How to spot and avoid credit card skimmers

May 20, 2017

By Kim Komando

One of the more successful tools of 21st-century crooks is the skimmer. Thieves attach them to ATMs, gas pumps, point-of-sale (POS) systems and other places you swipe your credit and debit cards. This sneaky bit of electronics steals the magnetic strip information from your card.Thieves use this information to clone your card, and once they have a clone, they can drain your bank account and run up huge bills and trash your credit before you even know it. That’s one reason credit card companies and stores are switching to EMV cards.Individual thieves and groups have stolen millions of dollars using skimmers. It doesn’t help that skimmers are available for sale to anyone who wants to buy them, so they can show up anywhere. That’s why you need to know how to spot a skimmer before it snags your information.

How overlay skimmers steal your ATM info

An overlay skimmer is one that fits over the card reader slot of an ATM or gas pump. For old or low-quality overlay skimmers, there are a few things you can look for.It’s usually modeled, or in some cases 3D printed, to look like the part it’s covering. However, it might not be the same quality or color as the rest of the machine. Maybe it’s protruding a bit too far or not installed straight. If it looks like it doesn’t quite fit, then that’s a possible warning.You can also look around for additions to the machine that could hide a camera pointed at the keypad. This is often how crooks get your PIN. It might be installed on the ATM, or even above it.That’s the case with a skimmer a passenger discovered on a MetroCard Vending Machine in the New York subway. Here’s the overlay part (after it was taken off the MVM):And here is the camera installed above the machine disguised as a plug. See the pinhole on the bottom for the camera lens?For these types of skimmers, it’s actually fairly easy to defeat them. Simply cover your hand when you’re typing in your PIN and the crooks won’t have all the information they need to clone your card. Click here to see how effective this simple precaution is.

Ultra-thin skimmers

One of the newest types of skimmers is thin enough to fit right inside the retail location’s card reader slot. These devices can easily be purchased by anyone on the Dark Web.To better understand how these skimmers work, watch these two videos. These are promotional sales videos that show the inner workings of skimmers that are for sale on the Dark Web.In the first video, you will see a demonstration of how a debit card easily fits inside the card reader while the skimmer is inside. At the end of the video, you see how the criminal extracts the skimmer.In this next video, the criminal shows how to install and remove a skimmer from a card reader that has been taken from an ATM.Next, we’ll talk about another smaller version of a skimmer, called a shimmer.

What is a shimmer?

Skimmers are somewhat bulky, making them easy to spot for the well-educated consumer. This has led criminals to turn to the shimmer.Shimmers are much smaller versions of a skimmer that fit easily inside an ATM or POS card reader. They are embedded with a microchip and flash storage, which allows them to steal your cards’ data, including the PIN. This data is extracted at a later time when the thief returns and inserts a specially designed card that downloads the information.This is what a shimmer looks like:

Image: shimmer found inside retailer’s checkout card reader. (Source: RCMP)

The shimmer is super easy for the thief to install and is so thin, you won’t be able to tell that it’s inside the card reader. It also won’t block the normal usage of your card.Because these new devices are so small, they won’t be limited to gas stations and ATMs. You can expect to see them popping up at grocery stores and retail locations, especially ones that offer self-checkout.

Advanced skimmers

A good example of an advanced skimmer comes from Brazil. It’s a type of overlay skimmer, but instead of overlaying the card reader, the entire front of the ATM is fake.You also need to be aware of unscrupulous employees of a restaurant or store who might have handheld skimmers that you’ll never see. Or they might put out POS terminals that are really skimmers in disguise; they’ll even print out a receipt.Not many crooks have these advanced skimmers yet, but they’ll get less expensive and more widespread as time goes by. Fortunately, as we said, banks and retailers are switching over to EMV cards that have a chip instead of a magnetic strip.Mobile payment options are also becoming more popular. Not sure how mobile payments work? Here’s everything you need to know about Apple Pay, Samsung Pay and Google Pay.

Defeating the skimmer

Here are some simple ideas to defeat skimmers:

• Shield your PIN – The easiest step you can take to avoid having your PIN stolen is to block your hand typing in the PIN with your other hand. Always assume someone is watching you enter your PIN.
• Check for tampering – Before putting your card into a reader check it for tampering. Look for anything different or misaligned. If it looks suspicious, do NOT use the machine.
• Wiggle everything – ATMs don’t have loose parts. If anything jiggles, don’t use it.
• Avoid stand-alone ATMs – Try to use ATMs that are located at a bank, preferably inside the lobby area.
• Frequently check bank statements – Criminals are becoming more sophisticated, which means you need to stay vigilant. Stay on top of your bank statements and report any suspicious activity ASAP.
• Report the theft – If you are a victim of a skimmer, report it immediately to your financial institution.