A card skimmer is an illegal device that criminals attach to card readers at Automated Teller Machines, (ATM), Point-of-Sale (POS) terminals, or at gas pumps. Criminals can use the data captured from the magnetic strip to steal the victim’s identity or create fake debit, credit, or Electronic Benefits Transfer (EBT) cards that can be used to make purchases and steal the victim’s money or benefits. Card skimmers can be hard to detect because they are designed to blend into the terminal. This weekend, we got a report of 17 skimmer devices on ATMs, Gas Pumps, and Retail Payment Machines in the San Antonio, TX area. Skimmers are a real threat in our area…below are some ways to help protect your accounts.
How Skimming Works
Traditional ATM skimmers are physical devices, often placed as overlays on card readers, designed to steal data from a card’s magnetic stripe or from the embedded chip when the card is physically inserted. Criminals often pair these with hidden cameras or fake keypads to capture your PIN.
- Most skimming devices used at ATMs and POS terminals fit over the original card reader; however, at gas stations, they can also be hidden internally behind the card reader.
- Fake keypad covers can also be used to record a PIN.
- Pinhole cameras can be placed above or around the PIN Pad or installed on the ATM to record a customer as they enter their PIN.
Best Practices to Detect Skimmers
- Inspect the terminal for signs of tampering (loose parts, odd attachments) before use.
- Look for security tape placed over the cabinet panel of the gas pump. If the panel has been tampered with, the security tape will read “void.”
- Look for skimming devices placed on top of gas station card readers.
- If possible, use a credit card instead of a debit card to avoid entering your PIN. Credit cards may also provide additional protections against fraud.
- Use gas pumps located closest to the attendant or pay inside the gas station.
- Always opt for contactless payment when available.
- No Physical Contact: The card or mobile device never makes physical contact with the potentially compromised parts of the card reader, eliminating the opportunity for a physical skimmer to capture data.
- Tokenization and Encryption: Contactless transactions use Near-Field Communication (NFC) technology to transmit encrypted data wirelessly. Each transaction generates a unique, one-time use code (a “token”) that is useless to a thief if intercepted, as it cannot be reused for subsequent transactions or to create a counterfeit card.
- Limited Range: The radio frequency identification (RFID) communication used is very low-power and only works over a very short distance (around 6 feet maximum), making it extremely difficult for an unauthorized reader to intercept the signal from afar.
- Shield the keypad with your hand when entering your PIN, just in case a camera is present.
- Monitor your account activity regularly and enable transaction alerts to spot any suspicious charges immediately.
- Lost/Stolen Cards: Immediately report lost cards and enhance your security by using a mobile wallet (like Apple Pay or Google Pay), which require an extra layer of biometric authentication (fingerprint or face ID).
This information is for general education purposes only and not to be used as tax or legal advice. The opinions and recommendations expressed herein are those of the author(s) and not necessarily those of Stone Bank. Stone Bank’s website may contain links to websites of other organizations that are no longer protected by our privacy policy or security practices. Stone Bank nor any of their employees assume any legal liability for the accuracy, completeness, or usefulness of this information.