In 2023, FICO reported that compromised cards at ATMs and fuel pumps jumped 96% year over year. More than 315,000 cards were skimmed, hitting over 3,500 financial institutions. Industry estimates put global skimming losses in the billions annually.
The device itself is cheap to build and fast to install. A skimmer over the card slot, a pinhole camera above the keypad, and the thief has everything needed to clone your card and drain your account. The whole setup takes under 30 seconds.
The good news: most skimmers are detectable if you know what to look for. These six checks take less than 20 seconds and can save you weeks of dispute paperwork.
1. Check the Card Slot for Bulges or Misalignment
Legitimate card readers are usually concave β they curve inward, flush with the machine's face. Skimmers sit on top, making the slot convex, bulky, or protruding.
What to do: Look at the card slot from the side. Does it stick out farther than the surrounding panel? Does the color or texture not quite match? Rick Steves notes that if the slot "bulges or protrudes out further than other parts of the machine," you should walk away.
The wiggle test: Give the card reader a light tug with your fingers. The FTC recommends this. A legitimate reader is bolted solid. A skimmer will shift, click, or detach.
If anything feels loose, do not insert your card.
2. Look for Mismatched Color or Material
ATM manufacturers use consistent plastics and finishes across a machine's face. Skimmers are aftermarket molds. They rarely match perfectly.
What to do: Compare the card slot's color to the rest of the machine. Is it glossier? Duller? A slightly different shade of gray? Does the plastic feel cheaper or thicker?
At gas pumps, the same rule applies: compare the card reader and keypad to the pumps on either side. If one looks different, use another.
3. Scan for Hidden Cameras Above the Keypad
Skimmers steal your card data. But without your PIN, that data is often useless. That's why thieves pair skimmers with tiny pinhole cameras pointed at the keypad.
What to do: Crouch down and look across the keypad from a low angle. Check for: - Small black dots or holes in the panel above the keypad - Unusual plastic lips or ledges that could conceal a lens - Brochure holders, mirrors, or other attachments that seem out of place
The University of Texas Global travel safety guidelines advise travelers to "cover the pin pad with your hand while entering your information" β even if you don't see a camera. This blocks both hidden lenses and shoulder surfers.
4. Feel the Keypad for Thickness or Sponginess
A keypad overlay is a thin, fake keypad placed on top of the real one. It records your PIN while the real keypad processes the transaction. You get your cash. The thief gets your PIN.
What to do: Press a few keys before entering your PIN. Does the keypad feel thicker than usual? Spongy? Do the keys sit higher than on other ATMs you've used?
Run your fingers around the edges of the keypad. A legitimate keypad is sealed flush. An overlay may have visible seams or lift slightly at the corners.
5. Check Your Phone for Suspicious Bluetooth Signals
Some modern skimmers transmit stolen data wirelessly via Bluetooth. The thief doesn't need to return to the ATM to collect the device β they just need to stand nearby with a phone or laptop.
What to do: Open your phone's Bluetooth settings while standing at the ATM. Look for unknown devices with generic names like "HC-05," "SPP," or long strings of numbers. These are common default names for Bluetooth modules used in skimmers.
This check is not foolproof. Not all skimmers use Bluetooth, and some may use other wireless protocols. But an unexpected, strong Bluetooth signal from an ATM is a red flag.
6. Look for Tampered Security Seals or Stickers
Many ATMs and gas pumps have tamper-evident stickers or security seals placed across access panels. If these are broken, peeled, or missing, the machine may have been opened and modified.
What to do: Look for stickers that say "void" if removed, or security tape across panel seams. On gas pumps, the American Bankers Association advises checking for "sticky residue or evidence of an adhesive used by criminals to affix" skimming devices.
A broken seal does not guarantee a skimmer is present. But it means the machine's integrity is uncertain. Use a different one.
What to Do If You Spot a Skimmer
Do not insert your card. Do not try to remove the device. Skimmers are evidence.
- Notify the bank or business immediately. If the ATM is outside a branch, go inside and tell a manager.
- Call local police if the bank is closed or unstaffed. Non-emergency lines are appropriate.
- Document the location β address, machine number if visible, time of day. Take photos from a safe distance if possible.
- Find another ATM β preferably inside a bank branch.
If you already inserted your card before noticing something wrong, call your bank immediately to freeze the account. Do not wait to confirm fraudulent charges.
Where to Withdraw: Location Matters More Than You Think
Not all ATMs carry equal risk. The European Association of Secure Transactions reported β¬167 million in European ATM skimming losses in 2022 alone. Thieves target machines that are unmonitored, poorly lit, and in high-tourist areas.
Safest options: - Inside bank branches β the University of Texas Global recommends using "an ATM located inside of a bank branch or hotel lobby rather than one on the street" - During business hours β when bank staff are present and can respond to issues - Well-lit, high-traffic areas β visibility deters installation
Highest risk: - Standalone ATMs in convenience stores, gas stations, or tourist strips - Machines in dimly lit or secluded areas - Any ATM with visible damage or tampering
ATM skimming is a global problem. For city-specific guidance, see our guide to ATM scams in Mexico City, where thieves use similar techniques near tourist zones.
The Second Trap: Decline Dynamic Currency Conversion
Finding a safe ATM is only half the battle. The machine itself may try to overcharge you through Dynamic Currency Conversion (DCC).
Here's how it works: the ATM asks if you want to be charged in your home currency instead of the local currency. It sounds helpful. It isn't.
When you choose your home currency, the ATM sets its own exchange rate β typically with a markup of 2% to 7% above the mid-market rate. Visa's guidelines state that merchants and ATMs "should give you a choice to accept or decline currency conversion and must not choose on your behalf."
Always choose the local currency. Let your own bank handle the conversion. The difference on a single withdrawal can be small, but over a two-week trip it adds up to real money.
Final Checklist: 20 Seconds That Save Your Trip
Before you insert your card, run through this list:
- [ ] Card slot is flush, not bulging
- [ ] Color and material match the rest of the machine
- [ ] No pinhole cameras above the keypad
- [ ] Keypad feels normal, not thick or spongy
- [ ] No suspicious Bluetooth signals nearby
- [ ] Security seals are intact
- [ ] Location is inside a bank or well-lit public area
- [ ] You will decline any currency conversion offer
Skimming is a physical crime. It leaves physical evidence. The thieves rely on travelers being rushed, distracted, or unfamiliar with local machines. These six checks break that advantage.
Sources
- Rick Steves / Explore.com β "Rick Steves' Tips For Protecting Your Money When Using An ATM While Traveling"
- TIME β "What Is ATM Skimming? How to Protect Yourself" (SolcyrΓ© Burga, 2024)
- Capital One β "Credit Card Skimmers: How to Spot & Avoid Them"
- University of Texas Global β "Information Security" travel safety guidelines
- FICO β 2023 card compromise data
- European Association of Secure Transactions β 2022 European ATM fraud losses
- Visa β "Dynamic Currency Conversion Explained"
- Wise β "What is dynamic currency conversion (DCC)?"
- American Bankers Association β ATM safety tips
- Genome / Inga KuktienΔ β "The ATM Skimming Fraud: How to Recognize and Prevent It"