What an ATM skimmer is and why criminals use them
An ATM skimmer is a device that reads and records the data from your debit or credit card without your knowledge. Criminals attach these devices to the card slot of an ATM, and when you insert your card, the skimmer captures your card number, expiration date, and other information printed on the magnetic stripe. A hidden camera or fake keypad above the real one also records your PIN.
Skimmers are attractive to criminals because they work passively — the ATM still functions normally, so you have no reason to suspect anything went wrong. The criminal retrieves the device later and sells the stolen card data to other criminals who make counterfeit cards or conduct online fraud. You typically don't discover the theft until your bank alerts you to suspicious charges or you check your statement.
This article explains how skimmers are constructed and installed, what they look like, and how to protect yourself. Understanding the mechanics helps you recognize warning signs at ATMs you use regularly.
Key Takeaways
- ATM skimmers are physical devices attached to the card slot that capture card data and PINs through a combination of magnetic readers and hidden cameras.
- The most common skimmers are external overlays that fit over the real card slot, making them easier to spot than internal devices installed by ATM technicians.
- Criminals often target ATMs in less-monitored locations like convenience stores, gas stations, and remote bank branches rather than busy downtown locations.
- You can reduce your risk by checking the card slot for loose or misaligned parts, covering the keypad when entering your PIN, and using ATMs inside bank lobbies when possible.
- If you discover unauthorized charges, contact your bank immediately — federal law limits your liability to $50 if you report fraud within two business days.
The basic components of an external skimmer
Most skimmers you encounter are external overlays — devices that sit on top of the real card slot rather than being installed inside the ATM. These typically consist of a plastic or metal housing that mimics the appearance of the legitimate card slot, a magnetic stripe reader inside that captures card data, and a small circuit board that stores the information.
The magnetic stripe reader works by detecting the magnetic field created by the stripe on your card as it passes through. This is the same technology ATMs use legitimately, but the skimmer's reader sends the data to a storage chip rather than to the bank's system. The device is powered by a small battery or, in some cases, by power drawn from the ATM itself through a connection hidden behind the overlay.
A complete skimming setup also includes a way to capture your PIN. Most commonly, criminals install a thin fake keypad over the real one, or mount a small camera above the keypad angled to record your fingers as you type. Some sophisticated setups use both methods for redundancy.
How skimmers are installed and retrieved
Installing an external skimmer takes only a few minutes. The criminal approaches the ATM during a quiet time, removes the overlay from their pocket or bag, and slides it over the card slot. The fit is usually snug enough that it stays in place without adhesive, though some criminals use double-sided tape or small magnets for extra security. The fake keypad or camera is positioned and secured, and the device is ready to start capturing data.
The criminal returns to the ATM days or weeks later to retrieve the device and extract the stored data. They may visit multiple times to check on the device or swap out the storage chip before it fills up. Some modern skimmers transmit data wirelessly, so the criminal can retrieve information without physically removing the device — they simply stand nearby with a wireless receiver.
Internal skimmers, installed by someone with access to the ATM's interior, are harder to spot but less common. These require either stealing an ATM technician's key or having an employee at the bank or service company install the device. Internal skimmers are more reliable because they're protected from weather and physical damage, but they're also riskier for the criminal because they leave a trail of access records.
Where criminals target ATMs
Skimmers appear most often on ATMs in locations with less frequent monitoring and lower foot traffic. Gas station ATMs are common targets because they're often unmanned and the machines may not be serviced as frequently as bank ATMs. Convenience stores, laundromats, casinos, and bars also see skimmers regularly because the business owner may not inspect the machine daily.
Remote bank branches and ATMs in less-populated areas are targeted more often than busy downtown locations. Criminals avoid high-traffic areas where someone might notice a poorly fitted overlay or where security cameras are more likely to capture their face during installation.
ATMs inside bank lobbies that require a key card to enter are safer because the criminal would need to be a customer or have stolen credentials. Drive-through ATMs are also lower-risk targets because they're harder to approach without being noticed, and the enclosed design makes it difficult to attach an overlay.
