Free tools Windows power users keep installed
One-click scans. No signup required.
Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Card skimming captures information from a card’s magnetic stripe, usually when the card is swiped; card shimming uses a thin device inside a reader slot to capture information from a chip card as it is inserted. Both involve tampering with payment equipment, and either can put your account at risk. A separate camera or keypad overlay may also steal your PIN. The practical response is to check the terminal, stop if a card does not fit normally, cover the keypad, use tap-to-pay when available, and watch your account for unauthorized activity.
The distinction matters because chip cards changed the way payment data is handled, but they did not eliminate terminal tampering. A skimmer can target the stripe on an ATM, checkout reader or fuel pump. A shimmer is hidden in the slot used for an inserted chip card and may be impossible to see without dismantling the reader. Neither device has to be obvious, and a reader that appears normal is not proof that it has not been altered.
As an Amazon Associate I earn from qualifying purchases.
Recommended Free Tools
At a glance
| Method | Data targeted | What happens | Detection clue |
|---|---|---|---|
| Skimming | Magnetic-stripe data | Information is captured when a stripe is swiped past a compromised reader. | An altered or mismatched reader may be visible, but some devices are hidden. |
| Shimming | Chip information | A thin device inside the card slot captures information as a chip card is inserted. | The device may be hard to see; an unusual or difficult card insertion is a warning sign. |
These are general distinctions, not guarantees about every attack: skimmers are not always exterior overlays, and shimmers may be difficult to identify without dismantling equipment. Michigan’s consumer guidance and the FBI’s overview of skimming describe the methods and precautions.
What’s the difference between skimming and shimming cards?
The difference is what the device targets and how the card interacts with the reader: skimming targets magnetic-stripe data during a swipe, while shimming targets information from a chip card during insertion.
Popular on Amazon
- Ideal for Gifting
- Ideal for a bookworm
- Compact for travelling
A skimmer may be attached over or installed inside a payment reader. Some attacks use an overlay that resembles the original slot; others place components inside equipment or otherwise capture stripe data without an obvious add-on. When you swipe, the compromised equipment captures information stored on the stripe. Skimming can occur at ATMs and point-of-sale terminals, including self-checkout equipment and fuel pumps.
A shimmer is a thin device placed inside a slot, between the inserted card and the reader’s contacts as described in consumer guidance. It is intended to intercept information exchanged when a chip card is inserted. Because it sits inside the reader, shimming is especially difficult to spot by looking at the outside. The card may still appear to work normally, so visual inspection cannot guarantee that a terminal is safe.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The labels describe different data paths, not two wholly separate kinds of location or equipment. A compromised ATM or checkout terminal may be involved in either type of tampering. A fuel pump is a particularly familiar skimming location because customers commonly swipe there, but an ATM or ordinary checkout reader can also be targeted. The presence of a chip reader does not mean the magnetic stripe or the equipment around it is immune to abuse.
Nor does the word “shimmer” mean that a criminal has automatically created a working duplicate of a chip card. Chip information alone does not necessarily produce a usable chip clone. New Jersey consumer guidance says chip cards make cloning more difficult, though not impossible, and describes stolen chip information being used to make counterfeit cards with magnetic stripes.
Skimmer versus shimmer: a practical comparison
| Question | Skimming | Shimming |
|---|---|---|
| What is targeted? | Magnetic-stripe data. | Information exchanged by a chip card during insertion. |
| What action exposes the card? | Swiping the stripe through a compromised reader. | Inserting a chip card into a compromised slot. |
| Where might it occur? | ATMs, point-of-sale terminals and fuel pumps. | ATMs and point-of-sale terminals with an inserted-card slot. |
| Is the device visible? | Sometimes an overlay or mismatched part is visible; internal devices may not be. | Often not. A shimmer can be inside the slot and hard to see without dismantling the reader. |
| What warning sign is most useful? | Loose, crooked, scratched, damaged or mismatched equipment. | A card slot that looks altered or a card that does not insert normally. |
| Does it steal a PIN? | Not by itself. A camera or keypad overlay is a separate method that can capture the PIN. | |
The table describes common patterns, not a checklist that identifies every device. Criminals can disguise equipment, and a normal-looking reader can still be compromised. Treat an unusual fit or visible alteration as a reason to stop, not as the only proof that a device is present.
Can a skimmer or shimmer steal my PIN?
The skimmer or shimmer captures card information; PIN theft is a separate step. A camera positioned near an ATM or a keypad overlay placed over the genuine keys may record the PIN as you enter it. Obtaining both the card information and the PIN can make an account compromise more damaging than obtaining card data alone.
Use your other hand or your body to shield the keypad from view. Cover the keys even when the terminal looks ordinary, because a tiny camera or a false keypad may not be obvious. This precaution applies at ATMs and at payment terminals whenever a PIN is required. It does not prevent card-data capture, but it reduces the chance that someone observing or recording the keypad can obtain both pieces of information.
