What Is ATM Skimming? How To Identify An ATM Skimmer To Avoid Being Scammed

Our writers and editors used an in-house natural language generation platform to assist with portions of this article, allowing them to focus on adding information that is uniquely helpful. The article was reviewed, fact-checked and edited by our editorial staff prior to publication.

ATM skimming is a type of payment card fraud. It’s a way of stealing PINs and other information off credit cards, ATM cards and debit cards by rigging machines with hidden recording devices.

Bank ATMs and payment terminals at gas pumps and other merchants are the targets of this scam, which rely on ATM skimming devices — essentially another reader that is placed deep inside the machine — to collect data. Thieves then use the stolen information to produce fake cards and spend victims’ money or take cash straight from their bank accounts.

“If they are able to retrieve the card number itself, it’s common to use those in online marketplaces or to sell the card numbers in batches to other criminal groups who may attempt to use them for fraudulent purchases,” says Nathan Wenzler, chief security strategist at Tenable, a cybersecurity firm in Columbia, Maryland.

Here is what you need to know about ATM skimming and how to protect yourself.

Methods of ATM skimming

Thieves employ several techniques to steal data that’s embedded in the magnetic stripe on credit and debit cards:

• A plastic overlay placed over the ATM keypad captures PINs as they are entered.
• An overlay placed over the card insertion slot records the data on the magnetic stripe.
• An overlay that covers the whole ATM faceplate is embedded with cameras and card-slot and keypad overlays.

In addition to physical skimming devices, some sophisticated thieves opt for installing tiny cameras on an ATM to record keypad entries and your fingers as you type.

“Skimmers are getting harder and harder to detect, especially with the advent of 3D printers and other inexpensive fabrication devices,” warns Wenzler.

In some cases, skimming devices don’t even need to be physically connected to the card reader. Instead, as they collect consumers’ data they transmit the information to the thief via Bluetooth technology.

Even chip-enabled payment cards, which are more secure than magnetic stripe cards, are vulnerable to theft. By placing a super-thin shim between the chip and the chip reader inside the ATM, thieves can capture your PIN and other card information. These devices are called “shimmers,” and as chip technology becomes more prevalent, they are starting to supplant skimmers as thieves’ choice tool.

Common skimmer scams

In addition to ATMs, thieves target other areas where you may insert your card including:

• Gas pumps: While paying at the pump is convenient, the locations away from the store are also especially convenient for bad actors. The method is the same as an ATM: The skimming device records all your financial information.
• POS terminals: POS stands for point of sale, which can include any payment terminal at a physical location — a grocery store or a cafe, for example. While these terminals can appear more secure since they’re directly under the monitoring of employees, the employees themselves might be working with criminals to install a skimming device.
• Electronic Benefits Transfer (EBT) cards scams: In addition to targeting personal credit and debit cards, thieves also prey on individuals’ government assistance cards. In March 2025, a scam in Rhode Island stole around half a million dollars from more than 1,800 families. 

How prevalent is ATM skimming?

It’s tough to pin down exactly the number of skimming incidents that happen at ATMs, but a report from FICO shows that skimming of all kinds has been on the rise: The number of debit cards compromised via skimming schemes in 2023 was 96 percent higher than the year earlier.

While skimming can happen anywhere, there are five states where thieves seem to be scoring the biggest hauls: California, Texas, Colorado, New Jersey and Pennsylvania made up almost half of all skimming schemes in the country, according to FICO.

“ATMs and gas pumps are certainly the most common targets,” Wenzler says, “but customers should be aware and vigilant of any card reader anywhere, whether that’s restaurants, retail stores, coffee shops or wherever else you may swipe your card.”

Also, wireless technology enables cyber-thieves to retrieve stolen PINs and other card data “without approaching the ATM ever again, making it very difficult to catch them in the act,” Wenzler says.

Ways to avoid ATM skimming

To avoid becoming a victim of ATM skimming and debit card skimming in general, review your bank statements regularly for suspicious transactions, sign up for account alerts and follow these tips:

• Go with cardless ATM transactions. Using your smartphone and your bank’s mobile app, you can conduct ATM transactions from anywhere, without a physical debit card.
• Use debit and credit cards with chip technology, which is more secure.
• When making a purchase at a store, run your debit card as a credit card and don’t enter your PIN, or use a credit card to begin with.
• Use a mobile payment system such as Google Pay, Apple Pay, Samsung Pay or PayPal.

Besides using safer payment methods, there are some physical, common-sense ways to avoid becoming an ATM skimming victim:

• Watch out for any signs of tampering, including tape or glue. And if there is anything hanging from the exterior of the ATM, you’re better off keeping your card in your wallet.
• Don’t use ATMs located in dark, out-of-the-way places, in bars and restaurants or in areas with lots of tourists. The safest place to use an ATM is at your bank. 
• If the ATM doesn’t immediately return your card after the transaction, waste no time in reporting it to the card issuer.
• “Try wiggling the card reader area to see if it feels loose or if there is a ‘cover’ over it,” advises Wenzler. “That could be a sign of a skimmer having been placed on top of the actual card reader itself.”
• Use a gas pump that is within view of the gas station attendant or pay inside.
• Cover the PIN pad when you enter your PIN — even if nobody is around.

Beware of e-skimming

While some criminals skulk around banks and stores to attach skimmers to physical payment terminals, others steal your credit and debit card data without getting out of their pajamas. 

According to intelligence firm Recorded Future, more than 11,000 e-commerce domains suffered e-skimming infections in 2024 — a threefold, year-over-year increase. Those infections can last a long time — and impact a huge customer base, too. According to Mastercard, one e-skimming attack on a ticketing company impacted nine million customers over a two-month period. 

Ways to avoid e-skimming:

• Use alternative payment methods such as Apple Pay, Google Pay or PayPal so you don’t have to type in payment card information. Just remember to use strong passwords for these wallets, too, to provide an extra layer of protection for your information. 
• Double check a website prior to sharing any personal information. For example, a locked icon in the URL address bar indicates that information transmitted will be encrypted. 
• Monitor your credit reports and bank and credit card statements routinely for suspicious activity, and report it right away. And use transaction alerts so you can notice right away if a purchase goes through that you did not make. 

Are credit cards safer than debit cards?

If a scammer steals your debit card information and/or ATM pin and makes unauthorized transactions, what you’re responsible for covering depends on how quickly you report the theft to your bank. Under the Electronic Fund Transfer Act, if you report your card or information stolen within two business days, your liability is $50 or less. If you report it more than two business days but less than 60 calendar days after you receive a bank statement that shows the theft, your liability goes up to $500. If you wait more than 60 calendar days after receiving a statement from the bank to report the theft, you’re liable for all the losses.

With a credit card, you usually have better fraud protection. In addition to federally mandated limits on fraud liability, capped at $50, many major credit card issuers offer zero liability fraud protection. Learn more about when it’s better to pay with a credit card or a debit card.

Bottom line

Whether you’re using a physical bank ATM, a point-of-sale terminal at a merchant or doing cardless ATM transactions, there is always a risk of fraud. Chip-enabled credit and debit cards are safer than magnetic stripe cards, but even those can be hacked.

“Frankly, until we can move away from using magnetic stripes for transactions, the technology that creates skimmers will continue to advance and improve, resulting in more attacks against more devices around the globe,” Wenzler says.

Fortunately, you can minimize your risk exposure by following the tips and advice outlined here and staying vigilant.