ATM skimming is a form of payment-card theft in which criminals tamper with an ATM or another card reader so that card information can be captured without the cardholder realizing it.
The FBI says skimming devices may be installed on or inside ATMs, point-of-sale terminals and fuel pumps. The stolen data can then be used to create counterfeit payment cards or support unauthorized transactions. PIN theft is often a separate part of the same scam, using concealed cameras or fraudulent keypad overlays to capture the number entered by the victim.
This means a person can leave the ATM with the physical card still in their wallet while the underlying card information and PIN have already been compromised.
Quick answer: ATM skimming usually combines two kinds of theft: card-data capture and PIN capture. A skimmer targets the card reader, while a hidden camera or fake keypad may record the PIN. The biggest consumer warning signs are loose, crooked, damaged or unusual parts around the card slot or keypad, followed by unfamiliar withdrawals or transaction alerts.
Safety scope: This article explains skimming defensively. It does not provide skimmer construction, placement instructions, hidden-camera setup, keypad-overlay design, card-cloning procedures or ATM cash-out methods.
What Is an ATM Skimmer?
An ATM skimmer is an unauthorized device used to capture payment-card information when the card is inserted or read. Some skimmers are visible overlays; others can be installed inside or deeper within a card reader and may be difficult for a customer to see.
The Secret Service describes skimming incidents as the installation of hidden electronic devices that record cardholder information at ATMs and point-of-sale terminals. Its 2025 advisory says criminals can later misuse that stolen data for unauthorized withdrawals or purchases.
The Two-Part Nature of Many Skimming Scams
Fraud component | What it targets | Why criminals want it |
|---|---|---|
Card-data skimmer | Information read from the payment card | Can support counterfeit-card or unauthorized-payment fraud |
PIN-capture method | The PIN entered by the cardholder | Can make stolen debit-card data more useful for ATM withdrawals |
Social engineering or observation | The victim or their behavior | Can expose PINs, cards or account details without technical tampering |
How Card-Reader Skimming Works at a High Level
A tampered ATM can contain an additional reader that captures data during an otherwise normal transaction. The customer inserts the card, completes the transaction and may notice nothing unusual at the time.
For consumers, the important point is not the internal design of the device but the effect: the ATM can still appear to function normally while an unauthorized component is copying data from the payment interaction.
External Overlays vs Internal Skimming Devices
Type | What a customer might notice | Defensive takeaway |
|---|---|---|
External overlay | Loose, crooked, raised or mismatched material around the card slot | Do not use the ATM if anything looks attached or out of place |
Internal/deep-insert device | May have few or no obvious external signs | Prefer supervised or indoor ATMs and rely on transaction alerts as a second layer |
Tampered keypad area | Raised keypad, odd spacing, unusual material or loose privacy cover | Do not enter a PIN on a keypad that looks or feels abnormal |
How PIN Theft Fits Into the Scam
The card reader and the PIN-capture method are often separate. The FBI says criminals may use a small concealed camera near an ATM or a fraudulent keypad overlay to record PIN entries.
That is why covering the keypad with your free hand is one of the most consistently recommended ATM-safety habits. It blocks the line of sight of many concealed cameras even when you cannot see the camera itself.
Pinhole Cameras: What Consumers Need to Know
A pinhole camera is a tiny concealed camera positioned so that it can view the keypad. The Secret Service notes that the lens can be extremely small and easy to hide on or near an ATM.
- Cover the keypad fully while entering the PIN.
- Do not assume the camera would be mounted directly above the keypad.
- Look for unusual objects, panels or attachments around the ATM.
- Use your body and free hand to shield PIN entry from nearby people as well as cameras.
Keypad Overlays: What They Are
A keypad overlay is a fraudulent layer placed over a legitimate keypad so that keystrokes can be recorded. The FBI and Secret Service both warn that suspiciously raised, loose or inconsistent keypads can be a sign of tampering.
Consumers should not try to dismantle a suspicious ATM. If the keypad or reader feels wrong, stop using the machine and report it to the bank, merchant or ATM operator.
