Skimming

What skimming is

Skimming is the unauthorized capture and transfer of payment data for fraud. In person, a criminal uses a hidden or handheld device to copy data from a card’s magnetic stripe, or tampers with a point-of-sale terminal or its connection. Some attacks also capture a customer’s PIN through a concealed camera or altered keypad.

E-skimming targets online checkout. Malicious code on an online store copies payment details as customers enter them. The term Magecart is also used for this kind of online attack. Both forms expose payment-card information, but one targets physical payment equipment and the other targets a website or app.

Skimming is a fraud risk, not a standard processing fee, and it can start at a terminal or on your checkout page.

How skimming affects your business

Stolen card data can be used to make counterfeit cards or unauthorized purchases. Customers may dispute those transactions, and your team may need to investigate affected sales, secure equipment or website access, and notify the right parties. Downtime and damaged customer trust can add to the cost, even though skimming itself is not a processing fee.

For in-person payments, using the EMV chip instead of swiping a chip card helps reduce counterfeit-card exposure. The US EMV liability shift took effect in October 2015 for most in-person merchants. When counterfeit fraud occurs, the party using the less secure technology bears the loss under that shift.

Where skimming goes wrong

A tampered reader can look like ordinary equipment, and a device can be placed inside a terminal or attached to a cable. Warning signs include loose or damaged readers, unfamiliar attachments, unexpected equipment swaps, or someone offering to service a terminal without an approved work order.

Online, third-party scripts and checkout tools add another place for unauthorized changes. PCI DSS v4.0.1 is the current standard. The 51 future-dated requirements from v4.0 became mandatory on March 31, 2025, including payment-page script controls in requirements 6.4.3 and 11.6.1. Processors commonly bill a monthly PCI non-compliance fee when a merchant has not validated compliance, but that fee is separate from skimming itself.

What appears on your statement

There is no standard statement line called “skimming.” Review settled sales, refunds, disputes and any fraud-related fees against your order records. A suspicious transaction is not proof of a skimming attack, but a cluster of unauthorized purchases can be a reason to investigate the affected terminal or checkout page.

Keep skimming losses separate from ordinary processing costs. The research does not establish a standard skimming fee or a fixed merchant penalty. Look for a PCI non-compliance fee as its own line, then verify whether your compliance validation is current.

What you can actually change

1. 01
   Inspect terminals. Check readers, cables and terminal housings for damage, unfamiliar attachments or unauthorized changes. Restrict terminal access and confirm service visits through your approved process.
2. 02
   Protect checkout pages. Review payment-page scripts and third-party tools for unauthorized changes. Keep your PCI DSS validation current, including the applicable payment-page script controls.
3. 03
   Respond quickly. If you suspect a device or website compromise, contact your acquiring bank or processor and your security team immediately. Preserve relevant records and follow their incident-response instructions.
4. 04
   Use chip payments. When a customer presents a chip card in person, use the chip reader rather than swiping the magnetic stripe. The US EMV liability shift for most in-person merchants began in October 2015.

Frequently asked questions