Credit card “shimming”: the new skimming

The information provided on this website does not, and is not intended to, act as legal, financial or credit advice. See Lexington Law’s editorial disclosure for more information.

“Shimming” is an alternative method of credit card fraud where criminals steal sensitive information from credit card microchips. The Federal Trade Commission (FTC) indicated that 1,036,903 instances of identity theft and counts of 101,427 of credit card fraud occurred in 2023. Credit card shimming and skimming can ultimately lead to identity theft in certain scenarios. 

Here, we’ll explain the difference between shimming and skimming, where these scams are likely to occur, and what you can do if your credit card gets compromised. Consulting this guide will increase your awareness of shimming scams and help you protect your banking information.

Table of contents:

1. Shimming vs. skimming
2. How to spot a credit card shimmer
3. How credit card shimming works
4. How to keep your card secure
5. What to do if you experience credit card shimming?
6. Get help with credit repair from Lexington Law Firm

Shimming vs. skimming

Credit card skimming and shimming are activities where bad actors lift financial information from credit cards. Skimmers target the magnetic strip on traditional credit cards, while shimmers target the chip in newer credit cards.

For skimming or shimming to work, criminals have to attach illegal devices to card readers. They can mount these devices on top of card readers, which can blend in and trick unsuspecting shoppers. 

Conventional wisdom recommends feeling card readers at gas stations to see if they wiggle. Knowing how these methods of fraud work can also help protect your funds.

How to spot a credit card shimmer

It can be quite difficult to spot a credit card shimmer or skimmer, but there are key questions to help you determine your risk at any transaction:

• Does the card slot look misaligned?
• Does it take more effort to insert your card?
• Does the credit card reader move around when you touch it?
• Does it look like anything is blocking the credit card slot? Has something already been inserted?
• Are the buttons on the card reader hard to push?
• Does anything about the reader look unusual (colors, font, etc.)?
• Is there security tape on the card reader? Is it broken or tampered with?

If you’re doubtful about whether an ATM has been affected, it’s best to try another ATM or go to a bank teller if possible. If you’re unsure about a transaction, consider paying in cash or using a contactless payment method, such as your mobile device’s virtual credit card wallet.

What do card skimmers look like?

Card skimmers and shimmers are made to look exactly like the regular ATM or card reader. Look for signs of poor craftsmanship or misalignment in the credit card slot because this means it may have been tampered with.

Taking extra safety precautions may seem like a burden at first, but protecting your finances is worth the effort. Remember to pause before you make any transaction to ensure the conditions are safe, even if you’re in a hurry.

How credit card shimming works

Credit card shimming works by inserting a small device called a “shim” into a card reader. Unlike skimmers — which were typically bulky and easily detectable if you knew what to look for — shims are small and subtle.

Whenever a chip-enabled card is inserted into the reader, the shim collects its data. Then, the scammer collects this data by inserting what looks like a regular card into the reader. This makes it difficult to spot suspicious activity, as it appears the scammer is making a regular transaction.

As the technology currently stands, scammers aren’t able to create an exact duplicate of chip-enabled cards based on the shimming data they collect. They are, however, able to create a version of the card with a magnetic stripe only — which many retailers still accept.

How to keep your card secure

While identity theft is not always avoidable, there are some habits you can incorporate to make sure you’re as protected as possible.

• Consider contactless payment. The best way to protect against skimmers that steal your card information is to simply avoid them altogether. Examples of contactless payment, aka “tap to pay” methods, include Apple Pay, Android Pay and Google Pay.
• Choose your ATM strategically. Only use ATMs that are in high-traffic areas or banks to reduce the chances that they’ve been compromised.
• Check for tampering. Wiggle the card reader or slot before inserting your card. A traditional skimmer will come off. If your card doesn’t go into the slot smoothly, this could be a sign of a shim inside. Consider choosing a different ATM.
• Be cautious at the pump. If you pay at the pump, choose a pump that is closest to the store and in direct view of an employee. If you’re skeptical, the safest option may be to pay the attendant inside.

Shimming and skimming scams are generally more likely to occur in specific places. You might encounter a credit card shimming or skimming device at the following locations:

• Automatic teller machines (ATMs)
• Fuel pumps
• Parking meters
• Point of sale (POS) terminals
• Vending machines

What to do if you experience credit card shimming?

Banks have some fraud detection technology in place that may catch suspicious activity before it becomes problematic, but it doesn’t always work. Luckily, the Fair Credit Billing Act says you’re not responsible for any unauthorized charges once you report your card as stolen. So, if you suspect you’ve fallen victim to skimming or shimming, you’ll want to act swiftly.

1. Contact your credit card issuer right away. They’ll cut off card access and send you a new card if needed.
2. Call the business where you think the shimming happened so that they can check their card readers for signs of tampering.
3. Alert your local law enforcement and the Federal Trade Commission. They may be able to notice a wider pattern and stop other consumers from becoming victims.
4. Freeze your credit. Contact the three major credit bureaus (Equifax®, Experian® and TransUnion®) to freeze any activity on your credit report.
5. Look into credit repair services. If fraudulent activity hurts your credit profile, credit repair services can help you get back on your feet.

Get help with credit repair from Lexington Law Firm

There are many steps you can take to help prevent Identity theft, and there are resources to help you recover from a successful attack. Get a free credit snapshot from Lexington Law Firm for a summary of the activity on your credit report. 

We can also help you dispute inaccuracies with the major credit bureaus if you find anything suspicious. Sign up with Lexington Law Firm for a more accurate view of your credit report.

Note: Articles have only been reviewed by the indicated attorney, not written by them. The information provided on this website does not, and is not intended to, act as legal, financial or credit advice; instead, it is for general informational purposes only. Use of, and access to, this website or any of the links or resources contained within the site do not create an attorney-client or fiduciary relationship between the reader, user, or browser and website owner, authors, reviewers, contributors, contributing firms, or their respective agents or employers.