Warning Signs Before You Insert Your Card
Warning sign | Why it matters |
|---|---|
Loose card reader | A component may have been added over or around the real reader. |
Crooked or raised card slot | The reader should look integrated with the ATM, not newly attached. |
Scratches, broken plastic or adhesive residue | Visible tampering can indicate that something was attached or removed. |
Raised or unusual keypad | A keypad overlay may be present. |
Different color or material | Mismatched parts can indicate a foreign component. |
Unusual privacy shield or nearby object | Could interfere with the keypad or conceal a camera. |
What to Check in 10 Seconds Before Using an ATM
- Look at the card slot and keypad before touching the machine.
- Check whether anything is loose, crooked, raised, cracked or obviously mismatched.
- Look for scratches, tape, adhesive residue or newly attached plastic.
- If the keypad or reader feels loose, stop and use another ATM.
- Choose an indoor, well-lit ATM when practical.
Why Indoor ATMs Are Often a Better Choice
The FBI and Secret Service recommend using ATMs inside financial institutions, near security cameras or in well-lit locations when possible. These machines can still be attacked, but physical access is generally more controlled and suspicious tampering may be noticed sooner.
Can Chip Cards Still Be Skimmed?
EMV chip technology makes traditional counterfeit-card fraud more difficult than magnetic-stripe-only cards because chip transactions use stronger security than a static stripe.
However, many cards still contain magnetic stripes, and the FBI notes that the stripe remains vulnerable even when the card also has a chip. The Secret Service also warns that skimming technology evolves, so chip use should be combined with terminal inspection and account monitoring.
What Is a “Shimmer”?
“Shimmer” is a common security term for a thin unauthorized device associated with chip-card readers. Consumers do not need to diagnose the exact device type: if the card reader behaves strangely, retains the card, or looks damaged, stop using the ATM and report the problem.
The defensive rule is the same for skimmers and shimmers: do not troubleshoot suspicious hardware yourself. Secure the card and notify the ATM owner or financial institution.
What Happens After Card Data Is Stolen?
After a skimming event, the victim may not see fraud immediately. The stolen information can be stored and later used for unauthorized transactions. In magnetic-stripe schemes, law enforcement has documented stolen data being re-encoded onto other cards for fraudulent withdrawals or purchases.
This delay is why transaction alerts and routine account review matter. The physical ATM visit and the fraudulent withdrawal can occur at different times and locations.
Warning Signs After You Used an ATM
- A cash withdrawal you do not recognize
- A small or unusual transaction followed by larger unauthorized activity
- A bank alert for a location you did not visit
- Repeated PIN failures or a card being unexpectedly blocked
- The ATM retained your card and the card is later used elsewhere
- Multiple suspicious transactions after one recent ATM visit
What If the ATM Does Not Return Your Card?
The FBI recommends contacting the financial institution immediately if an ATM does not return the card after the transaction is ended or canceled. A retained card can be a mechanical problem, but it can also indicate tampering.
- Do not accept help from an unknown person nearby.
- Do not re-enter your PIN because someone tells you to.
- Lock or freeze the card in the official banking app if available.
- Call the issuer using the trusted number on your banking app, statement or official website.
- Review recent account activity from a trusted device.
What to Do After an Unauthorized ATM Withdrawal
1. Contact the bank or card issuer immediately.
Report the withdrawal as unauthorized and ask for the card and account to be secured.
2. Lock or replace the card.
Follow the issuer's official fraud process.
3. Change the PIN if advised.
Use a trusted banking channel, not the suspicious ATM.
4. Review recent transactions.
Look for other withdrawals, purchases or balance inquiries you do not recognize.
5. Preserve evidence.
Keep alerts, receipts, ATM location details and transaction times.
6. Report the skimming incident.
In the United States, the FBI directs skimming victims to IC3.gov; other countries have their own reporting channels.
Why Transaction Alerts Matter
The FBI recommends monitoring card, bank and benefits accounts and enabling email or text alerts when available. Alerts cannot stop a skimmer from copying data, but they can dramatically shorten the time before a victim notices unauthorized use.
