Card skimmers have been used for years now as a method for criminals to capture credit and debit card information. It's a fairly common scam, yet it's also one that we all can help stop with awareness and vigilance.
What is a Card Skimmer?
A card skimmer is a small piece of technology used by criminals that reads credit and debit card information from the magnetic strip (or magstripe) on the back of the card. The skimmer is simple and works in the exact same way as the magstripe reader found on all credit/debit card terminals found in stores, ATMs, gas pumps, and legitimate pocket-card readers (like Square or PayPal), as it literally reads the magnetically encoded data. Skimmers are used to capture card information contained in the magstripe (such as credit card number, full name, card expiration date and country code), and then the criminals typically use that card information to create fake cards that can be used for purchases and to get cash.
Where Do You Find Skimmers?
Skimmers are usually small, and they are normally found placed just over the top of a card slot of a reader, such as on an ATM, gas pump or store card terminal, unless it's a pocket skimmer. They are typically placed at less visible, less popular locations for easier application and subsequent removal, but they really could be placed just about anywhere.
For ATMs, skimmers are typically installed over the weekend and removed before Monday to avoid being found by ATM owners. That being said, skimmers come in all sizes, and small ones could also be slipped onto a card reader in a store without being too obvious.
There are also pocket-sized skimmers that someone may pull out for surreptitious use right next to an actual card reader. An example of this could be a skimmer used by someone in a restaurant while they have your card and are running it away from the table or in the drive-through line.
How is the Captured Data Used?
Many criminals only capture the information and then sell it, or they may produce cards to sell to criminals. They also may employ others to use the cards, return with what they could get and give them a cut of the "take". The end user of these fake cards is always at risk, as the card may have already been flagged for fraud when they try to use it. For this reason, they prefer to use the fake cards when there is little or no human interaction. People will try to use the fake cards to buy gift cards, or things that are easily and quickly re-sellable and for cash when they can.
PIN codes are needed for the cards to be used for cash withdrawals, and that is why you will typically find a small camera hidden nearby pointing at the pin pad to attempt to capture the PINs entered with each card. Another tactic they use is to place a fake number pad on top of the actual number pad, and this fake pad captures the PIN while allowing the button presses to still reach the actual keys.
The 3 or 4-digit security code on the back of the card cannot be captured with a skimmer, which makes it less likely for criminals to attempt to make online purchases with cards created from skimmer captured information. Most all sites now require this code on the back to perform an online purchase.
How To Recognize a Skimmer
A skimmer is designed to go unnoticed. There are different types, as they are shaped to match different card readers.
While the plastic may be molded to closely match the original, there are some telltale signs of a skimmer being used.
- Plastic color may not match the rest of the reader
- Skimmer may be mis-aligned, looking a crooked or imperfect
- The skimmer can be dislodged with a little bit of wiggling or a tug
- The device may appear very worn
Tap/Click on these images to see larger images
What You Should Do
- Keep Your Eyes Open - Look for anything that seems off or out of sorts. Skimmers may use a slightly different color of place, a hidden camera could be installed within line of the sight of the pin pad, a fake sign may be mis-aligned.
- Check for Tampering - Don't be afraid to wiggle, shake or pull on the card slot area at an ATM, gas station or store. Using your hands is just as important as using your eyes. If it's a skimmer, it can pop right off in your hands. Also be sure to look for edges next to the number pad, because if there's a fake number pad on top of the real pad, it should lift up fairly easily.
- Use the EMV Chip Slot (whenever possible) - Most stores and restaurants are now using EMV chip readers. There are only a few hold-outs left. Gas stations and ATMs are still not quite there, and it is still possible to place a skimmer in front of an EMV chip slot. So, make sure you wiggle or tug on the area just to be safe.
- Use Apple Pay, Android Pay, Samsung Pay or the Store/Gas Station App - Many stores have card readers that not only have an EMV chip slot, but they also support contactless or NFC payments. It will usually show on the reader if they support any of the smartphone payment systems. Some stores and gas stations also let you pay with their app instead of running your card through a reader. These options allow you to completely avoid running your card through any slot, therefore eliminating skimmer risk.
- Always Shield Your PIN - Even if you think it might look silly, always just assume someone is watching over your shoulder and wants to know your PIN. Use your free hand and even your body to obscure your PIN from sight just in case a camera is hidden nearby.
- Don't Let the Card Out of Your Sight - We know, this is nearly impossible to do at restaurants where you sit down and order, however the more you keep the card in your sight (or preferably, in your hand) when making a purchase, the likelihood of someone using a pocket skimmer is greatly reduced. If you are going through a drive-thru, keep an eye on the card as they run it through the reader. If anything looks suspicious, get a manager.
- Speak Up - If you ever find a skimmer, alert the police immediately. It's also important to let the store, gas station or financial institution know. Companies work closely with law enforcement to protect the people using their services. They need to know of anything suspicious, so they can pull footage and try to apprehend the criminals using skimmers.
The Good News
Magnetic Stripe technology is on the way out. Over the next few years all cards will ditch the magstripe and will only carry a chip. That means the skimmers that we know today won't be useful for criminals much longer. To get to this point, however, there are still many magnetic stripe readers to be replaced, before this can occur. In the meantime, be sure to stay vigilant and use the above-mentioned tips to avoid and catch card skimmers.