What Is ATM Skimming? How to Protect Yourself

Hundreds of thousands of Americans had their debit cards compromised last year after falling victim to ATM skimming—and the problem is only growing. 

Skimming is a type of fraud that takes consumers’ credit and debit card information at Automated Teller Machines (ATMs), fuel pumps, and checkout stations. The Federal Bureau of Investigation says it costs consumers and financial institutions more than $1 billion a year. 

“We are becoming a cashless society, so we rely a lot [on cards],” says Ahmed Banafa, a professor at San Jose State University and cyber security expert. “Once they get that [card] information, within seconds they can do purchases, cash withdrawal, and sell [card information] on the dark web. People will never know about it unless they have an alert, they check their credit report, or they have a message from the bank.”

Officials are working on cracking down on the fraud practice. On Tuesday, four foreign nationals were federally charged for allegedly installing skimming devices on bank ATMs and at store checkout stations in at least six states, the U.S. Attorney's Office from the District of Rhode Island announced. A fifth defendant is in the custody of the U.S. Marshals Service, and an arrest warrant has been issued for the sixth. But the problem is still significant. In a March report, FICO found that the total number of compromised debit cards went up by 96% from 2022 to 2023 due to skimming.  

Here’s what to know. 

What is skimming?

Banafa describes ATM skimming as “identity theft for your credit and debit card.” He says that scammers may often use an “overlay” that is placed over ATM slots or checkout stations where consumers insert their cards to get people’s credit card information.

Skimming devices look similar to regular card readers, though the FBI notes that it can be more convex while real readers are concave. Scammers may also install small cameras to track people’s PIN numbers.

“After a few days, the criminals will come to the location or stand next to the machine and start downloading the information,” Banafa says, though others are much more advanced in their fraud schemes and can send information through bluetooth. 

Once they have card information, they will likely use it to make purchases, but can also sell the information to others.  

How common is it?

More than 315,000 cards and at least 3,500 financial institutions were impacted by skimming in 2023, according to FICO. 

The practice is also particularly easy to do. Banafa says scammers can 3-D print an overlay device, which they can install by distracting store clerks. Card information can even be transferred wirelessly in some cases, meaning the culprits don’t even have to return to the store. 

The majority of card compromises happen at non-bank ATMS, many which can be found at convenience stores or gas stations. However, there has been a rise in skimming at bank ATMs from 2022 to 2023, as they now account for a third of all compromised skimming locations. 

Virginia, Texas, New Jersey, Florida, and Colorado have all reported a rise of 50% or more in debit or credit card compromises—with Virginia and Texas among the top five states with skimming activity. And despite California reporting significant decreases in skimming activity, they still are leading the list as the top state with skimming activity, per FICO. 

EBT and other public benefits cards are more attractive to skimming groups because they do not have a chip, which functions as a tool to make more secure payments. “EBT cardholders generally have limited protections compared with holders of common credit and debit cards,” the FBI says. “As a result, they may not be reimbursed fully or at all for benefits lost to criminals. This, in turn, can compound their existing financial hardships.”

How to protect yourself

Being cautious of where you are inserting your credit or debit card is important. Some telltale signs of a skimming machine may include strange wires, or a particularly bulky or loose slot to insert a card. “Try to go to an ATM where somebody can see that you are there, or a gas station location pump where the attendant can see you so [scammers] can understand that they're monitoring that,” says Banafa. He also suggests people avoid ATMs in areas with a lot of tourists, as those can be hotspots for skimming. 

The FBI suggests people also try running their debit cards as credit cards, or covering their PIN when they put it in if that is not an option. If the keypad has a strange shape or color, that can also indicate that a keypad overlay has been placed. 

“If you don't feel comfortable about it, whether it is inside the store or a standalone ATM, or the gas pump, don't do it. Go somewhere else, you know,” says Banafa. “And at the same time, inform the establishment, ‘I think there's something wrong with it.’” 

The FBI also suggests people make purchases using third-party payment options like Apple Pay, Google Pay or PayPal when buying an item at a checkout. “When your credit card information is saved on the servers of those companies they generate one-time information for that transaction, and that number is useless after using it for that [purchase],” Banafa says.

Any suspicious activity on a card should immediately be flagged to the bank, as some fraudsters use the card to check if small purchases can go through, or will be flagged, before they attempt to buy more goods. Signing up for fraud alerts, or even purchase alerts might also be a good tool of protection.  

“Don’t underestimate this,” says Banafa. “All [scammers] need is just to get your information once, and now we have to deal with the consequences on your credit report.”