Credit Card Skimmer: How to Spot One and What to Do Next

Independent guide - not affiliated with or endorsed by any card issuer, card network or government agency. To report fraud, use the contact details in your card issuer's app or on its official website.

A credit card skimmer is an illegal card reader that criminals attach to a real payment terminal, such as a gas pump, ATM or store checkout, to copy your card details. To spot one, look for broken security seals, a reader that looks different from the others nearby, and parts that move when you tug them. If you think your card was skimmed, report it to your issuer right away: federal law caps your liability for unauthorized credit card charges at $50, and you owe nothing for charges made after you report.

What is a credit card skimmer?

The FTC describes skimmers as illegal card readers attached to payment terminals that grab data from a card's magnetic stripe without your knowledge. Criminals then sell the stolen data or use it to buy things online. A copied debit card is far more useful to a thief who also knows the PIN, which is why shielding the keypad matters wherever you enter one.

The FTC's warning focuses on gas pumps, where a terminal can sit unwatched for long stretches, but the same idea applies to other unattended card readers such as standalone ATMs and parking or self-service machines. A skimmer can be fitted over the real card slot or hidden inside the machine, which is why both the outside of the reader and the panel around it are worth a careful look.

How to spot a credit card skimmer

No check is perfect, but a few seconds of attention catches many of them. Based on the FTC's advice, look at three things before you pay:

• The panel and seals. Make sure the gas pump panel is closed and shows no signs of tampering. The FTC notes that many stations put security seals over the cabinet panel; if the panel has been opened, the label reads "void".
• The card reader itself. Compare it with the readers on other pumps or machines nearby. A reader that sticks out further, has a different color or texture, or covers part of the machine's design is a warning sign.
• Loose parts. Try to wiggle the card reader before you put in your card. If it moves, the FTC says to report it to the attendant and use a different pump. Do the same check on an ATM keypad: a keypad that feels thick, spongy or raised may be an overlay.

Also notice the setting. A pump with a damaged or missing seal, an ATM in a dim corner with an odd attachment above the screen, or a card slot that feels tight or gritty are all reasons to pay another way.

How to protect yourself from skimmers

1. Use a credit card, not a debit card, at gas pumps and other unattended terminals. With a debit card, a thief who has your data and PIN can take money straight out of your bank account. The FTC's tip for drivers who do use debit at the pump is to run it as credit rather than enter a PIN, so the PIN stays safe and the money is not deducted immediately.
2. Avoid the magnetic stripe when you can. The FTC explains that skimmers read data from the magnetic stripe. Inserting the chip or tapping to pay, where the terminal supports it, means you are not swiping that stripe through the reader, although no payment method is completely risk-free.
3. Pay inside if you are concerned about a pump. The FTC suggests this for anyone worried about skimmers.
4. Cover the keypad with your other hand when you enter a PIN, so a hidden camera cannot record it.
5. Turn on transaction alerts in your issuer's app. An alert for every charge, or for card-not-present purchases, can show fraud within minutes rather than at the end of the month.
6. Use a virtual card number online where your issuer offers one, so a breach at one website exposes a number you can delete. Our guide to virtual credit card numbers explains how they work.

Our comparison of credit cards vs debit cards covers why the protections differ so much when something goes wrong.

How to tell if your card has been skimmed

Usually you cannot tell at the time. The FTC warns that you will not know your information has been stolen until you get your statement or, with a debit card, an overdraft notice. The signs to watch for are:

• Charges you do not recognize, including small ones and purchases from online stores you have never used.
• Charges in places you have not been, such as another state or country.
• A fraud alert, text or call from your issuer asking whether you made a purchase. Answer through the official app or the number on your card, not by replying to a message that asks for codes.
• A declined card when you know you have available credit, which can mean the issuer has blocked the account after spotting fraud.

What do you owe if your card is skimmed?

Federal law protects credit card users more strongly than debit card users. Under Regulation Z, your liability for unauthorized use of a credit card cannot exceed the lesser of $50 or the amount charged before you notify the issuer. The CFPB defines unauthorized use as use by a person who does not have the right to use the card, which covers a thief using skimmed data.

The FTC's guide to lost or stolen credit, ATM and debit cards sets out the difference:

The debit card tiers come from Regulation E section 1005.6. Even when the law protects you, the money missing from a checking account can take time to restore, which is the practical reason to keep debit cards away from unattended readers.

What to do if you think your card was skimmed

1. Report it to your issuer immediately, through the app or the phone number on the back of the card or on the issuer's website. The FTC says you are not responsible for charges made after you report, and fast reporting matters most for debit cards.
2. Lock or replace the card. Ask the issuer to close the compromised number and send a replacement card. Update any automatic payments that used the old number.
3. Follow up in writing. The FTC recommends a letter to the issuer's billing dispute address confirming the fraudulent charges and when you noticed them. Keep copies.
4. Review statements closely for the next few months, and dispute anything you did not make. Our guide on how to dispute a credit card charge covers the deadlines.
5. Check your credit reports for accounts you did not open. If you see signs of identity theft, the FTC points to IdentityTheft.gov for a recovery plan.
6. Tell the business where you think the skimmer was, so it can inspect the terminal.

Our step-by-step guide on what to do if your credit card is stolen covers fraud alerts and credit freezes in more detail. Be wary of follow-up calls or texts that claim to be your bank's fraud team and ask for a code or PIN; our guide to card call and text scams explains how those work.

The short version

Skimmers copy card data from real terminals, so look before you pay: intact seals, a reader that matches the others, nothing loose. Use a credit card rather than debit at pumps and ATMs, avoid swiping when you can chip or tap, and turn on alerts. If you suspect skimming, report it to your issuer at once. With a credit card, federal law limits what you can owe to $50 at most, and often nothing at all.