What is card skimming?

In 2022, there was more than a 700% year-over-year increase in card skimming, with gas stations ranking as one of the most common locations for skimming devices.¹ The FBI estimates that card skimming costs individuals and financial institutions more than $1 billion each year.²

So how does card skimming work, and what steps can individuals take to help avoid it? Learn more about card skimming and potential ways to help safeguard financial information.

How does card skimming work?

To steal information, criminals use card skimming devices that are physically attached to or on card readers, where people insert or swipe their cards to complete a transaction. Common card skimming locations typically include ATMs, point-of-sale (POS) terminals, and fuel pumps.

When a card is swiped or inserted into a compromised machine, the skimmers scan the card’s magnetic strip to steal the card’s information. This information can then be stored and either downloaded or transmitted via Bluetooth, which allows criminals to create copies of the cards later.

As part of the card skimming fraud, criminals may also use fake keypads or install a tiny camera above keypads to record the PIN used for a card.

Potential consequences of card skimming scams

Once a card has been cloned and the PIN is known, thieves can potentially withdraw funds from ATMs and make purchases. The consequences for affected individuals can be far-reaching. Their bank accounts could be drained, or their credit accounts could be maxed out, which could also affect their credit score.

This makes it critical to closely monitor financial accounts and statements for unusual transactions and dispute unauthorized purchases immediately.

How to help spot and prevent card skimming

Here are some strategies to consider to potentially help stay protected against card skimming:

• Avoid standalone ATMs. ATMs that aren't owned by a major bank and are located in standalone areas may be more likely to be compromised as these locations typically have less security.
• Check the card reader. Before inserting a debit or credit card into any terminal, try to inspect the reader. Start pulling at the area where cards are inserted. If anything feels loose, that may be a sign that a card skimming device has been installed.
• Look for a security seal. Some gas pumps have a security seal in place to prevent fraudulent activity. If the seal appears tampered with, it may be a sign that the machine is compromised.
• Cover the PIN. Individuals may be prompted to input their PIN to begin the transaction. Consider covering view of the keypad when using it.
• Evaluate different payment methods. Using a mobile wallet or tap to pay may help prevent fraud since a physical card isn’t present.

Reporting card skimming incidents

There's normally no way to immediately tell if a card has been skimmed. It may only become obvious once thieves start testing card information or committing fraudulent transactions.

As soon as individuals notice suspicious activity within their account, they should contact their financial institution, the Federal Trade Commission, and/or the FBI.²

Contact the bank or financial institution

Individuals who believe their account has been compromised should immediately report any unauthorized transaction to their financial institution. Although each bank may follow a different process, people may expect to take the following steps:

1. Call the customer service number. Find the official number on the financial institution’s website or on the back of a different credit or debit card from the same issuer as the compromised card.
2. Ask to speak to the fraud department.
3. Ask for the compromised account to be frozen and for a new card to be issued.
4. Request that the fraud department open an investigation.
5. Provide the fraud department with any evidence to prove that transactions were fraudulent.
6. Wait for the investigation to be completed.

Cardholders may also be able to report fraud and freeze accounts through an app or online account.

Some banks and financial platforms may employ fraud monitoring that catches suspicious activity and alerts cardholders in real-time. They may also proactively block transactions if suspicious activity is detected.

Inform the Federal Trade Commission (FTC)

Victims of credit skimming fraud can also report incidents to the FTC. While the FTC can’t necessarily resolve someone’s individual inquiry, they work to investigate large-scale cases of fraud and scams. They may also provide tailored information on how someone can protect their personal and financial information.

Make security a priority with PayPal.