Also popular on Amazon
Do not enter a PIN if the terminal appears altered or if someone is trying to distract you while you use it. Move to another machine or ask the responsible operator for help. If you already entered a PIN at a suspicious reader, notify your issuer promptly and follow its instructions for protecting the account.
Where are skimmers and shimmers found?
Payment-terminal tampering is not limited to one brand of machine. The FBI describes skimming at ATMs, point-of-sale terminals and fuel pumps. State and consumer-protection guidance likewise warns that criminals can target equipment wherever customers insert or swipe payment cards.
- ATMs: A compromised card slot can capture data, while a camera or false keypad can record a PIN. Check the machine before inserting a card and cover the keypad.
- Retail and restaurant terminals: A reader at a checkout counter or self-service station may be altered, internally or externally. Compare its parts with nearby equipment and stop if a card does not fit normally.
- Fuel pumps: These are common skimming targets because customers may swipe at the pump. Use an alternative payment method or an attended terminal when practical, and inspect the reader for damage or mismatched components.
Location alone does not tell you whether a device is present. A busy store, familiar ATM or recently serviced pump can still have a problem, so combine a quick inspection with account monitoring and safer payment choices.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallHow can I spot a compromised card reader?
Look for signs that equipment has been altered, but treat inspection as a warning system rather than proof of safety. A hidden device can escape notice, and a reader that looks normal is not necessarily uncompromised.
- Check whether the reader or keypad looks loose, crooked, scratched, damaged or mismatched with the rest of the terminal.
- Compare the color, shape and alignment of the card slot and keypad with nearby readers of the same type.
- Look for a bezel, faceplate or keypad that appears to sit higher than it should or does not line up with the terminal.
- Notice whether labels, security seals or other components appear disturbed. Do not rely on a seal alone as a guarantee.
- Stop if the card slot feels unusually tight, obstructed or difficult to use. Do not force a card into it.
Shimmers sit inside the card slot, so they may not be visible without taking the reader apart. The Michigan Attorney General notes that shimmers can be difficult to detect without dismantling the equipment. Do not try to open or dismantle a terminal yourself; report the concern to the responsible operator.
How can shimming be detected? There is no dependable consumer test that exposes every shimmer from the outside. An unusual insertion experience is a useful warning sign, but it is not definitive evidence by itself. If the card catches, stops short, or requires pressure that is not normal for that machine, remove it if you can do so safely, stop the transaction and notify the operator or financial institution.
How can I reduce the risk when paying?
Prefer contactless payment when it is available, protect any PIN you enter, and monitor the account afterward. No single precaution guarantees that a payment terminal or account is safe.
Also popular on Amazon
- Choose tap-to-pay when available. The FBI says, “Tap-to-pay transactions are more secure and less likely to be compromised.” That is a relative risk statement, not a promise that contactless payments cannot be compromised or that every contactless transaction is risk-free.
- Inspect the terminal before using it. Avoid a reader with loose, crooked, damaged or mismatched parts. If an inserted card does not fit normally, stop rather than forcing it.
- Use the chip instead of swiping when contactless is unavailable and the terminal is normal. If the slot looks altered or insertion feels wrong, do not continue simply because the machine offers another payment route; ask for a different terminal or payment method.
- Cover the keypad. Shield your PIN as you enter it, since a camera or keypad overlay may be used separately to capture it.
- Check transactions and turn on issuer alerts if available. Review your card and bank activity for charges, withdrawals or other activity you do not recognize. Alerts can help surface activity quickly, but continue to check statements and account activity yourself.
- Contact your issuer promptly about unauthorized activity. Use the issuer’s official contact method, such as the number on the card or in its app, and follow its instructions for securing the account.
These precautions are supported by FBI guidance, the Pennsylvania State Police bulletin and New Jersey consumer guidance.
What should I do if my card does not fit easily into an ATM?
Stop. Do not push, twist or force the card into the slot, and do not use the machine again until the operator confirms it is safe. Difficulty inserting a card can have an ordinary mechanical explanation, but it is also a warning sign for an obstruction or an internal device.
- Remove the card if you can do so without damaging it.
- Cancel the transaction and move away from the machine.
- Tell the bank, ATM operator or business responsible for the equipment. Use a posted phone number or an official branch or app contact rather than a number supplied by a stranger.
- If you entered a PIN or completed a transaction, check your account and contact the issuer promptly if anything is unfamiliar.
Do not attempt to pull out a suspected shimmer or open the machine. Handling the equipment could damage evidence or create a safety problem. An unusual fit does not prove that a shimmer was installed, but it is enough reason to stop and report the issue.
What should I do if I suspect a skimmer or shimmer?
Stop using that terminal, report the suspected tampering and check your accounts. If you already used the reader, contact your card issuer promptly about suspicious activity and ask what steps it recommends for protecting the account.
- Do not use the reader again. If you are at a business or ATM, tell the operator or financial institution responsible for it. If you can safely do so, note the terminal’s location, time and identifying details to help the operator find it.
- Review your card and bank transactions. Look for charges, transfers or withdrawals you did not authorize. Enable transaction alerts if your issuer offers them.
