You’ve probably used an ATM a thousand times without thinking twice about it. Pull up, stick your card in, punch in your PIN, grab the cash, move on. That routine is exactly what criminals are counting on. Because while you’re thinking about dinner or checking your phone, a tiny device you’d never notice is copying every piece of financial data on your card. And by the time you realize something’s wrong, your bank account is drained.
ATM skimming — the act of rigging cash machines with hidden devices that steal your card info — costs consumers and banks over $1 billion every year. And it’s getting worse fast. The number of cards hit by skimming jumped 77% in a single year, shooting from 70,000 compromised cards in 2022 to nearly 120,000 in just the first six months of 2023. Criminals are getting smarter, the devices are getting smaller, and most Americans still don’t look twice at the ATM before sliding their card in.
Here’s exactly what to look for — and some of these tricks are genuinely unsettling.
The Card Slot That Feels Just a Little Off
The most common skimming setup is a fake card reader placed right over the real one. It looks like it belongs there. Same color (usually), same general shape. But there are giveaways. If the card slot feels thicker than normal, wiggles when you touch it, or seems like it’s sticking out more than it should, that’s a problem. A normal ATM card reader is firmly attached to the machine. It shouldn’t move. Period.
Run your fingers along the edges of the card slot before you insert anything. If there’s a gap between the reader and the body of the ATM, or if the whole piece lifts up when you give it a firm tug, you’re looking at a skimmer. Walk away. Don’t use that machine. Don’t try to remove the device yourself — just call the bank or the police.
Fraudsters can install these things in seconds. They walk up, pop the overlay on, and leave. The device quietly copies data from the magnetic strip of every card that passes through it. Some newer models can even transmit that data wirelessly via Bluetooth to a laptop sitting in a parked car nearby.
Cameras the Size of a Pinhead Are Watching You Type
Stealing your card number is only half the equation. Criminals also need your PIN. And the way they get it is creepy: tiny pinhole cameras, sometimes no bigger than a pencil eraser, hidden on or around the ATM. They’re positioned to record your fingers as you type your four-digit code.
These cameras show up in different spots. Sometimes they’re tucked into a small piece of plastic mounted above the screen. Sometimes they’re hidden in what looks like a brochure holder stuck to the side of the machine. Sometimes they’re embedded in a fake faceplate that covers the entire front of the ATM. The placement varies, and that’s what makes them so hard to spot.
The single best thing you can do — and I mean this — is cover the keypad with your other hand every single time you type your PIN. Even if no one is standing near you. Even if you’re inside a bank. Make it a habit. If a hidden camera can’t see your fingers, the stolen card data alone is much less useful to the thief.
Fake Keypads That Record Every Keystroke
If you think hidden cameras sound bad, consider this: some criminals skip cameras entirely and just replace the keypad. They place a thin overlay — a fake keypad — directly on top of the real one. When you press a number, the overlay records the keystroke and passes it through to the actual button underneath. You feel a normal button press. The transaction works. You never suspect a thing.
But there are ways to tell. A compromised keypad might feel spongy, thick, or raised compared to the rest of the machine. It might look slightly different in color or texture. If the buttons feel mushy or if the pad seems like it’s sitting on top of another surface, trust your gut. That weird feeling you’re noticing? It’s probably legitimate. Try pressing down on the edges of the keypad. If it flexes or lifts, it’s an overlay.
Shimmers: The Threat You Literally Cannot See
Here’s where things get really frustrating. You might’ve heard that chip cards are safer than the old magnetic stripe cards. And that’s true — to a point. But criminals have adapted. They now use devices called “shimmers,” which are paper-thin circuit boards that slide inside the card reader slot, between the chip on your card and the chip reader inside the ATM.
Shimmers are virtually invisible. You can’t see them from the outside of the machine. They sit deep inside the slot, capturing your chip data when you insert your card. The stolen data gets used to clone your card’s magnetic stripe — which can then be used at ATMs or stores that still accept swipes.
The fact that chip cards were supposed to fix this problem and criminals just invented a workaround tells you everything about how motivated these groups are. As chip technology became standard, shimmers started replacing traditional skimmers as the preferred tool.
