How to spot a card skimmer at an ATM or pump

TL;DR

Card skimmers are illegal devices that copy the data off your card while a hidden camera or fake keypad records your PIN. They appear on three surfaces: ATM card slots, gas-pump card readers, and point-of-sale terminals at the counter. Each has a small number of visual tells, but the single most important one is that a legitimate reader does not wiggle, does not have raised edges, and does not have parts that look like they do not belong. If the slot is loose or thicker than the ones next to it, walk away. Some skimmers sit inside the chip reader, where no eyeball check can reach, so the safest defenses are behavioral: tap to pay, run debit as credit at the pump, and check your statements.

What a card skimmer actually is

A card skimmer is a small electronic device installed on top of, or inside, a legitimate card reader. The US Secret Service, the lead federal agency for access-device fraud, describes the practice as criminals installing "hidden devices at ATMs and Point-of-Sale terminals at popular merchants (pharmacies, gas stations, grocery stores) to capture card data," then either re-encoding that data onto counterfeit cards or selling it on underground markets.^[1] Annual losses to US institutions and consumers run "in excess of $1 billion," according to the agency's own published numbers.^[2]

Three device families cover almost every reader you will run into:

ATM skimmers. Inserted deep into the card slot or fitted over it; according to the Secret Service, the deep-insert variety is "often impossible to detect externally."^[1]
POS overlays. Plastic shells covering the whole top of a card terminal, or just the keypad and chip slot, designed to look identical to the original.^[1]
Shimmers. Thin, card-sized boards inserted inside the chip-reader slot, sitting between your chip card and the terminal contacts; invisible from outside the reader.

The visual tells on an ATM

The FDIC's consumer page on skimming tells ATM users to inspect the reader first, watch for a card that "doesn't easily go into the machine," and look for tiny holes in the ATM housing that hide a pinhole camera.^[3] The Secret Service page adds that signs of tampering include "inoperable lights, raised PIN pads, loose edges, loose components, [and] unusual stickers."^[1]

Cluster those together: a legitimate ATM bezel is one piece of plastic with no raised seam, no part that moves when you wiggle it, and no pinhole anywhere on the housing. A skimmer is a part that is bolted, glued, or magnetically stuck on top of that bezel, which is what creates the wiggle and the seam.

Four checks you can do in under a minute at any ATM:

Wiggle the card slot. Push the bezel side to side and up. A factory-fitted slot does not move; a skimmer usually does.
Compare to the next ATM over. Skimmers are added one at a time, so the skimmed ATM looks subtly thicker, longer, or a slightly different color than the ATMs next to it.
Look for a second seam above the real slot. An extra plastic seam above the card entry is a smoking gun for a deep-insert skimmer.
Look at the PIN pad and the housing around it. A fake PIN pad is often thicker than the real one, sits at a different angle, or has a small hole punched above it for a hidden camera.^[3]

If any single check fails, do not use the machine and tell the bank branch. One ATM in a row of four with a thicker bezel is enough to walk past it.

The visual tells on a gas pump

Gas pumps are the most-skimmed surface in the US. In a single recent nationwide operation, the Secret Service inspected "approximately 60,000 point-of-sale terminals, gas pumps, and ATMs," removed "411 illegal skimming devices," and ran "22 operations" across cities including Los Angeles, Washington D.C., Boston, Orlando, Atlanta, and Miami.^[2] Gas pumps are the easiest target because they live outdoors, the customer-facing part is a single consumer panel, and most of them are identical from one pump to the next.

The practical checks at a pump:

Wiggle the card reader and keypad. Same principle as the ATM. A factory reader is rigid; an overlay shifts under your fingers.
Compare to the pump next to it. If one pump's reader sticks out further, looks longer, or has a slightly off-color plastic face, that is the skimmed one.
Look for a tamper-evident security sticker. The Secret Service page lists "unusual stickers" as one of the signs that a reader has been opened.^[1] If you can see a sticker across the pump door seam that is torn, missing, or replaced, that is a strong signal not to use the pump.
Check the keypad. A fake keypad sits on top of the real one, so it often feels thicker, spongier, or differently spaced.

