Card skimming
What is card skimming?
Card skimming is the unauthorized capture of payment card data using a device that secretly reads and stores magnetic stripe or chip data when a card is used at a compromised terminal. Attackers then encode the stolen data onto counterfeit cards or use it for online purchases in .
Skimming happens wherever a card meets a reader someone else can tamper with: ATMs, fuel pumps, unattended kiosks, and terminals. It's one of the oldest forms of card still in wide circulation, because it doesn't require breaking – only physical access to a reader, or write access to a checkout page.
Key facts
- Also known as: card skimming, ATM skimming; shimming when the device targets the chip; e-skimming or web skimming for the online variant
- What gets captured: card number, expiry date, name, magnetic stripe track data, and the PIN when a camera or a fake keypad is present
- What usually doesn't: the isn't encoded in the magnetic stripe, which is why skimmed data has historically been used to clone cards rather than to buy online
- Who bears the loss: varies by scheme and channel – rules decide whether the or the merchant absorbs a fraudulent
How card skimming works
- Device installed – an overlay reader is fitted over a legitimate card slot, or a thin shim is inserted inside it. A pinhole camera or a fake keypad is often added to record the PIN.
- Card read twice – the genuine reader processes the payment while the skimmer copies the data. The transaction approves normally, so nothing looks wrong to the cardholder.
- Data collected – the device stores the data locally for physical retrieval, or transmits it wirelessly over Bluetooth or a mobile connection.
- Data monetized – the details are encoded onto blank cards, or sold on and used for online purchases where no physical card is needed.
- Fraud surfaces – cardholders dispute the charges, generating , and the traces the affected cards back to a common point of purchase.
Types
- Magnetic stripe skimming – an overlay reader copies the track data written on the stripe
- Shimming – a thin device sits between the chip and the reader's contacts and captures data from the chip
- PIN capture – a hidden camera or an overlay keypad records the as it's entered, which is what makes a cloned card usable at an ATM
- Contactless interception – a device reads card data at close range from
- E-skimming – a malicious script injected into a merchant's checkout page captures card details before they reach the
Why it matters
- Skimmed card data passes basic validation. The card number and expiry are real, so format checks clear and the decision rests on , signals, and velocity rules.
- One compromised terminal exposes every card used on it until it's found, which is why issuers and card networks work backwards from clusters of disputes to identify the point of compromise.
- EMV chip transactions generate a unique cryptogram per payment, so copied chip data can't be replayed the way stripe data can. That is what pushed skimming toward PIN capture and checkout-script injection.
- Merchants that accept stolen data in card not present transactions carry the chargeback, because the loss lands on the channel where the card was used, not the channel where it was skimmed.
- Tamper inspection of readers and unattended devices is part of obligations for anyone accepting cards at a physical terminal.
