ExamWizardzExamWizardz
Start free
Security

What is card skimming?

Card skimming is stealing payment card data with a hidden reader on an ATM, fuel pump or POS terminal, often with a camera or fake keypad to grab the PIN.

What is card skimming?

Card skimming is the theft of payment card data at the place the card is used. Criminals fit a covert reader to an ATM, fuel pump, ticket machine or point-of-sale terminal so that it copies card data as customers pay, and they add a way to capture PINs. The stolen data is used to make counterfeit cards or is sold. Skimming is a physical attack: it depends on getting hands on the device, not on breaking into a network.

Types of skimming devices

  • Overlay skimmers: a fake bezel or card slot fitted over the real one, reading the magnetic stripe as the card slides in.
  • Deep-insert skimmers: thin readers pushed into the card slot itself, invisible from outside.
  • Internal skimmers: wired inside a pump or terminal cabinet after it is opened, often with a widely available generic key.
  • Shimmers: paper-thin circuits slid into the chip slot to intercept data passing between chip and terminal.
  • PIN capture: a pinhole camera above the keypad or a fake keypad overlay that records each press.

Some skimmers store data until the criminal comes back for the device; others transmit it over Bluetooth or a cellular module so nobody has to return.

Why chip and contactless payments help

A magnetic stripe holds static data that can be copied exactly onto another card. An EMV chip produces a fresh cryptogram for each transaction, so data captured from it can't simply be written to a working chip card. That is why criminals still want stripe data and favor terminals that accept swipes or fall back to the stripe when a chip read fails. Contactless and mobile wallet payments go further: each tap carries a one-time cryptogram, and mobile wallets send a token in place of the real card number, so a reader planted on the terminal gets little of value.

Indicators of skimming

Staff inspecting a terminal look for a reader or keypad that wobbles, sits higher or differs in color from identical machines nearby, and for seals on pump or kiosk cabinets that are torn, missing or carry the wrong serial number. A tiny hole or extra strip near the keypad may hide a camera. Near fuel pumps, an unfamiliar Bluetooth device name showing up on a phone scan is a warning sign. Card issuers spot skimming from the other end, when fraud reports cluster among cardholders who all used one machine, a technique known as common point-of-purchase analysis.

Defending against skimming

For a merchant, the core controls are an inventory of every card-reading device with its model, serial number and location; tamper-evident seals and non-generic locks on cabinets; regular inspections by staff trained to spot overlays and swapped devices; and camera coverage of terminals. PCI DSS requires merchants to protect these point-of-interaction devices from tampering and substitution, keep the device list and inspect the devices periodically (requirement 9.5 in v4.0.1). Moving customers to chip, contactless and mobile wallets removes most of the value of a stripe skimmer. Cardholders can tug the card slot before inserting, shield the keypad while entering a PIN, and prefer tap-to-pay.

Card skimming vs. related attacks

  • Shoulder surfing: watching someone type a PIN; skimming relies on a planted device.
  • Badge cloning: the same copy-it-at-the-reader idea aimed at building access cards.
  • Web skimming: malicious JavaScript injected into an online checkout page to steal card details as they are typed; no physical device is involved.

Card skimming on the CompTIA Security+ exam

Skimming is one of the physical attacks named in SY0-801 objective 2.5, a scenario objective about recognizing attacks from their indicators. Wording such as a card reader that looks different from the others, customers who used one pump reporting fraud, or a broken seal on a terminal points to skimming. The controls that fit are device inspection, tamper seals and chip or contactless payment. Distractors include shoulder surfing, when no device was planted, and tailgating or forced entry, which are about getting through a door rather than copying card data.

Studying for CompTIA (Security)?

ExamWizardz turns the official objectives into a guided study plan — with practice tests, realistic PBQs, and a readiness score. Start free.

Start studying free

Related terms

badge cloning

Badge cloning is copying the credential from an access badge, usually a 125 kHz proximity card, onto another card or device that the door reader accepts.

NFC

Near Field Communication (NFC) is a short-range, high-frequency wireless technology that allows for secure, bidirectional data exchange between two devices in close proximity.

PCI DSS

PCI DSS (Payment Card Industry Data Security Standard) is the security standard for any organization that stores, processes or transmits card data.

POS

A point-of-sale (POS) system is a computerized system used by businesses to record sales transactions, manage inventory, and handle customer payments at the location where goods or services are sold.

shoulder surfing

A social engineering attack in which an attacker observes a victim's screen, keyboard, or keypad from over their shoulder to capture sensitive information such as passwords, PINs, or confidential data without the victim's knowledge or consent.

tokenization

Tokenization replaces a sensitive value, such as a card number, with a random token; only a secure token vault can map the token back to the original.

← Back to the full CompTIA glossary