The sticker is one of the most useful tells at the pump. A sticker placed over the pump door seam is supposed to break when the door has been opened, and a sticker that is torn, replaced, or missing is the kind of "unusual sticker" the Secret Service flags as a sign of tampering.^[1]

POS terminals at the counter

Point-of-sale terminals at restaurants, pharmacies, and grocery checkouts are the third major surface. The Secret Service describes POS skimmers as overlays "covering the entire top exterior of the terminal, or just the keypad and EMV reader slot," designed to look identical to the original and able to capture "magnetic stripe, EMV chip, and keypad entries (including PINs)."^[1]

The checks are the same as for ATMs and pumps, with one extra rule: at a counter, the operator should be willing to let you handle the terminal. The Secret Service advises consumers to "gently pull up on corners of the terminal or keypad shroud; if loose, do not use it and alert the merchant."^[1] A cashier who refuses to let you touch the terminal is a smaller red flag than a loose bezel, but worth noting.

Shimmers: the visual check you cannot do

A shimmer is a thin circuit board inserted inside the chip-reader slot. It sits between your card's EMV chip and the terminal's contact pins, which is why it is not visible from outside the reader. Shimmers are the reason a visual inspection can give you false confidence.

There is no consumer-level visual tell for a shimmer, because the device lives inside the slot. The practical defenses are behavioral, not visual:

Prefer tap-to-pay. Tap transactions do not enter the slot at all.
Insert and remove slowly. A stiff or gritty feel when inserting or removing a chip card can be a shimmer. If the slot feels wrong, do not complete the transaction.
Run debit as credit at gas pumps. This skips the PIN pad, which is the second half of the data a skimmer needs.

If your bank supports it, virtual card numbers and single-use tokens also break the data path. They cost you nothing at the point of sale and remove the value of the skim.

What Bluetooth tells you, and what it does not

Some ATM and gas-pump skimmers ship with a Bluetooth radio so the criminal can pull the captured card data without re-opening the device. The FBI has documented "Bluetooth-enabled wireless skimmers" and described how this feature "reduces the prospect of criminal capture."^[4] That same radio is the basis for several smartphone "skimmer detector" apps that scan for nearby Bluetooth devices on the frequencies skimmers typically use.

Two honest limits on those apps. First, the FBI description is one variant; not every skimmer has Bluetooth, and a Bluetooth scanner cannot see a non-Bluetooth device. Second, scanning for Bluetooth on a public phone introduces its own risk: many ATMs and pumps run a Bluetooth radio for legitimate hardware (chip readers, contactless readers, payment-terminal telemetry), and a noise floor of unrelated devices makes a positive detection easy to misread. Treat a Bluetooth scanner as a backup signal, not as a primary check, and combine it with the visual tells above.

What to do once you have spotted something suspicious

If a reader fails any of the checks above, the Secret Service and the FDIC converge on the same practical advice.

Walk away. Do not complete the transaction, do not enter your PIN, and do not try to remove or dismantle the device yourself; it is evidence in a federal case.
Tell the operator. For an ATM, tell the bank branch. For a gas pump, tell the attendant. For a POS terminal, tell the merchant and ask them to take the terminal out of service.^[1]
Report it. The Secret Service asks victims and witnesses to report the device to local law enforcement and the agency's field offices.^[1] The FTC accepts consumer reports at ReportFraud.ftc.gov.^[5]
If you used it before noticing: Maximum federal liability for an unauthorized debit-card transaction is $50 "if you notify your bank within two business days after learning of the loss." For credit cards, the Truth in Lending Act caps liability at "$50 for all unauthorized transactions."^[3] Notify your card issuer immediately.

The Bottom Line

A real card reader is rigid, seam-free, and indistinguishable from its peers. A skimmer has a seam, a wiggle, or a thicker face. Run the four checks (wiggle, compare to neighbors, look for the security sticker, look at the keypad) at every reader, and bypass the chip slot entirely by tapping or running debit as credit. If anything looks off, walk away and tell the operator.

How to spot a card skimmer at an ATM or gas pump