The times are always changing, and that means Americans are using physical payment methods less and less—forget cash; a majority of us are using digital wallets and other, safer ways of paying for stuff more than credit or debit cards these days.
But you can’t always avoid using a physical card at a store checkout or an ATM. Although most payments involving cards use Europay, Mastercard, and Visa (EMV) chip technology for contactless payments these days, you still run into a lot of older ATMs and point-of-sale (POS) systems that require you to swipe or insert your card to make the money magic happen—and that puts you at risk of a skimmer or shimmer scam (a shimmer is a thin circuit board inserted into a card reader; when you “dip” your card, it captures your info).
Skimmers and shimmers are variations on the same idea: A piece of technology is illegally inserted between you and the card reader on the ATM or checkout. They often either look exactly like the real thing or are hidden inside the checkout device, making them difficult to spot. These are often large-scale operations that fan out and install their devices on a lot of machines to steal your information, and despite the rise of contactless payments, these scams are still thriving. Your number one defense is being aware—and knowing what to look for.
Many skimmer devices are designed to look like the real thing, but because they are retrofitted, there are usually some tell-tale signs. If you find yourself in a position where you have to physically swipe or insert your card, there are a few steps you can take to protect yourself:
Compare. Compare the card reader with others in the same store or ATM vestibule, if you can. Does it look different? It’s probably a fake.
Try to remove. Next, give it a tug—like, really give it a tug—even if you have no reason to be suspicious. Many skimmers are fitted over the existing hardware and can be removed with just a little effort, but you won’t harm the real deal. See if you can get a fingernail under the keypad and lift it up, too; criminals want to steal your PIN by capturing it when you type it in.
Look for residue. Examine the surface of the reader for sticky residue; sometimes these devices are quickly (and sloppily) glued into place. Scratches can also indicate that the machine has been worked on with tools.
Check the tape. Some ATMs and gas pump POS systems use security tape to ensure that the reader hasn’t been opened to insert a shimmer or otherwise tamper with it. The FTC has a photo of what this tape should look like in its voided and unvoided state.
Look inside. Before you insert your card into a reader, shine a light into the receptacle to ensure there’s nothing jammed in there.
Just being physically observant will protect you from most skimmers and shimmers, but criminals do have some other tricks they play that you should be aware of whenever you’re accessing an ATM, so there are a few other things to keep in mind:
Situational awareness. Make a point of looking around any time you’re about to use a credit or ATM card. Look for anything out of place, like machines that don’t match or components that look broken or dirty. Trust your instincts and use a different machine (or store) if you have any doubts.
Cover the keypad. Even if you find no reason to believe there’s a skimmer involved, criminals sometimes install tiny cameras that capture your PIN as you type it in. Combined with the card info the skimmer snags, they have everything they need to rob you blind.
Always go contactless. If possible, always opt to pay with a contactless option to avoid all the risk. While it’s not impossible that thieves can steal your card info from a contactless transaction, it’s a lot more difficult.
