Debit and Credit Card Skimming

Last updated on April 20, 2022

Nowadays, it is far more convenient to pay at gas stations with a speedpass, use Paypal for online purchases, and pay with plastic rather than holding wads of cash and pockets of loose change.

But instead of now worrying about being mugged for cash, there is a technique to defraud you of your money that is more anonymous, sophisticated, and dangerous — and all it takes is a device that can easily be purchased for $50 online.

This type of fraud is known as card skimming and it involves swiping your debit or credit card through a card reader that has been illegitimately set up to record information from your card’s magnetic stripe.

(Have you heard of MagSpoof? Creator Samy Kamkar created his own homemade card skimming device and made the project open source.)

After your information has been recorded, it is usually then sold to other scammers on the black market or converted into a counterfeit card and used to make fraudulent purchases.

Because it is difficult to know when your card has been skimmed, you may not find out unless you review your financial statements or get a call from your card provider.

How Does Card Skimming Work?

Although card skimming techniques are becoming increasingly sophisticated, the methods are generally the same. Skimming devices are usually installed on machines like ATMs and handheld pinpads, but also come as standalone, portable versions that are small enough to fit inside your pocket.

ATM Skimming

One method of skimming involves fraudsters installing a faceplate over the card slot of any machine which accepts debit or credit cards. This is commonly referred to as ATM skimming, but it is also popular with other types of payment processing machines, such as those at gas stations and parking lots.

The face plates installed on these machines usually contain hardware which reads your card’s magnetic stripe before it enters into the original ATM card slot.

Your PIN number is then either observed by a person “shoulder surfing” or by a hidden pinhole camera installed on the machine and pointed at the keypad. This is why it is a good idea to cover your keypad with your hand even when alone at an ATM machine.

Fraudsters don’t need to return to the ATM machine to extract the video and card information because many of these skimming devices also have wireless capabilities. Fraudsters can comfortably and anonymously sit in their car, hundreds of feet away, and retrieve the information wirelessly.

Replacing or Modifying Pinpads

Fraudsters, sometimes the family members of employees, often approach employees of a retail establishment and bribe them to assist in modifying or replacing an existing pinpad with a counterfeit one and installing cameras to record PIN numbers.

Card information from the pinpads and the video is later retrieved by the dishonest employee and given back to the fraudster. The employee will usually share in the proceeds and receive a lump-sum payment or be paid on a per-card-skimmed basis.

Some retail establishments, such as the office supplier Staples, have used locks on their debit pinpads to prevent fraudsters or dishonest employees from stealing and replacing them.

Skimming Devices

Because skimming using a handheld device can be extremely easy, many dishonest employees choose to operate alone. All an employee needs to do is wait until your attention is distracted to swipe your card from behind the counter.

Skimming devices are readily available on the Internet from websites such as eBay for as little as $50. These devices are usually disguised under the name of a “card reader” because they can also serve legitimate purposes.

Skimming at restaurants also happens frequently, especially since customers often leave their credit card for the server to pick up, process, and return a few minutes later. In these cases, a portable card reader is perfect because it is small enough to fit in the server’s pockets or apron.

A server may not even need a portable skimming device. Your credit card information can easily be written down or copied from a receipt.

Protect Yourself from Card Skimming

It is very difficult for victims to know how, when, and where their cards were skimmed. Your card’s details may have been skimmed months or years prior to you discovering any fraudulent transactions on your statements.

Although debit and credit card companies can often perform data mining to find which retail establishments multiple victims have commonly used their cards at, at that point, it is often too late for the victim.

Card skimming may be sophisticated, but there are still some basic things you can do to protect yourself:

• Check for tampering. Before using your card, take a look at the card reader to make sure it doesn’t look like it’s been tampered with. If anything looks suspicious, don’t use the machine and report it.
• Cover your keypad. Always use your hand and body to cover your keypad when operating a handheld pinpad or a payment processing machine like an ATM — even when alone. This will prevent shoulder surfers and pinhole cameras from observing your PIN number.
• Watch your card. If you must hand your debit or credit card to an employee, don’t take your eyes off of it. It only takes a second for your card to be swiped while you look the other way.
• Pay up front. When eating at restaurants, ask to pay at the terminal instead of giving your credit card to a server for processing.
• Review your statements. View your bank and card statements on a regular basis. Watch for suspicious charges.
• Notify someone. If you spot a suspicious pinpad or payment processing machine, notify someone immediately. If you are using a bank’s ATM and the bank is open, notify the bank manager. Otherwise, notify the local police.