The Lebanese Loop: Your Card Goes In and Never Comes Out
Not all ATM scams are about copying your data. Some are way more direct. A “Lebanese loop” is a small plastic device or pronged sleeve inserted into the card slot that physically traps your card. You put your card in, the ATM seems to malfunction, and your card doesn’t come back. Most people shrug, assume the machine ate their card, and walk away planning to call their bank later.
That’s exactly what the criminal is waiting for. Once you leave, they pull the device out of the slot — with your card still in it. If they also had a camera recording your PIN, they now have everything they need to clean out your account.
If an ATM swallows your card, do not walk away. Stay at the machine and call your bank immediately using the number on their website or on the back of another card. And whatever you do, don’t call a phone number that might be posted on the ATM itself — because scammers sometimes stick fake customer service numbers right there on the machine.
The Money Trap That Makes Your Cash Disappear
This one is wild. Some criminals install a device over the cash dispenser itself — the slot where your money comes out. The device catches and hides the bills as they’re dispensed. Your transaction goes through, your account gets debited, but no cash appears. You think the machine glitched. You leave. The thief swoops in, removes the device, and pockets your money.
If an ATM deducts money from your account but doesn’t actually give you cash, don’t just walk away confused. Report it immediately.
Where Skimmers Show Up Most — And It’s Not Random
Criminals are strategic about where they plant their devices. Standalone ATMs at gas stations, convenience stores, hotels, and tourist areas are the most common targets. Why? Less monitoring, fewer security cameras, and more foot traffic. A busy gas station ATM at a rest stop off the interstate is a goldmine for skimmers. The criminal blends into the crowd. Nobody notices them spending 10 seconds at the machine.
Gas pumps are another favorite target. The card readers on pumps are often unmonitored, and in some cases criminals can open the pump housing with a universal key to install internal skimming devices that are completely hidden.
Meanwhile, ATMs inside bank branches — especially those in lobbies with security cameras or near a drive-through window — are much harder targets. It’s tough to tamper with a machine when a bank teller is 20 feet away and there are cameras everywhere.
Real Criminals, Real Cases
This isn’t a theoretical problem. Five Romanian nationals admitted to installing skimming devices on ATMs across the St. Louis area. Organized criminal groups — not lone operators — are behind many of these schemes. The U.S. Secret Service, which most people associate with protecting the president, is actually the lead federal agency that investigates skimming and access device fraud. They respond to hundreds of skimming incidents every single year.
And here’s a detail that doesn’t get enough attention: since at least 2021, skimming groups have been specifically targeting EBT cards — the electronic benefit cards used for food assistance programs. People who rely on those benefits are losing money to fraud, and EBT cards often have fewer fraud protections than traditional bank cards. It’s not just a financial crime; it hits the most vulnerable people hardest.
What Actually Works To Protect Yourself
So what do you actually do with all this? A few things that genuinely help:
Use ATMs inside bank branches whenever possible. Cover your PIN every time — no exceptions. Before inserting your card, give the card reader a tug and wiggle. Run your fingers along surfaces and feel for texture changes, loose edges, or sticky residue. If anything seems off — a weird color mismatch, a part that moves, a slot that looks too wide — walk away and use a different machine.
Set up transaction alerts through your bank. Most major banks let you get instant notifications for ATM withdrawals, and some let you turn your debit card off entirely through their app when you’re not using it. If your card number does get stolen, you’ll know about it within minutes instead of days.
Also — and this one surprises people — avoid using debit cards linked to your primary checking account at ATMs you don’t fully trust. If a thief gets your debit card number, they may have access to every account linked to that card. A compromised credit card, by comparison, comes with stronger fraud protections and doesn’t give direct access to your cash.
If tap-to-pay is available at an ATM, use it. Contactless transactions through a mobile wallet don’t expose your card number or magnetic stripe data, which makes skimmers useless.
Ten seconds of looking at an ATM before you use it could save you weeks of dealing with a drained bank account. That little bit of paranoia is worth it.
