Debit and credit card skimming has been around for decades and continues to be a threat.
The Federal Bureau of Investigation (FBI) estimates that card skimming costs individuals and institutions around $1 billion annually — and there are no signs of it slowing down.
According to data gathered by FICO, card skimming increased by a stunning 759 percent from 2021 to 2022.
How card skimming works
The magnetic stripe (AKA magstripe) on the back of your debit or credit card holds sensitive information, including your name, account number, and your card’s expiration date and security code.
To steal that information, fraudsters install a card skimming device — or illegal card reader — over or within a point of sale (POS), ATM, or gas pump card reader. Because debit cards require a PIN, there is often a small hidden camera, or a concealed keypad cover, to record that as well.
When you (unknowingly) swipe your card’s magnetic stripe through a card skimmer, it reads and stores your data, giving criminals the ability to create a phony card, draw money from your bank account, or rack up your credit card balance.
SNAP cards with a magstripe are also susceptible to skimming.
What if you insert a chipped card or use tap-to-pay?
EMV chip cards offer an extra layer of protection for your data because, unlike the magnetic stripes which contain static data, EMV chips encrypt that information.
Rates of card skimming initially declined after the widespread introduction of EMV chip cards in 2015, according to the U.S. Secret Service. However, fraudsters have recently developed state-of-the-art skimming technology called card shimmers, which can bypass these protections.
Though shimmers are still less common than skimmers, there’s another ruse fraudsters can use to bypass the EMV cards’ additional security. In some cases, criminals infect card readers with malware in order to shut down the chip reader. Typically, retailers will then ask the customer to swipe their card’s magstripe instead, making it susceptible to traditional skimmers.
Contactless payments — “tap to pay” or “tap to go” — are largely safe from fraud. Cards equipped with tap-to-pay use short-range electromagnetic waves to transmit payment information from the card to the POS reader, without requiring the use of an EMV chip or magnetic stripe.
However, they may not be 100 percent secure, as a few cases of fraud related to tap-to-pay cards were reported in 2023.
How to spot a skimming device
Newer devices are virtually undetectable. In some cases though, when older technology is installed, you may be able to spot some warning signs.
Keep your eyes peeled for these red flags when you’re paying by card at a gas station, ATM, or POS card reader:
The card reader looks different from others. As you approach, take note of the card readers. Do they all look the same, or is the one you’re using different in shape than others? If it’s different in any way, avoid using it.
There are signs of tampering. Many gas pumps will have a tamper-proof seal or sticker across the panel that holds the card reader (click here for a visual from the Federal Trade Commission). If the seal looks broken — or if you notice any other signs of tampering — don’t swipe or insert your card and alert the attendant.
It moves. Try to tug on the card reader; it shouldn’t move. If it wiggles or shifts in any way, don’t use it.
How to protect yourself from card skimming
In addition to knowing how to spot skimming devices, there are other ways to minimize your risk, like:
Use contactless payment or cash. A card skimmer records data through the magnetic stripe on cards (and a shimmer, by way of the chip), so without skimming or inserting your card, a criminal can’t reach your data. When possible, use tap to pay, your digital wallet, or cash.
Avoid vulnerable card readers like gas pumps out of view of the attendant (or pay for gas purchases inside the station) and stand-alone ATMs, which are at higher risk for tampering than those located inside a bank or building.
Opt for credit. Across the board, credit cards offer more financial fraud protection than debit cards so use your credit card whenever possible. If you need to use your debit card, run the charge as credit to avoid having to enter your PIN.
Conceal your PIN. When you use your debit card and have to enter your PIN — like at an ATM — use your hand to cover the numbers in case there’s a hidden camera.
Check your bank accounts and credit card statements regularly. Keep a close eye on your bank accounts and credit card statements to catch any pending or posted charges as quickly as possible. If you’re an Allstate Identity Protection member, you can also connect your accounts to our financial monitoring and credit monitoring tools to receive text or email notifications for every transaction.
What to do if you’ve fallen victim to card skimming
Time is of the essence when it comes to remediating fraud. If you notice an unusual transaction on your credit or debit card, report the fraud to your bank or credit card company immediately to dispute the charge.
Though card skimming by itself is typically a case of financial fraud — not identity theft — stay alert for any signs that other personal identifying information or credentials have been compromised.
If you’re a member of Allstate Identity Protection and you suspect that your identity has been stolen, contact our identity specialists, who are on hand 24/7 to help you when you need it most.
