Can chip cards be skimmed?
Key takeaways
- Chip cards are less vulnerable to skimming than magnetic stripe cards, but they aren’t completely safe.
- Crooks can still capture your card information from a chip card using a technique called shimming.
- Shimming allows criminals to create fake credit cards with your card information.
Now that we’ve adopted chip cards in the U.S., magnetic stripe cards are becoming a thing of the past. But does that do away with your risk for credit card skimming? Unfortunately, no — while chip-and-PIN cards are more secure, you should still be careful when using these cards.
Chip cards are more secure
Magnetic stripe credit cards carry a high risk of fraud through skimmers that criminals add to card readers at ATMs, retail stores and gas stations. These devices “skim” and record your card information when you swipe or insert your card into the card reader. Bad guys then retrieve this information from the skimmers and counterfeit your credit card’s details, which they can then use for fraudulent transactions.
The introduction of so-called EMV or chip card technology was designed to decrease this risk. With a chip card, you insert your card into the card reader without swiping. And while chip cards are safer than magnetic stripe cards, they are still at risk for fraud through a technique called “shimming.”
Chip cards can be shimmed
Chip cards are considered safe because they generate a different token for each transaction. While information skimmed from magnetic strip cards doesn’t change from transaction to transaction, the nature of chip tokens prevents fraudsters from using your information for future payments or activity.
Yet, as thieves will do, there’s a new technique called shimming that allows for even chip card information to be stolen from unsuspecting cardholders. Shimming uses a thin reader called a “shim” that fits into a card reader slot at a retailer or ATM. These shims contain a microchip and flash storage that can capture and save your card information from your chip card. Unlike the one-time transaction token generated by chip cards, the information captured by a shim contains the details required to authenticate and process future transactions.
The crooks can then retrieve the shim and use your card information to create forged cards with magnetic stripes, providing a tool for swiping their cards containing your information. These fraudulent mag stripe cards don’t arouse suspicion, because chip cards also typically contain a magnetic stripe as backup.
Take steps to protect yourself
You can take the below steps to reduce your risk of shimming and the theft of your card information:
- Turn to contactless cards and mobile wallets: These payment methods don’t require you to input your credit card into a card reader that can shim your information. Instead, you tap your card or wallet on the card reader, and that one-time token is generated for a transaction to go through.
- Remain vigilant by paying attention to the way your chip card inserts into a card reader: If it’s difficult in any way for you to insert your card, or if the card reader itself isn’t secure to the machine, take your card and report it to your issuer.
- Carefully read your credit card statements: Read them regularly to make sure that there are no transactions you didn’t initiate.
- Avoid using debit cards: Especially be mindful of using them at gas stations, which can expose your bank account to thieves without the protections offered by credit cards.
What to do if you’re a victim of shimming
If you’re a victim of credit card fraud, call your credit card issuer immediately. Many issuers offer fraud protections that absolve you of liability if you report the charges within 30 days. Your issuer can also freeze your account against future fraud, providing you with a replacement card for future transactions.
For next steps, the Federal Trade Commission has set up a website for victims of fraud to report their situation and outcomes. The FTC shares this information with law enforcement to support wider investigations into fraud.
And don’t be afraid to turn to your state’s attorney general or consumer protection agency for help if you need it.
The bottom line
Although chip-and-PIN cards are an improvement to magnetic strip cards when it comes to exposure to fraud, your information isn’t 100 percent secure. Chip cards can still be skimmed — or shimmed — at card readers and ATMs. Stay vigilant to keep your chip card safe, understand the safest ways to pay and know the steps to take if you do become a victim of credit card fraud.
