What card swipers and skimmers actually do
A card skimmer is a device that reads and stores the information from your credit card's magnetic stripe without your knowledge. It sits on top of or inside a legitimate card reader — at a gas pump, ATM, or checkout terminal — and captures your card number, expiration date, and sometimes your name as you swipe or insert your card. The person who installed it retrieves the device later and sells the stolen data to other criminals.
A card reader is the legitimate machine itself. Skimmers work because they're designed to look identical to the real thing, or because they're hidden inside the real machine where you can't see them. The goal is always the same: collect card data from dozens or hundreds of people, then use that data to make fraudulent charges or sell it on the dark web.
Understanding how these devices work is the first step to spotting them and protecting your card information. The rest of this guide walks through the most common types, where they show up, and what you can do to reduce your risk.
Key Takeaways
- Skimmers are hidden devices that capture your card data when you swipe or insert your card at gas pumps, ATMs, and checkout terminals.
- External skimmers sit visibly on top of card readers and can often be detected by tugging on the card slot or looking for loose, bulky, or misaligned parts.
- Internal skimmers are installed inside the machine itself and are nearly impossible to spot without taking the machine apart.
- Gas pumps and standalone ATMs in remote locations are the highest-risk places because they're checked less frequently and criminals have easier access.
- Using chip readers, contactless payment, or mobile wallets instead of swiping significantly reduces your exposure to skimming.
External skimmers: the ones you might actually see
External skimmers are bolted or glued onto the outside of a legitimate card reader. They're designed to look like part of the machine, but they're actually a separate device that sits between your card and the real reader. When you swipe your card, it passes through the skimmer first, which captures the data, and then through the legitimate reader, which processes your transaction normally. You get your money or your purchase goes through, so you have no reason to suspect anything happened.
The most common places to find external skimmers are gas pump card readers and ATM card slots. Gas pumps are popular targets because they're outdoors, often in remote locations, and many are checked infrequently by the gas station owner. ATMs in convenience stores, laundromats, and parking garages are also common targets for the same reason.
External skimmers often have telltale signs. The card slot may look slightly raised, bulky, or misaligned compared to the rest of the machine. The plastic may be a slightly different color or texture. Before you swipe, try gently tugging on the card reader slot — if it moves, wiggles, or feels loose, do not use that machine. A legitimate card reader should be firmly attached. If something feels off, trust that instinct and find a different pump or ATM.
Internal skimmers: why they're harder to stop
Internal skimmers are installed inside the machine itself, usually by someone with access to the machine's interior — a technician, an employee, or someone who breaks in. These devices sit between the card reader and the machine's main computer, so they capture your data before the legitimate transaction processing even begins. You cannot see them from the outside, and there's no way to detect them without opening the machine.
Internal skimmers are more sophisticated and more profitable for criminals because they can operate undetected for weeks or months. They're also harder to prevent, since they require either compromised employees or physical access to the machine's interior. Gas stations and banks are the most common targets, but any business with a card reader is at risk.
The only real defense against internal skimmers is to avoid swiping altogether. If you must use a machine you're unsure about, use a chip reader if available, or use a contactless payment method like a mobile wallet instead.
Where skimmers show up most often
Skimmers are found most frequently at gas pumps, particularly at stations in rural areas or on highways where the machines are checked less often. Standalone ATMs — the ones in convenience stores, laundromats, parking garages, and other locations outside of banks — are also high-risk. These machines are often serviced by third-party companies that may not inspect them as carefully as a bank would.
Retail checkout terminals are less common targets, but they do happen. Restaurants, especially those where you hand your card to a server, are also a risk because employees have access to your card and could install a skimmer or use a handheld device to capture your information.
The pattern is clear: the less frequently a machine is inspected and the fewer people who have eyes on it, the more likely it is to have a skimmer. Machines at busy bank branches or major retail chains are lower-risk because they're monitored more closely.
How to reduce your skimming risk
The most effective way to protect yourself is to stop swiping your card altogether. If the machine offers a chip reader, use it — chip technology is much harder to skim because the data is encrypted and changes with every transaction. If the machine has contactless payment, use that instead. Mobile wallets like Apple Pay, Google Pay, and Samsung Pay use the same chip-based encryption as physical chip cards, so they're equally safe.
