An ATM skimmer is a device criminals attach to cash machines to steal your card information without you knowing

A skimmer is a thin piece of hardware that fits over or inside an ATM's card slot. When you insert your card, the skimmer reads and records your card number, expiration date, and other data as your card passes through. At the same time, a hidden camera or fake keypad records your PIN. The criminal comes back later to retrieve the device and the stolen information, then uses it to make fraudulent charges or withdraw cash from your account.

Skimmers work because they sit between you and the actual card reader. Your card goes through the skimmer first, which copies the information, then through the real reader so the transaction appears normal. You have no way to know it happened while you're at the machine.

Key Takeaways

  • Skimmers are physical devices attached to ATMs that copy your card data when you insert it, paired with hidden cameras that record your PIN.
  • The stolen information is used to make unauthorized charges or cash withdrawals, often within hours of the skimming.
  • Skimmers are most common at standalone ATMs in remote locations, gas stations, and convenience stores rather than bank branches.
  • You can reduce your risk by using ATMs inside banks, covering the keypad when you enter your PIN, and checking your statements weekly.

How criminals build and install skimmers

Building a skimmer requires basic electronics knowledge and parts that are either manufactured specifically for this crime or repurposed from other devices. The card-reading component is the core — it must be thin enough to fit in the card slot without blocking it, but sensitive enough to read the magnetic stripe or chip as the card passes through. Criminals source these from online electronics suppliers or manufacture them using 3D printing and standard microcontroller boards.

The camera is usually a tiny wireless device, often smaller than a matchbox, hidden above the keypad or inside the bezel. It records video or still images of your fingers entering your PIN. Some skimmers use a fake keypad overlay that sits on top of the real one — when you press the keys, it records which ones you touched and in what order, allowing the criminal to deduce your PIN without a camera.

Installation takes only a few minutes. The criminal approaches the ATM, removes the card slot cover or facade (often held on with straightforward screws or adhesive), slides the skimmer into place, and reattaches the cover. The entire device is designed to look like part of the machine. Some skimmers are so well-made that even bank employees miss them during routine inspections.

Where skimmers are most likely to be found

Standalone ATMs in low-traffic areas are the easiest targets because criminals can install and retrieve devices without being noticed. Gas station pumps and convenience store ATMs see heavy use but less security monitoring than bank branches. Hotel lobbies, laundromats, and casinos are also common locations because the machines are often older and less frequently serviced.

Bank branch ATMs are less common targets because they are monitored by security cameras, checked regularly by staff, and located in areas with foot traffic and witnesses. A criminal installing a skimmer on a bank ATM in broad daylight is more likely to be seen or recorded.

Signs a machine might have a skimmer

A skimmer is not always visible, but some physical clues can alert you. The card slot may have a loose, wobbly, or slightly raised cover. The bezel around the keypad might be cracked, misaligned, or a different color or material than the rest of the machine. If any part of the ATM feels like it could be pulled off or wiggled, do not use it.

A fake keypad overlay will feel slightly raised or spongy compared to the real buttons underneath. If the keys feel different from other ATMs you have used, or if the machine looks recently repaired or altered, use a different machine instead. Trust your instinct — if something looks off, it probably is.

What happens after your information is stolen

Once a criminal retrieves the skimmer, they extract the card data and PIN from the device. Within hours, they test the information by making a small purchase or attempting a cash withdrawal. If successful, they either sell the card data to other criminals on the dark web or use it themselves to drain your account or max out your credit limit.

You may not notice the fraud when ready. Many victims discover the theft days or weeks later when they check their statement or their bank alerts them to unusual activity. By that time, the criminal has already moved on to the next ATM and the next victim.

How to protect yourself at the ATM

Use ATMs inside banks whenever possible, especially after hours when the lobby is locked and accessible only to customers. These machines are monitored more closely and serviced more frequently than standalone machines. If you must use a standalone ATM, choose one in a well-lit, high-traffic area during daylight hours.

Before inserting your card, inspect the card slot and the area around the keypad. Gently try to wiggle the card slot cover or any part that looks like it could be removable. If anything feels loose or out of place, use a different machine. Cover the keypad with your other hand while entering your PIN so that any hidden camera cannot see your fingers. Check your bank statement at least once a week, either online or by phone, so you catch fraud quickly.

Consider using a debit card with a low daily withdrawal limit, or use a credit card instead of a debit card when possible — credit card fraud is easier to dispute and does not drain your actual bank account. Some banks offer cards with chip readers instead of magnetic stripes, which are harder to clone, though skimmers can still read chips on some older machines.

What to do if you think you have been skimmed

Contact your bank when ready if you notice unauthorized charges or withdrawals. Most banks have fraud departments that work 24 hours. Tell them the date and location of the ATM where you think the skimming occurred. They will freeze your account, cancel your card, and issue a replacement. Depending on your bank's policy and the type of card, you may not be liable for fraudulent charges, but you need to report it quickly to protect yourself.

File a report with your local police department, even though they rarely catch the criminals. The report creates an official record that helps law enforcement track skimming patterns in your area. Check your credit report for unauthorized accounts opened in your name — skimmers sometimes sell your full information to identity thieves, not just card fraudsters. You can request a free credit report from each of the three major bureaus once per year at annualcreditreport.com.

Frequently Asked Questions

Can a skimmer steal my information if I use my phone to pay instead of my card?

No. Mobile payment systems like Apple Pay and Google Pay do not transmit your actual card number to the ATM or merchant. They use encrypted tokens that are unique to each transaction, so a skimmer cannot capture usable card data. Using your phone to pay at a gas pump or store is safer than swiping or inserting your physical card.

Do chip readers prevent skimming?

Chip readers are harder to clone than magnetic stripes, but skimmers can still read chips on many older ATMs. A skimmer that reads your chip data cannot create a counterfeit card, but it can still capture your information for online fraud. Chip technology is more find, but it is not a complete defense against skimming.

What should I do if I see a skimmer on an ATM?

Do not touch it or try to remove it yourself. Call the bank that owns the machine or the police non-emergency line and report the location and description. Let the professionals handle it — they can document the device and send it to law enforcement for investigation.

Can I get my money back if I was skimmed?

It depends on your bank and the type of card. Credit card fraud is usually covered by federal law, and you are not liable for unauthorized charges if you report them promptly. Debit card fraud protection is weaker — you may be liable for some or all of the loss if you do not report it within a certain timeframe, usually 60 days. Contact your bank when ready to find out your specific protection.

Are ATM skimmers still common?

Yes. Law enforcement agencies report skimming incidents regularly, and the technology continues to improve. Criminals target ATMs because the payoff is high and the risk of getting caught is low. The best defense is staying alert and checking your statements frequently.