Table of Content
Table of Content
Table of Content
Card Skimming: ATM Warning Signs and What to Do Next
Card skimming is the theft of card data at the point where a card meets a machine: an ATM slot, a fuel pump, a self-checkout reader. A device fitted over or inside the reader copies what the card gives up, while a camera or fake keypad records the PIN. The data then ends up on a counterfeit card, usually used far from where it was stolen.
Chip readers make local cloning hard, so stolen data is worth most where chip checks are weak. The EBA and ECB 2025 report on payment fraud found that 70% of card fraud by value was cross-border, although most card transactions are domestic.
How ATM skimmers work
How do ATM skimmers work? Most setups have two parts. One reads the card: an overlay that fits over the slot, a thin insert pushed deep inside it, or a device hidden inside an unattended terminal such as a fuel pump. The other captures the PIN: a pinhole camera hidden in a panel or light strip, or a keypad overlay glued onto the real one. Cash machines are not the only target: Europol lists payment terminals in bars and restaurants, parking ticket machines and unmanned petrol stations among the places where skimming occurs.
A magnetic stripe holds a static copy of the card number, expiry date and a verification code, and that copy can be written onto any blank card with a stripe. This is classic ATM skimming. Debit card skimming at cash machines does the most damage because the PIN is captured alongside, which opens the door to cash withdrawals. Credit card skimming at an unattended pump without a PIN pad yields data that is mainly useful at terminals that still accept a swipe.
Skimming vs shimming
What is card shimming? A shimmer is a paper-thin circuit slid into the card slot so it sits between your card's chip and the machine's chip reader, recording what the chip transmits during a normal transaction.
Recorded chip data has limited value. It cannot produce a working chip clone, because the chip signs each transaction with keys that never leave it, and a stripe card built from it carries a verification value that issuers should reject. Criminals have moved to relaying instead of copying. The European Payments Council's 2025 threats report describes ATM relay attacks: a shimmer passes the chip's communication live to a relay card inserted in another ATM, while the PIN entry is filmed and streamed to an accomplice who types it in and collects the cash there. The EPC observed a sharp increase in these attacks in several European countries in 2024.
So, can a chip card be skimmed? Its stripe can, its chip data can be shimmed, and in a relay attack the chip is used remotely during your own transaction. Every one of these routes still needs your PIN. For a cardholder, skimming vs shimming changes the criminal's route to cash, not what you should do.
horizontal scroll
| Skimmer | Shimmer | |
|---|---|---|
| Where it sits | Over or inside the stripe reader, or hidden inside an unattended terminal | Inside the slot, against the chip contacts |
| What it captures | Stripe data, plus the PIN via camera or keypad overlay | Chip communication, recorded or relayed live, plus the PIN via camera |
| What criminals make | Counterfeit stripe cards | Stripe clones that issuers should reject, or a live relay withdrawal at another ATM |
| Best cardholder defence | Tap or insert instead of swiping; cover the PIN | Tap instead of inserting; cover the PIN |
Skimmers and shimmers attack different parts of the card, and both depend on capturing the PIN.
Source: European Payments Council, 2025; Europol
How to spot a card skimmer
How to spot an ATM skimmer starts with comparison: overlays are built to blend in, but they rarely match a neighbouring machine perfectly. Knowing how to spot a card skimmer at a fuel station follows the same logic. Before you insert a card, check for:
- A card slot that protrudes further than on the machine next to it, or differs in colour or texture.
- A keypad that sits higher than the panel around it, or feels spongy or loose when pressed.
- Glue, tape residue, scratches or a cracked panel around the slot or keypad.
- A pinhole or a new strip above the keypad or screen where a camera could sit.
- At fuel pumps, a broken or missing security seal on the pump door, or a pump out of the cashier's view.
Visual checks have a ceiling. Insert-style skimmers, shimmers and devices hidden inside unattended terminals sit inside the machine, so a clean-looking reader proves little. Europol's advice is to stand close to the ATM, shield the keypad with your spare hand and body, and choose a different machine if someone is watching. If something looks wrong, do not pull at it or try to remove it: use another machine and report it to the bank that runs the ATM or to the police.
Card skimming prevention that holds up
Card skimming prevention works best when it takes the stripe out of the transaction. Is contactless payment safer than swiping? For skimming specifically, yes: a tap never enters the slot, and each contactless payment sends a one-time code that cannot be replayed as a counterfeit stripe. Inserting the chip comes second. Swiping, where a terminal still allows it, exposes the most.
Cover the keypad with your other hand every time: the PIN turns stolen stripe data into cash, and a hand defeats the camera. Card controls help as well: limits, location settings or blocks on certain transaction types leave a cloned card less room. Check which Blackcat security controls are available in the app.
A hypothetical case shows why the PIN matters. Tomás withdraws €100 at 23:00 from an outdoor ATM on a busy tourist street in Lisbon. Two days later his app shows a €400 cash withdrawal in Bangkok, although the card never left his wallet. The skimmer copied the stripe and the camera filmed his PIN. With the keypad covered, the copy would have been close to useless at a cash machine.
What to do if your card is skimmed
What to do after suspected card skimming follows one order of steps, whether you notice a loose slot or an unfamiliar payment:
1 . Stop using the machine, and tell the operator or shop staff. Note its location and the time.
2 . Freeze or block the card in your app, or call the issuer on the number in the app or on its website, never a number posted on or near the machine.
3 . Review recent transactions, including small ones, since test charges of a few euros sometimes come first.
4 . Follow the issuer's instructions on replacing the card and disputing payments you did not make.
5 . Keep the evidence: receipts, the machine's address, date and time, and the IDs of unfamiliar transactions.
Should I replace a skimmed card? If you have reason to think its data was copied, yes. Freezing stops new payments while you investigate, but copied data stays usable until the card number changes, and a replacement card with a new number leaves the clone worthless. Knowing what to do if your card is skimmed matters because timing counts: EU rules tie your position on unauthorised payments partly to how quickly you report, and outcomes are assessed case by case rather than refunded automatically.
Key takeaways
- Skimmers copy stripe data; shimmers record or relay chip data.
- A clean-looking machine is not proof of safety, so cover the PIN every time.
- Tapping keeps the card out of the slot altogether.
- Suspect a skim: block the card, check transactions, get a new card number.
Protect the card you carry
Read how payment card protection works for Blackcat cardholders and which settings you can manage yourself.
FAQ:
How do skimmers steal card information and PINs?
A reader over or inside the slot copies the card data, while a hidden camera or keypad overlay records the PIN. Together they allow a counterfeit card for cash withdrawals.
Which warning signs can you check before using an ATM?
Compare the slot and keypad with a neighbouring machine and look for loose parts, glue, tape residue or pinholes.
How does shimming differ from traditional magnetic-stripe skimming?
Skimmers copy the stripe; shimmers sit inside the slot and read chip data. Shimmed data cannot clone a chip, but criminals can relay it live to another ATM while an accomplice enters the filmed PIN.
Does a chip or contactless card remove every fraud risk?
No. They make cloning much harder, but card details can still be stolen online or through scams.
What should you do immediately after using a suspicious reader?
Tell the operator, block the card through your app or the issuer's verified number, and check your transactions.
When should you freeze a card and contact its issuer?
As soon as you suspect a tampered device or see a payment you do not recognise. A freeze can be lifted; a delay cannot be undone.
What details should you preserve when reporting an unfamiliar payment?
The date, amount, merchant name and transaction ID, plus where and when you last used the card at a machine.
What is card skimming?
Theft of card data by a hidden device on an ATM, fuel pump or payment terminal, usually combined with a camera or fake keypad to capture the PIN.