When you do have to swipe, use machines that are in high-traffic, well-lit areas where criminals are less likely to install or retrieve a skimmer. Bank ATMs inside the bank building are safer than standalone ATMs. Gas pumps at busy stations are safer than remote ones. Checkout terminals at major retailers are safer than small independent businesses.
Before you use any machine, inspect it visually. Look for anything that seems loose, misaligned, or out of place. Tug gently on the card slot. If something feels wrong, walk away and find a different machine. It takes only a few seconds and could save you from fraud.
Monitor your credit card and bank statements regularly — weekly is ideal, not just monthly. If you see charges you don't recognize, report them to your card issuer when ready. Most credit cards offer fraud protection, so unauthorized charges will be reversed, but the sooner you report them, the faster the process moves.
What happens if your card data is stolen
If your card information is skimmed, the criminal will either use it to make fraudulent charges or sell it to someone else who will. You'll typically notice this when you see charges on your statement that you didn't make. Credit card companies monitor for unusual activity and may block your card or call you to confirm charges, but this isn't may provide.
If you discover fraudulent charges, call your card issuer when ready — the phone number is on the back of your card or on your statement. Report the fraudulent charges and request a new card. Under federal law, your liability for unauthorized charges is capped at $50, and most card issuers waive this entirely. The issuer will investigate, reverse the fraudulent charges, and send you a new card with a new number.
The bigger hassle is the time it takes to resolve. You may be without your card for a week or two while a new one is mailed to you. If the thief made multiple charges, you may need to dispute each one. If your information was sold and used by multiple people, you could see fraudulent charges for weeks or months. This is why prevention — using chip readers, contactless payment, and monitoring your statements — is so much easier than dealing with fraud after it happens.
Chip readers and contactless payment: why they're safer
Chip readers work differently than magnetic stripe readers. Instead of reading a static number from a stripe, the chip generates a unique code for each transaction. Even if a criminal intercepts that code, they can't use it again because it's only valid for that one transaction. This makes chip skimming technically possible but far less profitable, so criminals rarely bother.
Contactless payment — tapping your card or phone instead of swiping — uses the same chip-based encryption. Your card or phone generates a unique code, transmits it wirelessly to the reader, and the transaction is complete. The reader never sees your actual card number, so there's nothing for a skimmer to capture.
Mobile wallets like Apple Pay and Google Pay add another layer of security. Your actual card number is never shared with the merchant — only a tokenized version that's specific to that transaction and that device. Even if someone intercepts the data, they can't use it because it's tied to your phone and encrypted.
Frequently Asked Questions
Can I get my money back if my card is skimmed?
Yes. Federal law limits your liability for unauthorized charges to $50, and most credit card issuers waive this entirely. Debit cards have the same protection if you report the fraud within 60 days. Report fraudulent charges to your card issuer as soon as you notice them, and the issuer will investigate and reverse the charges.
How can I tell if an ATM or gas pump has a skimmer?
Look for anything that seems loose, misaligned, or out of place. The card slot should be flush with the machine and firmly attached. Try gently tugging on it — if it moves or wiggles, don't use it. If the plastic looks a different color or texture than the rest of the machine, or if the card slot seems raised or bulky, that's a red flag. Trust your instincts.
Is it safe to use my debit card at a gas pump?
Debit cards have the same fraud protection as credit cards, but using a credit card is slightly safer because credit card fraud is easier to dispute. If you must use a debit card, use the chip reader if available, or use a contactless payment method. Avoid swiping the magnetic stripe.
Do I need to worry about skimmers at major retailers?
Major retailers have more frequent machine inspections and security monitoring, so the risk is lower than at standalone ATMs or remote gas pumps. That said, use chip readers or contactless payment whenever possible, regardless of where you are. It's the safest option.
What should I do if I think I've been skimmed?
Check your credit card and bank statements for unauthorized charges. If you find any, call your card issuer when ready and report them. Request a new card. Monitor your statements closely over the next few weeks in case additional fraudulent charges appear. You can also place a fraud alert on your credit report by contacting one of the three major credit bureaus.