Kathleen Finlay/ Getty Images
Key takeaways
- Chip cards are less vulnerable to skimming than magnetic stripe cards, but they aren’t completely safe.
- Crooks can still capture your card information from a chip card using a technique called shimming.
- Shimming allows criminals to create fake credit cards with your card information.
Now that we’ve adopted chip cards in the U.S., magnetic stripe cards are becoming a thing of the past. But does that do away with your risk for credit card skimming? Unfortunately, no — while chip-and-PIN cards are more secure, you should still be careful when using these cards.
Chip cards are more secure
Magnetic stripe credit cards carry a high risk of fraud through skimmers that criminals add to card readers at ATMs, retail stores and gas stations. These devices “skim” and record your card information when you swipe or insert your card into the card reader. Bad guys then retrieve this information from the skimmers and counterfeit your credit card’s details, which they can then use for fraudulent transactions.
The introduction of so-called EMV or chip card technology was designed to decrease this risk. With a chip card, you insert your card into the card reader without swiping. And while chip cards are safer than magnetic stripe cards, they are still at risk for fraud through a technique called “shimming.”
Chip cards can be shimmed
Chip cards are considered safe because they generate a different token for each transaction. While information skimmed from magnetic strip cards doesn’t change from transaction to transaction, the nature of chip tokens prevents fraudsters from using your information for future payments or activity.
Yet, as thieves will do, there’s a new technique called shimming that allows for even chip card information to be stolen from unsuspecting cardholders. Shimming uses a thin reader called a “shim” that fits into a card reader slot at a retailer or ATM. These shims contain a microchip and flash storage that can capture and save your card information from your chip card. Unlike the one-time transaction token generated by chip cards, the information captured by a shim contains the details required to authenticate and process future transactions.
The crooks can then retrieve the shim and use your card information to create forged cards with magnetic stripes, providing a tool for swiping their cards containing your information. These fraudulent mag stripe cards don’t arouse suspicion, because chip cards also typically contain a magnetic stripe as backup.
Take steps to protect yourself
You can take steps to reduce your risk of shimming and the theft of your card information.
One way is to turn to contactless cards and mobile wallets. These payment methods don’t require you to input your credit card into a card reader that can shim your information. Instead, you tap your card or wallet on the card reader, and that one-time token is generated for a transaction to go through.
Another way to remain vigilant is by paying attention to the way your chip card inserts into a card reader. If it’s difficult in any way for you to insert your card, or if the card reader itself isn’t secure to the machine, take your card and report it to your issuer.
Also, carefully read your credit card statements regularly to make sure that there are no transactions you didn’t initiate. And avoid using debit cards, especially at gas stations, which can expose your bank account to thieves without the protections offered by credit cards.
What to do if you’re a victim of shimming
If you’re a victim of credit card fraud, call your credit card issuer immediately. Many issuers offer fraud protections that absolve you of liability if you report the charges within 30 days. Your issuer can also freeze your account against future fraud, providing you with a replacement card for future transactions.
For next steps, the Federal Trade Commission has set up a website for victims of fraud to report their situation and outcomes.The FTC shares this information with law enforcement to support wider investigations into fraud.
And don’t be afraid to turn to your state’s attorney general or consumer protection agency for help, if you need it.
The bottom line
Although chip-and-PIN cards are an improvement on magnetic strip cards when it comes to exposure to fraud, your information isn’t 100 percent secure. Chip cards can still be skimmed — or shimmed —at card readers and ATMs. Stay vigilant to keep your chip card safe, understand the safest ways to pay and know the steps to take if you do become a victim of credit card fraud.
FAQs
Chip cards often come with advanced security features like tokenization and dynamic authentication, reducing the risk of skimming attacks. While still susceptible to card-not-present fraud, the adoption of chip cards has significantly decreased instances of in-person skimming fraud.
Can chip cards be scanned? ›
Credit card shimming is a technique used by identity thieves to steal credit card data. It's done by placing a small device on a payment terminal that scans your card's microchip and stores card information. Data from the device can then be downloaded and used to commit fraud.
Can your card get skimmed? ›
But, like chip cards, no card is completely immune to card skimming tactics. Sophisticated criminals have still found ways to exploit vulnerabilities in contactless card systems. Some have skimmers that can intercept communication between a card and the point of sale.
