How to protect yourself from card skimming

Your eyes, fingers, and now even your smartphone can help you spot card skimmers at gas stations and ATMs, but nothing is foolproof.

“Some of the newer skimmers are almost impossible to see, even if you know what you’re looking for,” says David Tente, executive director of the ATM Manufacturers Association in the US.

Let’s take a closer look at what to do if your card has been compromised by a skimmer, as well as the background of what card skimming is and how to protect yourself from it in the future.

What to do if your card has been hacked

We recommend that you regularly check your bank and credit card statements for fraudulent charges. If you discover any unusual or unauthorized transactions, especially after recently visiting a gas station or ATM, notify your credit card issuer or bank immediately by calling the number on the back of your card and asking about the next steps.

Many credit card companies and banking institutions send you notifications about suspicious or fraudulent payments. Usually you want to cancel your card and get a new one in the mail.

If you have suspicions about a particular transaction with your card, you can notify the merchant or company where you think the skimming occurred so they can find out if the device is in place.

What is card skimming?

Card skimming occurs when a criminal illegally installs a small electronic device on a gas station, ATM or POS terminal. During a transaction, the skimmer captures your PIN, card number, and expiration date from the magnetic stripe of your credit or debit card. They then use your details to create a fake credit or debit card and access funds or credit from your account. Card skimming costs financial institutions and consumers more than $1 billion annually, according to the FBI.

Card skimmers are commonly found at gas stations and ATMs. However, be aware that if your card slips out of sight in a restaurant or department store, your card details could be compromised by an employee with a portable skimmer.

Skimmers are hard to spot on fuel pumps because they are usually attached to the wiring inside the pump. And criminals often install a skimmer device on top of the original ATM card reader or place it inside the card terminal itself. In many cases, scammers also install a camera obscura on the ATM or place a fake keyboard over the real one to record keystrokes and steal your PIN. The skimmer stores the data and attackers can retrieve it later via a Bluetooth connection without even having to remove the skimmer.

There are no reliable statistics on the extent of skimming as it is a local crime that is not monitored centrally, but experts say it is on the rise.

How big is the risk? According to the National Association of Convenience Stores, 40 million Americans gas up every day. Of these, 31 million pay for fuel with a credit or debit card. When skimming occurs at a gas station, it usually only occurs at one gas station. One compromised pump can collect data from 30 to 100 cards per day.

How to avoid card skimming

While card skimmers are hard to spot, you can take steps to reduce your chances of being scammed. Follow these steps to keep your card and your accounts safe:

1. Inspect the ATM or fuel pump.

Before inserting your card into a gas station or ATM, carefully inspect the keypad and card reader. “Does anything look different if it’s an ATM you’ve used before?” Tente asks.

Are the seals on the fuel pumps broken? To place a skimmer in a gas station, the scammers must open the dispenser door to insert the skimmer.

According to the Federal Trade Commission (FTC), many stations place pump security seals near the credit card reader. If a criminal opens the pump panel, the label will read “invalid”, indicating that the machine has been tampered with.

If there is no tape, check if the dispenser door looks forced open. Also, look inside the card reader to see what’s hidden there, says Tente.

2. Payment inside

The likelihood of a criminal installing a card skimmer or hacking a terminal inside a store or bank is significantly lower than outside. This is especially true at a gas station store, where employees and a higher likelihood of surveillance make it harder for thieves to get to the terminal. In contrast, store employees find it more difficult to constantly monitor 10 to 20 external fuel pumps while they are running.

3. Cash payment

Debit and credit cards are convenient, but if you really want to protect yourself from skimmers, use cash. You can even save money if the gas station offers cash discounts.

4. Use a credit card

If your credit card number is stolen, you are playing with the bank’s money and are protected by the card’s zero liability policy. A stolen debit card number can cause much more damage. “If the debit card is compromised and they have your PIN, you have just given someone access to your cash,” says Eva Velasquez, president and CEO of the Identity Theft Resource Center.

You might consider getting one of the best gas credit cards to get money back on your gas purchases. Of course, you’ll want to pay off your credit card balance in full each month to avoid interest charges.

5. Use mobile wallets

If you have Apple Pay, Samsung Pay, or Android Pay—or your card issuer, bank, or gas station’s mobile wallet—paying by phone is a way to fill up incognito or withdraw cash from an ATM. When you pay by phone at gas stations, your card is never inserted into the reader, which may contain a skimmer. Basically, your credit card company sends a randomly generated 16-digit token or code to your smartphone as a backup credit card number.

6. Download Skimmer Detection Apps

New apps use Bluetooth to help you detect skimmers before you use the terminal to steal information. Two popular apps are Card Skimmer Locator for iOS devices and Skimmer Scanner for Android devices.

A blog post from SparkFun, creator of the Skimmer Scanner app, explains how it works:

“If detected, the app will attempt to connect using the default password 1234. Once connected, the letter ‘P’ will be sent. If the answer is “M”, then there is a very good chance that there is a skimmer within your phone’s Bluetooth range (between 5 and 15 feet).

If your smartphone detects a skimmer, use another pump or go to another gas station. You can also inform the gas station attendant of your suspicion.

bottom line

Card skimming is a theft risk that should be guarded against whenever you use a credit or debit card to shop, fill up, or access an ATM. Perform a quick inspection of the reader before using the card. Consider using cash, credit cards, or mobile wallets instead of a debit card to prevent thieves from stealing your bank account information.

It’s also a good habit to review your bank and credit card statements regularly to detect fraud in a timely manner so you can take action to cancel your card and prevent further damage.