How to protect yourself from card skimming

Your eyes, fingers and now even your smartphone may be able to help you spot card skimmers at gas pumps and ATMs, but nothing is foolproof.

“Some of the newer skimmers are almost impossible to see, even if you know what you’re looking for,” says David Tente, U.S. executive director of the ATM Industry Association.

Let’s take a closer look at what to do if your card has been compromised by a skimmer, as well as some background on what card skimming is and how to protect yourself against it in the future.

What to do if your card has been skimmed

It’s a good practice to regularly check your bank and credit card statements for any fraudulent charges. If you spot any unusual or unauthorized transactions, particularly after recently visiting a gas station or ATM, alert your credit card issuer or bank immediately by calling the number on the back of the card and asking about the next steps.

Many credit card companies and banking institutions send you notifications when a suspicious or fraudulent charge occurs. Usually, you’ll want to cancel your card and receive a new one by mail.

If you’re suspicious about a particular transaction with your card, you may want to notify the vendor or business where you think the skimming occurred, so they can investigate if the device is still in place.

What is card skimming?

Card skimming occurs when a criminal illegally installs a small electronic device on a gas pump, ATM or point-of-sale (POS) terminal. During a transaction, the skimmer captures your PIN, card number and expiration date from the magnetic strip of your credit or debit card. They then use your data to create a fake credit or debit card and access funds or credit from your account.  According to the FBI, card skimming costs financial institutions and consumers over $1 billion every year.

Card skimmers are generally found at gas stations and ATMs. Keep in mind, however, if your card leaves your sight at a restaurant or department store, your card’s data could be compromised by an employee with a portable card skimmer.

It’s hard to spot skimmers on fuel pumps because they are typically attached to the wiring inside the pump. And criminals often install a skimmer device over an ATM’s original card reader or place it within the card terminal itself. In many cases, fraudsters also install a pinhole camera on the ATM or place a fake keypad on top of the real one to record your keystrokes and steal your PIN. The skimmer stores the data, and criminals can acquire it later through a Bluetooth connection without ever needing to retrieve the skimmer.

There are no reliable statistics on the extent of skimming since it is a local crime and not centrally tracked, but experts say it is on the rise.

How big is the risk? According to the National Association for Convenience Stores, 40 million Americans refuel every day. Of them, 31 million pay for fuel with a credit or debit card. When skimming occurs at a gas station, it usually takes place at only one pump. A single compromised pump can capture data from 30 to 100 cards per day.

How to avoid card skimming

Although card skimmers are difficult to detect, you can take measures to reduce your odds of becoming a fraud victim. Consider these steps to keep your card and your accounts safe:

1. Examine the ATM or fuel pump

Before you slide your card in a fuel pump or ATM, take a good look at the keyboard and card reader. “Does anything look different if this is an ATM you’ve used before?” Tente asks.

With fuel pumps, is the seal broken? In order to place a skimmer inside a fuel pump, fraudsters must open the fuel dispenser door to insert the skimmer.

According to the Federal Trade Commission (FTC), many stations place pump security seals near the credit card reader. If a criminal opens the pump panel, the label will read “void,” which tells you the machine has been tampered with.

If there’s no tape, check to see if the dispenser door looks as though it has been forced open. Also, look inside the throat of the card reader to see if you can spot anything hidden there, Tente says.

2. Pay inside

The odds of a criminal installing a card skimmer or tampering with a terminal inside a store or bank are significantly lower than they are outside. This is particularly true inside a gas station store, where employees and a higher likelihood of surveillance make it harder for thieves to tamper with the terminal. By contrast, it’s harder for store employees to consistently monitor 10 to 20 outside fuel pumps while they are working.

3. Pay with cash

Debit and credit cards are convenient, but if you really want to safeguard against card skimmers, use cash instead. You may even save money if the gas station offers discounts for cash purchases.

4. Use a credit card

If a credit card number is skimmed, you’re playing with the bank’s money and protected by the card’s zero liability policy. A stolen debit card number could yield far worse damage. “If a debit card gets compromised, and they have your PIN, you’ve just given someone access to your cash,” says Eva Velasquez, president and CEO of the Identity Theft Resource Center.

You might consider getting one of the best gas credit cards to earn cash back for your gasoline purchases. Of course, you’ll want to pay off your credit card balance in full each month to avoid interest costs.

5. Use mobile wallets

If you have Apple Pay, Samsung Pay or Android Pay – or your card issuer, bank or gas station’s mobile wallet – paying by phone is an incognito way to fuel up or withdraw cash at an ATM. When you pay by phone at gas stations, your card never goes in the payment reader that may contain a skimmer. Essentially, your credit card company sends a randomly generated 16-number token or code to your smartphone as a stand-in credit card number.

6. Download Skimmer detecting apps

New apps use Bluetooth to help you detect skimmers before you use an information-stealing terminal. Two popular apps are Card Skimmer Locator for iOS devices and Skimmer Scanner for Android devices.

A blog post from SparkFun, the Skimmer Scanner app maker, explains how it works:

“If found, the app will attempt to connect using the default password of 1234. Once connected, the letter ‘P’ will be sent. If a response of ‘M’ then there is a very high likelihood there is a skimmer in the Bluetooth range of your phone (five to 15 feet).”

If your smartphone detects a skimmer, use a different pump or go to a different gas station. You can also notify the gas station attendant of your suspicion.

Bottom line

Card skimming is a theft risk to guard against whenever you are using a credit or debit card to shop, get gas or access an ATM. Before you use your card, perform a quick inspection of the reader. Consider using cash, credit cards or mobile wallets instead of your debit card so thieves can’t steal your bank account information.

It’s also a good habit to regularly review your bank and credit card statements to discover fraud early, so you can take steps to cancel your card and prevent further damage.