- Call the issuer promptly if anything looks wrong. Report unauthorized transactions and follow the issuer’s directions for securing the card or account. Do not wait to see whether an unfamiliar charge disappears.
- Report suspected skimming to the FBI’s IC3. The FBI directs people to the Internet Crime Complaint Center for skimming reports. A suspected device can also be reported to local authorities and the business or financial institution responsible for the terminal.
Keep notes about when and where you used the reader and save notifications or statements showing unauthorized activity. Your issuer may ask for those details while investigating. If the card is still in your possession, that does not rule out compromise; the terminal may have copied data without taking the physical card.
What happens to stolen chip information?
Chip information should not be treated as an automatic recipe for a working counterfeit chip card. New Jersey’s consumer brief says chip cards make cloning more difficult, though not impossible, and describes stolen chip information being used to make counterfeit cards with magnetic stripes. That distinction matters: the risk is real, but it is inaccurate to assume every captured chip record can be used to duplicate the chip itself.
The brief also explains why cardholders should respond to suspicious activity even if they used a chip card. The reader’s method of capturing information and the criminal’s later use of it are separate parts of the risk. If you notice a transaction you did not make, report it to your issuer regardless of whether you inserted, swiped or tapped the card.
Also popular on Amazon
A shimmer therefore does not guarantee that a criminal can approve every type of transaction. It does mean information from a chip transaction may have been exposed and should be treated seriously. The issuer can determine whether the card should be blocked, replaced or monitored more closely.
Do RFID-blocking sleeves stop skimming or shimming?
No. RFID-blocking sleeves and wallets do not stop a compromised payment reader from capturing information when you swipe a magnetic stripe or insert a chip card. Those products address a different type of wireless-reading concern and are not a substitute for checking the terminal, protecting a PIN, choosing contactless payment when available and monitoring the account.
There is also no consumer detector identified in the guidance that reliably finds every skimmer or shimmer. Practical behavior and issuer services—especially transaction alerts and prompt fraud reporting—are the useful defenses described for this problem.
How costly is card skimming?
The FBI page states that skimming costs financial institutions and consumers more than $1 billion each year. The page does not state a publication year or identify an underlying dataset alongside that figure, so it should be treated as an undated FBI estimate rather than a verified measurement for 2026.
The PCI Security Standards Council’s Skimming: A Resource Guide, published in 2015, includes older figures attributed to industry sources such as ATMmarketplace.com, Aite Group, Mercator Advisory Group and FICO. Those historical numbers provide context about the long-running problem but should not be presented as current national totals.
Which sources explain card skimming and shimming?
The FBI provides federal consumer guidance on methods, PIN capture, payment locations, precautions, account monitoring and reporting. The Michigan Attorney General defines both methods and emphasizes that shimmers can be hard to detect. Pennsylvania State Police published a community-awareness bulletin dated September 12, 2022, while the New Jersey Division of Consumer Affairs revised its shimming brief on June 13, 2023.
The PCI Security Standards Council also published a skimming resource guide in 2015. Its figures are historical, not current estimates. The FBI page gives an estimate of more than $1 billion in annual losses to financial institutions and consumers, but does not state a publication year or identify an underlying dataset alongside that figure; it should not be presented as a verified current-year measurement.
Also popular on Amazon
- It can be a gift option
- Comes with secure packaging
- Helpful in various ways
Frequently Asked Questions
Do RFID-blocking wallets prevent card skimming or shimming?
No. RFID-blocking products do not stop a compromised payment reader from capturing information when you swipe a magnetic stripe or insert a chip card. The useful precautions are to check the terminal, protect your PIN, choose contactless payment when available and monitor your account.
Can stolen chip information be used to make a counterfeit card?
New Jersey consumer guidance says chip cards make cloning more difficult, though not impossible. It describes stolen chip information being used to create counterfeit cards with magnetic stripes, which is different from automatically producing a working duplicate chip.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Is the FBI’s more-than-$1-billion skimming estimate a current annual figure?
The FBI page gives that estimate but does not state a publication year or identify an underlying dataset alongside it. Treat it as an undated estimate, not as a verified measurement for 2026.
What is the difference between skimming and shimming cards?
Skimming targets magnetic-stripe data when a card is swiped. Shimming uses a thin device inside a card slot to capture information from a chip card as it is inserted. Both involve payment-terminal tampering, and either may be paired with separate PIN-capture equipment.
How can shimming be detected?
A shimmer may be hidden inside the slot and impossible to see without dismantling the reader. Watch for an unusual or difficult insertion, stop if the card does not fit normally, and report the terminal rather than trying to open it yourself.
The Bottom Line
Skimming reads magnetic-stripe data during a swipe; shimming hides inside a card slot and targets information from an inserted chip card. Inspect readers, stop when insertion feels abnormal, cover every PIN entry, choose tap-to-pay when available and review account activity. If a terminal seems altered or a transaction is unauthorized, report it promptly to the operator and your card issuer, and use the FBI’s IC3 for suspected skimming reports.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →
