ATM skimming is a form of payment card fraud where criminals attach hidden devices to ATM card readers to steal your card data and PIN. The stolen information is used to create counterfeit cards and drain bank accounts. Skimming attacks cost US consumers and banks hundreds of millions of dollars annually. Knowing what to look for takes seconds and can prevent significant financial harm.
For general ATM safety and usage guidance, see the ATM Guide 2026.
How ATM Skimming Works
A skimming attack has two components that work together:
Component 1 — Card Data Capture: Criminals glue a thin skimming device over the ATM’s legitimate card reader slot. When you insert your card, it passes through the legitimate reader (so the transaction works normally) but also through the skimmer, which records your card’s magnetic stripe data.
Component 2 — PIN Capture: Thieves use one of two methods:
- Hidden camera: A tiny pinhole camera aimed at the PIN pad, disguised as a brochure holder, decorative trim, or built into the skimmer itself
- PIN pad overlay: A fake PIN pad placed directly on top of the real one that records keystrokes before passing them through
With both pieces of data, criminals manufacture a cloned card using blank magnetic stripe cards and a card encoder, then use it at ATMs to withdraw cash — often internationally to avoid easy tracing.
How to Detect an ATM Skimmer
Before inserting your card, spend 10 seconds checking:
| What to Check | How to Check | Red Flag |
|---|---|---|
| Card reader | Tug firmly | Wiggles, feels loose, or detaches |
| Card reader color/fit | Visual inspection | Different color, poor alignment, extra bulk |
| PIN pad | Press corners | Feels spongy, raised, or overlaid |
| PIN pad color | Visual inspection | Doesn’t match ATM’s design |
| ATM fascia (front panel) | Press around card slot | Loose panels or gaps |
| Brochure holders / trim | Look for tiny holes | Pinhole camera visible |
| ATM screen bezel | Visual inspection | Unusual bulges or additions |
The tug test is the most reliable check: A legitimate card reader is firmly attached and will not move. Skimmers are glued on and often wiggle when tugged firmly.
Riskiest vs. Safest ATMs
| ATM Type | Risk Level | Reason |
|---|---|---|
| Gas station / convenience store (standalone) | Highest | Less frequent inspection, isolated placement |
| Tourist area standalone ATM | High | High-value targets for criminals |
| Outdoor bank ATM (no camera coverage) | Moderate | Less monitoring than branch interior |
| Indoor shopping center ATM | Moderate-Low | Better visibility and foot traffic |
| Bank branch ATM (lobby or vestibule) | Lowest | Frequent inspection, security cameras, staff nearby |
For routine withdrawals, use ATMs at bank branch locations when possible. When you need cash at a gas station or convenience store, apply the tug test and cover your PIN.
Protecting Yourself at ATMs
Habits that reduce your skimming risk:
- Cover the PIN pad with your free hand every time you enter your PIN — this defeats camera-based capture regardless of whether a skimmer is present
- Use bank branch ATMs over standalone machines when possible
- Use tap-to-pay / NFC where available — contactless ATM transactions (offered by Chase, Bank of America, and others) don’t require card insertion, making skimming impossible
- Vary your ATMs — using the same machine repeatedly creates predictability
- Check your account frequently — set up transaction alerts in your bank’s app so any unauthorized withdrawal triggers an immediate notification
- Trust your instincts — if an ATM looks different from others you’ve used at the same bank, or any part feels loose or unusual, walk away
Shimming: The Upgrade to Skimming
As chip cards became standard, criminals evolved to shimming — inserting an ultra-thin device inside the card reader slot (rather than on top) that intercepts the chip transaction. Shimming captures less data than magnetic stripe skimming but can still extract enough information to clone cards in some cases.
How to detect a shim: Because the device is inside the reader, visual inspection alone won’t catch it. Signs include: the card inserts with slight resistance or doesn’t seat fully, the card takes longer to read than usual, or the machine asks you to reinsert the card multiple times.
Contactless (tap) payments bypass shimming entirely, since the card never enters the reader.
What to Do If You’ve Been Skimmed
Act immediately — the faster you respond, the less damage thieves can do.
- Call your bank using the number on the back of your card. Report the suspected compromise and request a card replacement and account review.
- Dispute unauthorized transactions — banks are required to investigate debit card fraud claims. Under the Electronic Fund Transfer Act, your liability is limited to $50 if you report within 2 business days and $500 if you report within 60 days.
- Change your PIN on any accounts that used the same PIN at the skimmed ATM
- File an FTC report at reportfraud.ftc.gov
- File a police report — useful documentation for bank disputes
- Report to the ATM operator — call the number on the ATM so the machine can be inspected and the skimmer removed, protecting future users
Skimming vs. Other ATM Card Fraud
| Fraud Type | Method | Best Defense |
|---|---|---|
| Skimming | External device on card slot | Tug test + cover PIN |
| Shimming | Internal device in chip reader | Use contactless / tap |
| Shoulder surfing | Criminal watches you type | Cover PIN + check surroundings |
| Card trapping | Device traps card in machine | Use bank branch ATMs |
| Cash trapping | Device traps dispensed cash | Check cash tray carefully |
If an ATM retains your card, see what to do when an ATM keeps your card for immediate next steps.
Bottom Line
ATM skimming is preventable with simple habits: tug the card reader before inserting your card, cover your PIN pad every time, prefer bank branch ATMs over standalone machines, and use tap/NFC where available. If your account shows unauthorized charges after an ATM visit, call your bank immediately — federal law caps your liability and banks are required to investigate fraud claims.
The content on Wealthvieu is for informational purposes only and should not be considered financial, tax, or investment advice. Consult a qualified professional before making financial decisions. Full disclaimer · Editorial policy