How to Spot and Avoid Credit Card Skimmers and Shimmers

The moment I realized how woefully insecure credit and debit cards are is still vividly clear.

- MAX EDDY

I watched as someone took an off-the-shelf USB magnetic-stripe reader and plugged it into a computer, which recognized it as a keyboard. They opened a word processor and swiped the card. A series of numbers dutifully appeared in the text file. That was it: The card’s information had been pilfered.

That same technology has matured and miniaturized. Tiny “skimmers” can be attached to ATMs and payment terminals to skim your data off the card’s magnetic strip (“magstripe”). Even smaller “shimmers” are shimmed into card readers to attack the chips on newer cards. Now there’s also a digital version called “e-skimming” that’s pilfering data from payment websites. Fortunately, you can protect yourself from these attacks.

WHAT ARE SKIMMERS?

Skimmers are tiny, malicious card readers hidden within legitimate card readers that harvest data from every swiped card. After letting the hardware sip data for a while, a thief will stop by the compromised machine to pick up the file containing all the stolen data. With that information, the thief can create cloned cards or just commit fraud. Perhaps the scariest part is that skimmers often don’t prevent ATMs or credit card readers from functioning properly, making them harder to detect.

Getting inside ATMs is difficult, so ATM skimmers sometimes fit over existing card readers. Most of the time, the attackers also place a hidden camera somewhere in the vicinity to record the PINs (personal identification numbers) we use to access our accounts. The camera may be in the card reader, mounted at the top of the ATM, or even in the ceiling. Some criminals even install fake PIN pads over the actual keyboards to capture the PIN directly, bypassing the need for a camera.