

If you’re at a gas station, take a quick look at the other pumps around you to see if they look the same as yours. Do the card slot and keypad at your pump look about the same as the others? If not, that might be a sign of a skimmer.

Skimmers may be paired with a hidden camera to record PINs. Look closely above the card reader to see if any holes are pointing down to where you would enter a PIN. These cameras are sometimes called “pinhole cameras” as the hole in the machine for the camera’s view would be very small.

Keep in mind that some machines, such as ATMs, have legitimate security cameras.

Credit card skimmers are designed to look like they’re part of the POS system they’re attached to. Some skimmers fit over the original card reader in the machine but may appear bulkier. Others may be installed internally and therefore wouldn’t be visible.

The United States Secret Service website has a page that shows what skimmers might look like.

In the event a credit card skimmer can’t be seen or detected using the tips above, there are still things you can do to help protect yourself. Here are some ways to avoid credit card skimming:

Remember, hidden cameras are sometimes installed with credit card skimmers to capture PINs. The FBI suggests covering the keypad with one hand while you enter your PIN to prevent any cameras from recording you.

If you’re at a gas station, paying through their app or inside with an attendant might offer more protection. Fuel pumps are common targets for credit card skimmers because they are self-pay, away from direct view of employees. The POS inside where employees are present may be less likely to have a card skimmer installed for this reason. 

If you’re going to pay at a pump, the FBI suggests picking a pump that’s closer to the store or in direct view of the attendant. Those pumps are less likely to be targeted by fraudsters.

If you’re using an ATM, cardless machines or machines in high-traffic areas or inside bank branches may be more secure. Cardless ATMs allow account access and cash withdrawals without using a physical card. Typically, you can access these machines by verifying your account with a text message or through a banking app.

Swiping and inserting aren’t the only ways to pay with a card. If you have a contactless credit or debit card, you can simply tap it to the machine instead of inserting it. Contactless cards can be identified by a contactless symbol on the front or back of the card—it looks like four curved lines that grow in size from left to right. All Capital One ATMs offer cardless withdrawals.

A mobile wallet is another contactless tap-to-pay option you can use to avoid swiping or inserting your physical card. In addition to being contactless, digital wallets offer another layer of protection, as they use tokenization to encrypt card numbers. For that reason, they may be considered a safer way to pay because you don’t use your actual credit card number to make a transaction

While credit cards and debit cards are typically both safe options, credit cards may have slightly more protection than debit cards if fraud were to occur. For example, if your account number was used but your credit or debit card wasn’t stolen or lost, you shouldn’t be on the hook for the amount lost. But with debit cards, you must report fraudulent activity within 60 days of your statement date to avoid liability for your loss. 

Checking your bank and credit card accounts regularly might help you notice if there are suspicious or fraudulent charges. 

If your account has been compromised, report it to your card issuer immediately. You can do this by calling the number on the back of your card.

Fraudsters sometimes illegally install skimmers on card readers to steal credit card information. But there are signs of tampering you can keep an eye out for before paying with a card. There are also steps you can take to avoid card skimming altogether, such as using a contactless card or digital wallet to pay.

Explore digital payment options from Capital One to learn more about making fast, secure payments with your accounts.