Debit Card vs Credit Card at Risky Terminals
The FBI and Secret Service both note that debit-card compromise can expose money directly connected to a bank account and may involve a PIN. At non-ATM payment terminals, using a credit card or contactless method can reduce some debit-account exposure.
At an ATM, a debit or ATM card is usually required for cash access, so the practical defense is to use trusted machines, protect the PIN and monitor the account.
ATM Skimming vs Card Trapping
Skimming copies payment data while the victim typically keeps the card. Card trapping is different: the physical card becomes stuck or is retained in a way that may allow a criminal to recover it later.
Both can involve PIN theft, which is why a retained card plus unusual activity should be treated as an urgent fraud warning.
ATM Skimming vs Shoulder Surfing
Shoulder surfing is simple observation rather than electronic skimming. Someone watches the cardholder enter the PIN or handle the card. Covering the keypad protects against both hidden cameras and nearby observers.
ATM Skimming vs Card-Not-Present Fraud
ATM skimming begins with a physical card-reader interaction, making it primarily a card-present threat. Card-not-present fraud happens online, by phone or through other channels where the physical card is not presented.
The same stolen card data may later be abused in other channels, so a skimming incident can sometimes lead to both ATM and online fraud.
How Banks and ATM Operators Fight Skimming
- Anti-skimming hardware and tamper-resistant card readers
- Surveillance and physical inspection of ATMs
- EMV chip-based transaction security
- Real-time transaction and withdrawal monitoring
- Card and account alerts
- Rapid blocking of cards linked to known compromised terminals
Exact detection thresholds and anti-skimming controls are not publicly disclosed in detail because that information could help criminals evade them.
Frequently Asked Questions
What is ATM skimming?
ATM skimming is the theft of payment-card data using an unauthorized device installed on or inside an ATM card reader.
How do ATM skimming scams steal PINs?
PINs may be captured separately through concealed cameras, fraudulent keypad overlays or observation by another person.
Can I always see an ATM skimmer?
No. Some devices are visible overlays, while others can be hidden inside the card reader.
What are the biggest signs of an ATM skimmer?
Loose, crooked, raised, damaged or mismatched parts around the card reader or keypad are important warning signs.
Why should I cover the keypad?
Covering the keypad helps stop concealed cameras and nearby observers from seeing the PIN.
Can chip cards be skimmed?
Chip technology is more secure than magnetic stripes, but cards often still contain magnetic-stripe data and other forms of terminal tampering remain possible.
What should I do if the ATM keeps my card?
Contact the bank or card issuer immediately, lock the card if possible and do not accept help from strangers.
What should I do after an unauthorized ATM withdrawal?
Report it to the issuer immediately, secure the card and account, review recent activity and preserve evidence.
Are indoor ATMs completely safe?
No. They can still be compromised, but law-enforcement guidance says indoor or well-supervised machines can be less vulnerable targets.
How can I report ATM skimming?
Report the incident to your financial institution and local authorities. In the United States, the FBI also directs victims to IC3.gov.
Final Thoughts
ATM skimming scams are dangerous because the cardholder can complete a normal-looking transaction and leave with the physical card while stolen information has already been captured.
The card reader is one part of the threat and PIN theft is often the second. Loose or unusual ATM components, hidden-camera risk, unfamiliar withdrawals and retained cards are the warning signs consumers should take most seriously.
The best defense is layered: inspect the ATM, shield the keypad, favor well-lit supervised machines, enable transaction alerts and contact the bank immediately when anything looks wrong.
Authoritative References
- FBI - Skimming
- FBI - ATM Skimming: Beware of Skimmers
- U.S. Secret Service - 2025 ATM & POS Terminal Skimming Public Advisory
- U.S. Secret Service - Operation Targets EBT Fraud
- FBI - Common Frauds and Scams: Skimming
Editorial note: This article is educational and defensive. It explains ATM skimming, PIN theft, warning signs and victim response without providing skimmer construction, device placement, hidden-camera setup, keypad-overlay design, card-cloning instructions or ATM exploitation methods.
