The Dark Art of Card Skimming

By Elliot Greenblott
Growing up on a lakeshore meant plenty of time to try a great amateur sport: stone skipping. The trick was to find a slat stone and angle it into the water in order to cause it to skim along the surface. Skimmers were great when they could travel out 100 or more feet. Today’s “skimmers” (and shimmers) are not fun and result in significant losses by consumers.

A card skimmer is a device attached to a point-of-sale terminal that collects credit and debit card information and transmits the data to a criminal. This technology is installed on ATMs, gas station pumps, and other places where consumers use payment cards. Card shimmers are a bit more sophisticated. They are paper thin shims inserted in the existing card slots and intercept data between your card and the chip reader.

Once the data is transmitted by either of these devices, the criminal is capable of making purchases using the card, withdrawing money from bank accounts (ATM Cards), producing duplicate cards, or selling your information to others.

Because a skimmer is a fairly bulky piece of equipment, it requires installation time. This makes it’s use more likely when the payment device is in a location not regularly monitored or more distant from traffic volume. For example, placement is more likely at a gas pump furthest away from the store entrance or at an ATM located in a corner of a store rather than close to the cashier.

Shimmers, by contrast, can be places in practically any card reader, including at the check-out counter of a store. Installation takes only a matter of seconds and can be accomplished when the counter is unattended or when the clerk is distracted.

Skimmers, in general are easier to detect. Before inserting your card, check out the terminal and surroundings, particularly in low traffic areas. Look for scratches, parts with mis-matched color, or even dried glue around components. On gas pumps, look for seals covering the access point to the service panels of the pump. No seals covering the access points, choose a different pump. The same advice is true if there is residue and appears that tape was removed. Examine ATMs for anything that looks out of place: added external boxes that might contain a camera to capture pin entry, loose components such as the card reader slot (if anything on the device moves, don’t use it). Also, examine the logos that appear on the device. Step away if they are blurry or distorted.

Detecting a shimmer is difficult. Generally, there are no physical signs of its presence. None the less, check the insert slot before sliding your card. If the slot appears to have a visible layer in the slot enclosure, use an alternate payment method by asking the clerk to handle the payment, using cash, or where available, use contactless payment.

Some general tips: 1) Avoid using gas station pumps that are furthest from foot traffic. These are more likely candidates for skimmers; 2) Plan ahead for cash needs when traveling. ATM skimmers are frequently found near ski and resort areas where users are not familiar with the machines; 3) With ATMs, use those that are security monitored or are located in places requiring access cards; 4) Consider alternatives to using credit card. Cash is an option but so are contact-less payment systems such as Apple Pay or Google Pay. In addition, many gas stations offer loyalty programs where no card is required and payment is made by direct account debiting. Often these programs even offer discounts at the pump.

Finally, whether you are a victim or not, if you see something, say something. Report the scam to the business involved so it can respond and report the scam to local law enforcement. Skimming and shimming generally are not singular events. Law enforcement may have similar reports that can be used to recognize a pattern.

Elliott Greenblott is a retired educator and coordinator of the AARP Vermont Fraud Watch Network. Questions, concerns? Contact [email protected]