How to spot a skimmer before using an ATM
Before inserting your card, inspect the card slot and keypad for signs of tampering. Look for overlays that don't match the rest of the machine — the color, material, or fit may be slightly off. Try gently pulling on the card slot cover; a legitimate part should be firmly attached, while a skimmer overlay may shift or come loose.
Check the keypad for a second layer on top of the real buttons. Run your finger across the keys — they should feel uniform and flush. A fake keypad will often feel slightly raised or have uneven gaps between the buttons. Look for any small holes or lenses above the keypad that could be cameras.
Examine the area around the card slot for wires, tape, or adhesive that shouldn't be there. Legitimate ATMs are sealed and maintained by technicians, so visible repairs or loose components are a red flag. If something looks off or feels wrong, use a different ATM.
Protecting yourself when using an ATM
Always cover the keypad with your hand or body when entering your PIN, even if you don't see a camera. This blocks any camera that might be hidden above the keypad and is a good habit regardless of whether a skimmer is present. Stand close to the machine and angle your body so someone standing nearby can't see the keys you're pressing.
Use ATMs inside bank lobbies or other secure locations whenever possible. These machines are monitored more frequently and are harder for criminals to access without being noticed. If you must use an outdoor ATM, choose one in a well-lit, high-traffic area during business hours.
Check your bank statements regularly — at least weekly if possible — and set up alerts for any transactions over a certain amount. Many banks offer free fraud monitoring and will notify you immediately of suspicious activity. If you spot unauthorized charges, contact your bank right away. Federal law limits your liability to $50 if you report fraud within two business days of discovering it, and many banks waive the fee entirely.
What happens after your card data is stolen
Once a criminal retrieves a skimmer, they extract the stored card data and sell it to other criminals or use it themselves. The data is often sold on the dark web in batches, sometimes for as little as a few dollars per card number. Buyers use the information to create counterfeit cards, make online purchases, or conduct identity theft.
Counterfeit cards are made by encoding the stolen card data onto blank cards with a magnetic stripe writer. The criminal then uses the card at ATMs to withdraw cash or at retail locations to make purchases. Because the card is physical and the PIN is known, the transaction often goes through without triggering fraud alerts.
Online fraud using stolen card data is harder to execute because many websites now require additional verification, but criminals still attempt it. They may also sell your information to other criminals who specialize in different types of fraud, multiplying the risk to you.
Frequently Asked Questions
Can a skimmer damage my card or the ATM?
No. A skimmer only reads the data on your card's magnetic stripe; it doesn't alter or erase anything. The ATM continues to function normally, which is why skimmers are so effective — you have no reason to suspect anything went wrong. The machine itself isn't damaged either, though the overlay may eventually wear or fall off.
How long does it take for fraudulent charges to appear?
It varies. Some criminals use the stolen data within hours, while others sell the information to someone else who may not use it for weeks or months. You might not see charges until long after your card data was stolen, which is why monitoring your statements regularly is important even if you haven't used an ATM recently.
Will my bank refund fraudulent charges?
Yes, but the timeline depends on how quickly you report it. If you report fraud within two business days, federal law limits your liability to $50. If you wait longer, you could be liable for up to $500. Most banks refund fraudulent charges within one to two weeks once you've reported them, though the investigation may take longer.
Are newer ATMs with chip readers safer than older ones?
Chip readers are harder to skim because the chip uses encryption and one-time codes, but criminals can still capture your card number and use it for online fraud or create a counterfeit card with a magnetic stripe. Chip technology is more secure than magnetic stripes, but it doesn't eliminate skimming risk entirely. Covering your PIN and monitoring your statements remains important.
What should I do if I find a skimmer on an ATM?
Do not attempt to remove it yourself. Contact the bank or business that owns the ATM immediately and report the location and description of the device. You can also contact your local police department's non-emergency line. If you've already used that ATM, contact your bank and monitor your account for unauthorized activity.