How card skimming works
- A reader fitted over the slot of an ATM or fuel pump copies the magnetic stripe
- A pinhole camera or a false keypad records the PIN
- A shimmer, a thin insert in the chip slot, reads chip data
- A payment terminal in a shop is tampered with or swapped
- Web skimming: script injected into a checkout page copies typed card details
Stripe data can be written to a blank card and used where terminals still accept a swipe. Data from a web skimmer is used for card-not-present payments.
What limits card skimming
An EMV chip produces a one-time cryptogram for each payment, so a copy of the stripe, or of the data a shimmer reads, cannot pass as the chip at a chip terminal. Counterfeit fraud therefore moves to places that still read the stripe, and to online payments, where 3-D Secure and tokenisation take over the defence.
Why card skimming matters to acceptance and issuing
For a merchant or a terminal provider the risk is a compromised device or page: terminals are inspected for tampering, and payment pages are watched for scripts that should not be there.
An issuer sees skimming as a cluster of fraud on cards that all visited one ATM or shop, the common point of purchase. The usual response is to reissue those cards before more are used.
Where card skimming shows up in a platform
Modules that do the work
- Card issuingVirtual and physical cards, wallets and controls, on the issuer processor you choose.
- Fraud & riskReal-time fraud scoring, limits and case management, with the risk engines you already trust.
- Card acquiringCard acceptance on the phone, in store and online, through the acquirer you choose.