When a batch of cards turns up in fraud, the issuer's analyst first asks which ATM or card terminal all of them used. One machine common to every card points to skimming, a form of card fraud that starts with copied data.
How does a skimming device steal card data at an ATM?
Picture a supermarket ATM, drawn only from the US Secret Service's skimming guidance:
- Fit. A skimmer goes deep inside the card slot and a pinhole camera watches the keypad.
- Capture. Each card gives up its magnetic stripe data, sometimes its chip data too, while the camera records the PIN.
- Collect. The group keeps the data or sells it in batches.
- Clone and cash out. The data is written onto other cards for cash withdrawals or expensive purchases.
The Secret Service, the lead US agency on access device fraud, says skimming causes "hundreds of millions of dollars in losses annually".
Burçak Aydın, this entry's author: "Issuers usually find a skimmer from the cards, not the machine. They take every card that later turned up in fraud, find the one ATM or terminal those cards all used, and reissue every card that touched it, even the ones not yet misused."
Table 1. How skimming fraud works at one ATM, stage by stage.
| Stage | Criminal | Cardholder notices | Bank or merchant sees | Who acts |
|---|---|---|---|---|
| Fit | Hides a skimmer and a camera | Nothing | Nothing, unless an inspection finds it | ATM operator or merchant |
| Capture | Records stripe, chip and PIN data | Nothing | Normal transactions | Nobody yet |
| Collect | Keeps or sells the batch of card data | Nothing | Nothing | Nobody yet |
| Clone and cash out | Writes the data onto cards and spends | A withdrawal they did not make | Disputed transactions | Cardholder reports; issuer blocks the card |
| Detect | Loses the device once it is found | A new card | One ATM shared by the disputed cards | Issuer reissues; police remove the device |
Card skimming or cash skimming: which meaning do you need?
Skimming has two meanings. In banking and payments it means copying card data, and US law counts the data itself as an access device: the definition lists "any card, plate, code, account number" and a "personal identification number" (18 U.S.C. 1029(e)(1)). In accounting, skimming means taking money before it reaches the books. To a bank analyst it is a copied card; to a fraud examiner, a missing sale.
What is cash skimming in a business?
The ACFE defines skimming as "a scheme in which an incoming payment is stolen from an organization before it is recorded", for example by an employee who pockets a customer's payment and records no sale (ACFE, Occupational Fraud 2026, page 106). Of 2,402 cases investigated from January 2024 to September 2025, 219 were skimming: 9 percent, with a median loss of $45,000 (pages 6 and 15). The ACFE splits skimming into sales, receivables (where lapping sits) and refunds and other (page 13).
How is shimming different from skimming?
Shimming is skimming from inside the card reader. The European Association for Secure Transactions (EAST) defines a shimming device as one "placed inside the card reader" in its standard terminology for card data compromise devices.
How can you tell a card reader has been tampered with?
Often not from the outside. The Secret Service says an ATM skimmer is usually impossible to detect from the exterior and lists small signs: broken lights, a raised PIN pad, loose components, stickers in unusual places. On a shop terminal, pull the corners gently and tell the merchant if any part feels loose.
Merchants can run three checks from the PCI Security Standards Council's skimming advice for merchants (23 December 2015):
- Serial numbers. The sticker underneath should match the number on the display; if not, a skimmer may be inside.
- Odd changes. Damaged security stickers or swapped cables suggest someone opened the case.
- Unannounced service visits. A "friendly tech" may be fitting a device.
Where do skimmers turn up: ATMs, fuel pumps, tills or checkout pages?
Table 2. Types of skimming fraud, with examples.
| Type | Where | What is taken | How it is cashed out | Source |
|---|---|---|---|---|
| ATM skimming | Inside the card slot, a camera near the keypad | Stripe and chip data, PIN | Cloned cards at other ATMs | Secret Service |
| Point of sale (POS) overlay | A shell over a shop terminal or its keypad | Stripe and chip data, every key pressed, including a debit card's PIN | Cloned cards and purchases | Secret Service |
| Fuel pump | Attached to the pump's internal wiring, out of the customer's sight | Card data, stored or sent wirelessly | Cloned cards | FBI; Secret Service |
| Shimming | A device inside the card reader | Card data read from inside the reader | Reused card data | EAST |
| Digital skimming | A script on an online checkout page | Card details as they are typed | Online purchases | PCI SSC, 2025 |
| Cash skimming | A till or a receivables ledger | Customer payments before they are recorded | Pocketed directly | ACFE, 2026 |
The FBI notes that fuel pump skimmers are usually attached to the pump's internal wiring and store data to be downloaded or sent wirelessly later. In one Florida case, a ring skimmed pumps in three states and bought diesel in bulk with the counterfeit cards; a third member pleaded guilty in March 2025 (US Attorney, Middle District of Florida).
The Secret Service says card skimming often hits pharmacies, gas stations and grocery stores. The year in financial crime and compliance is reviewed in the 2025 to 2026 Financial Crime and Compliance Report from complead, formerly Sanction Scanner.
What is digital skimming?
Digital skimming moves the skimmer onto a checkout page. Take an online shop whose payment page loads a third party script: an attacker alters it, and every card number typed in also goes to the attacker. "Scripts running in consumers' browsers are now a significant target," PCI SSC wrote on 10 March 2025. PCI DSS requirements 6.4.3 and 11.6.1 ask that payment page scripts are "properly authorized, checked for integrity, and monitored for tampering" (PCI SSC payment page security guidance).
Is skimming illegal, and what is the penalty?
Yes, in the US, the UK and the EU.
In the US, 18 U.S.C. 1029 covers producing or using counterfeit access devices (a)(1), holding 15 or more counterfeit or unauthorized ones (a)(3) and holding equipment for making them (a)(4). The maximum is 10 years, 15 for (a)(4) and 20 after a prior conviction.
In England, Wales and Northern Ireland, the Fraud Act 2006 allows up to 5 years for possessing an article for use in fraud (section 6) and up to 10 for making or supplying one (section 7).
In the EU, each member state sets its own penalties, within the floor that Directive (EU) 2019/713 on fraud and counterfeiting of non-cash means of payment sets for maximum prison terms; Denmark is not bound by it and Ireland did not take part.
Say someone is stopped with a skimmer and 20 cloned cards: in the US that reaches (a)(3); in England, Wales and Northern Ireland, section 6. Who refunds the victim of credit card theft is covered in the credit card fraud entry.
How do banks and merchants stop skimming fraud?
Suppose a grocery chain finds an overlay on one till. It takes the terminal out of service and calls the police, as the Secret Service advises, and issuers reissue every card used there. The standing controls are sealed terminals, regular inspections, employee training and chip or contactless payment in place of the stripe.
Catching a cloned card when it is spent is payment fraud detection: each payment is scored at authorization, then approved, declined or sent for review. Acquirers can check a new merchant or its owners for fraud news free.
The guide to fraud detection and prevention covers how banks build these checks.
How can you prevent skimming fraud as a cardholder?
Four of the Secret Service's steps for cardholders:
- Use an ATM inside a bank branch or in a bay with security cameras.
- Shield the PIN with your other hand.
- Pay by chip or contactless, not the stripe; a tap never enters an ATM's card slot.
- If the card is misused, ask the issuer's fraud department for a new card and PIN, and call the local police if you lost money.
In the UK, victims report to Report Fraud, which the City of London Police launched on 4 December 2025 in place of Action Fraud (ONS crime bulletin, 23 July 2026).
Back at the supermarket ATM, the device came out the day the analyst named the machine, and its cards were reissued.
Related terms
- Credit card fraud. Using a card or its details without permission; skimming supplies the details.
- Card not present fraud. Spending with card details when no physical card is shown, as in online or phone orders.
- Embezzlement. Theft of money or property entrusted by an employer; cash skimming is one form.