Can NFC payments be skimmed? ›
Potentially, payment terminals can be compromised. However, as opposed to regular card skimming, NFC communication is encrypted and tokenized – meaning that a card can hardly be duplicated thanks to its information being hidden.
How to stop contactless cards from being skimmed? ›
Don't keep your cards in easily accessible pockets or bags which will draw pickpockets' attention. Line your wallet or cardholder with tin foil to block scamming devices from reading your card. If you don't fancy the DIY approach, there are products like RFID readers available which do the same thing.
Can RFID cards be skimmed? ›
While it is technically possible for a thief to find a way to skim your RFID card, they would have to work quite hard to do so. If you do find yourself targeted for credit card fraud and identity theft, regardless of how it happens, report the theft immediately.
Can EMV cards be skimmed? ›
No, using long-range RFID readers to extract data from contactless cards is impossible. The near field communication (NFC, compliant with ISO/IEC 14443 standard) technology in contactless cards uses a 13.56Mhz radio frequency technology that only transmits digital data within a concise range.
How do you tell if your card has been skimmed? ›
You won't know that your card has been skimmed until you see unusual transactions, which is why it's important to regularly monitor your account and review card statements. You can also set up card alerts to get emails, texts or app notifications for new transactions.
Does tapping your card prevent skimming? ›
Does "tap to pay" prevent your card from being skimmed? Payment terminals with contactless technology that let you “tap to pay” prevent your card from being skimmed with a traditional card skimming device. However, scammers never seem to run out of new ways to steal your card data, so you should always stay vigilant.
How to avoid card being skimmed? ›
How Can You Avoid Card Skimmers?
- Run your debit card as a credit card without using the PIN. ...
- Pay inside at the gas station. ...
- Use your card's tap-to-pay functionality.
- Pay with cash instead of plastic.
- Use an online or mobile payment service such as Apple Pay, Google Pay or PayPal.
Are contactless cards safer than chip cards? Contactless credit cards can also be EMV chip cards. However, contactless payments tend to be safer since the credit or debit card itself never makes contact with the payment terminal.
Can my debit card be scanned while in your wallet? ›
Similarly to card skimming, card scanning is a type of payment card theft where the fraudster with a scanning device gets close enough to your bag or wallet to scan your card number. This type of fraud is enabled by the fact that today's payment cards typically work on Radio Identification Frequency (RFID) technology.
Can card skimmers read Google Pay? ›
Payment method encryption: Since Google Pay doesn't store your card details on your device, no one can access your info, even if it's unlocked. Learn more about automatic security features.
Can my credit card chip be scanned? ›
Although banks claim that RFID chips on cards are encrypted to protect information, it's been proven that scanners—either homemade or easily bought—can swipe the cardholder's name and number. (A cell-phone-sized RFID reader powered at 30 dBm (decibels per milliwatt) can pick up card information from 10 feet away.
Is card skimming still a thing? ›
But is card skimming still a thing in 2024? Very much so. According to the FBI, card skimming fraud still costs financial institutions and American consumers more than $1 billion yearly—and it's growing. In 2023, the FTC reported card compromise reports (CCRs) saw a 20% year-over-year increase.
Why does my card keep getting skimmed? ›
High-quality devices are attached over the card slot and others are placed inside the card slot. The reader can record your card information. Sometime, a tiny camera might be installed nearby to record your PIN as you enter it or an artificial keypad could be placed over the existing one to record your keystrokes.
Can chip cards be tracked? ›
The short answer is no, your card's physical location can't be tracked, and the chip in your card doesn't contain a tracking system.
Can RFID chips be scanned? ›
You scan the RFID chip with a specialized reader or NFC-enabled smartphone. The device creates an electromagnetic field with its antenna that powers the chip inside the document, so it can communicate with the device. Then it sends some commands to obtain the required data.
Can chip cards be read remotely? ›
Yes, chip credit cards can be read remotely, but only if they have contactless capabilities. A chip-only credit card has to be dipped into a card reader in order to complete the transaction. That's because the chip does not transmit any signal that can be picked up from a distance by a card reader or a fraudster.
Can credit cards with chip be cloned? ›
Unlike a magnetic strip, which simply stores information, a microchip encrypts your account data, making your card much less susceptible to skimming and cloning.
