How ATM Skimming Works
Card Skimmer (magnetic stripe)
A plastic overlay placed over the card slot that reads and stores the magnetic stripe data from your card as you insert it. Paired with a tiny camera (often hidden in a fake panel above the keypad, or in a brochure holder) or an overlay keypad to capture your PIN. A criminal retrieves both the card reader and camera data later, typically within 24–48 hours. The data is used to clone cards or make online purchases.
Card Shimmer (chip cards)
Shimming is a newer technique targeting EMV chip cards. A paper-thin device is inserted inside the card slot — it's essentially invisible from the outside. It intercepts data during the chip transaction. Shimming is more technically sophisticated than skimming and became more prevalent as chip cards reduced magnetic stripe fraud. Contactless payment (tap to pay) completely bypasses this attack vector.
How to Check an ATM Before You Use It
Wiggle the card reader
Grab the card slot firmly and try to move it. A genuine ATM card reader is solidly attached — it won't wiggle, rotate, or feel loose. A skimmer overlay is glued or taped on and will have some give. This test catches most skimmers in under 2 seconds. Also check the area above the card reader for unusual attachments, bubbles, or components that don't match the machine's finish.
Look for cameras aimed at the keypad
Skim operations use cameras to capture your PIN. Look for: unusual components above or alongside the keypad (a small hole in a panel or brochure holder), mismatched plastic pieces that look added, anything with a small lens. Legitimate ATM security cameras are usually mounted high on the machine and clearly visible — cameras that look like they're positioned to view what you type are not legitimate.
Press on the keypad
An overlay keypad placed on top of the real one feels different — spongier, slightly raised, with more key travel than a genuine ATM keypad. Press the keys firmly and notice if they feel normal or if there's an unusual layer between your finger and the machine.
Which ATMs Are Safer
Not all ATM locations carry equal risk. Here's the relative risk ranking, from lowest to highest:
Lowest risk: Inside a bank branch
ATMs inside an operating bank branch — not in a 24-hour vestibule, but in the main branch during business hours — are the lowest-risk option. Bank staff can monitor and inspect them. Installing a skimmer inside an operating bank branch is extremely high-risk for the criminal.
Moderate risk: Bank branch vestibule or exterior ATMs
Still bank-branded, but accessible 24/7 without staff oversight. Skimmers are installed at night or on weekends. Use the wiggle test. These are still much lower risk than third-party ATMs.
Highest risk: Standalone ATMs in bars, restaurants, and convenience stores
Independent ATMs in gas stations, bars, nightclubs, and small retailers have the highest skimming rates. They're less monitored, have looser maintenance schedules, and are often operated by third-party companies with less oversight. If possible, use your bank's ATM instead — the fees you avoid aren't worth the risk differential.
Better Alternatives to Card-Based ATM Transactions
Contactless / tap-to-pay
Apple Pay, Google Pay, and tap-enabled cards transmit a unique one-time transaction token — your actual card number is never sent. Even if the terminal were compromised, the skimmed data would be useless for replay attacks. This is genuinely more secure than chip or swipe.
Credit card instead of debit
Credit card fraud is easier to dispute under the Fair Credit Billing Act ($50 max liability, 60 days to dispute). Debit card fraud can drain your checking account immediately, and the EFTA recovery timeline depends on how quickly you report.
Transaction alerts on every card
Enable text or email alerts for all transactions over $0. You'll know within seconds if your card is used somewhere you didn't authorize. This doesn't prevent skimming but dramatically shortens the window before you detect and report it.
Withdraw less, more strategically
Withdraw from known-safe ATMs in larger amounts less often, rather than using random ATMs daily. Less ATM exposure = less risk. Keep a small amount of cash on hand so you're not forced to use an unfamiliar ATM under time pressure.
If You've Been Skimmed
- Call your bank immediately — the number on the back of your card. Report each unauthorized transaction. Your card will be cancelled and a new one issued.
- Under the Electronic Fund Transfer Act: if you report debit card fraud within 2 business days, your liability is capped at $50. Between 2–60 days: up to $500. After 60 days: potentially unlimited. Report as fast as possible.
- For credit card fraud: report within 60 days of the statement, maximum $50 liability (most issuers have $0 liability policies).
- File a police report — your bank may require this to process fraud claims, and it helps law enforcement track skimming operations.
- Report the ATM to the bank or operator that owns it — they need to investigate and sanitize the machine to protect other customers.
- Check your credit report for any additional fraudulent accounts opened using your information.
Frequently Asked Questions
I found a skimmer on an ATM. What should I do?
Don't touch or remove it — it's evidence. Step away from the ATM and call the bank or business whose ATM it is, and also call local police to report it. Take photos if you can do so safely. The skimmer may have cameras recording the area — be aware of that. Police will want to preserve the device for fingerprints and possible investigation into the skimming operation.
Are skimmers becoming less common as chip cards spread?
Magnetic stripe skimming has declined as EMV chip adoption increased — chip transactions are harder to replay than magnetic stripe. However, shimmers (targeting chip transactions) have emerged as a replacement technique. More significantly, online/card-not-present fraud has increased dramatically as in-person chip security improved. Contactless payment (which doesn't transmit the card number at all) is the most resistant to all current forms of card-present fraud.
My PIN was captured but my card wasn't skimmed — is that useful to an attacker?
A PIN without the card number has limited immediate use for ATM fraud. However, PIN + card number from a data breach elsewhere (if you reuse PINs) could combine to create a complete ATM attack vector. Use a unique PIN for each card, and use a PIN that doesn't appear in any obvious form in your life (birthday, address, phone number). Change your PIN if you suspect it was captured.
Recommended Products
Products we've tested and recommend for this topic. Affiliate links — disclosure.
Ekster Parliament Wallet
~$79
RFID-blocking smart wallet with Chipolo tracker built in.
View on Amazon →Aura Identity Protection
~$12/mo
Real-time fraud alerts, dark web monitoring, and $1M identity theft insurance.
View on Amazon →