Card skimming is the theft of payment card data using a hidden device attached to an ATM, fuel pump or payment terminal – or, in its digital form, malicious code on an online checkout page.
How card skimming works
A physical skimmer is a card reader disguised as part of the machine, usually a fake card slot or keypad overlay. It copies the magnetic stripe as the card is inserted, while a pinhole camera or fake keypad records the PIN. Criminals collect the data later or receive it wirelessly via Bluetooth or GSM modules, which is common in skimmers hidden inside fuel pumps.
Variants include:
- Shimmers – thin devices inserted into the chip reader that capture data from EMV chip transactions; this data is much harder to abuse, because the chip generates dynamic codes.
- Digital skimming – malicious JavaScript injected into e-commerce sites, also known as formjacking or Magecart. In 2018 such a script on the British Airways website stole card data of hundreds of thousands of customers.
- Contactless relay attempts against NFC payments, which are limited by transaction caps and tokenisation.
Why card skimming matters
Stolen magnetic stripe data is used to clone cards and withdraw cash, especially in countries where stripe payments are still accepted. The data feeds the carding market, and cash is often withdrawn by money mules. Victims usually notice only after unauthorised transactions appear.
How to protect against card skimming
- Inspect ATMs and pumps for loose parts, unusual card slots or keypads; prefer machines inside bank branches.
- Cover the keypad when entering your PIN.
- Use contactless or mobile wallets, which never expose the stripe data.
- Enable transaction alerts and report suspicious charges immediately.
