In this article:
In years past, scammers commonly used card skimming devices to steal information like your card number from your card's magnetic stripe. But that threat was largely thwarted when EMV chip cards became more common in 2015 and made it harder for thieves to duplicate your credit card.
Fast forward to 2026, and fraudsters have found a way to shimmy around EMV chip protection. Credit card shimming is a relatively new method where criminals attach hidden electronic devices to card readers to steal data from a card's microchip. Here's what you need to know.
What Is Credit Card Shimming?
Credit card shimming is when thieves steal information from your credit or debit card's chip as you use it at an ATM or a checkout card reader. When you insert your card, a hidden device called a shim can copy information from its chip. Thieves can then use that information to make a counterfeit card. Essentially, shimming is the updated version of skimming, but the device copies information from your card's chip instead of its magnetic stripe.
Many newer devices can send stolen card information over Bluetooth. This allows thieves to collect the data from nearby without having to return to the card reader and risk getting caught.
Note: Fraudsters can't create a counterfeit chip card from shimmed chip data. Instead, they store it on a counterfeit magnetic stripe card, and use it at terminals and ATMs that still accept card swipes.
Where Are Shimming Devices Found?
Shimming devices can be found anywhere you insert a chip card, often in locations where thieves can operate without being noticed.
- ATMs: These machines are a common choice for thieves because of their high use and because they're often unmonitored.
- Point-of-sale (POS) terminals: Thieves also target card readers at grocery stores and other retail stores where they can distract a clerk and place a shimming device into the card reader in a few seconds.
- Gas pumps: Fraudsters also install shimming devices inside fuel pumps, especially those that are dimly lit and hard for the attendant to see. These shimmers can capture data from hundreds or even thousands of cards due to the pump's high use.
- Vending machines, parking meters and self-service kiosks: These machines are typically unattended, so scammers can install skimming and shimming devices with less risk of being caught.
Learn more: What Is Card Skimming?
Shimming vs. Skimming
While shimming and skimming are similar versions of an old scam, there are some key differences between them. Skimming targets the magnetic stripe on the back of your card. Fraudsters attach a small device over or inside the card reader, and it records your card data each time you swipe. At ATMs, skimmers typically have a hidden camera aimed at the keypad or a fake keypad that records your PIN as you type it.
For its part, shimming is a newer tactic fraudsters employed after banks added microchips to cards to stop skimming. Now when you insert your debit or credit card, a thin shimmer installed inside the reader copies the data from the chip instead of the stripe. The device is set deep in the machine, so it's much harder to detect. Shimmers hidden in overlays on store checkout terminals can even capture your PIN as you type it.
| Shimming | Skimming | |
|---|---|---|
| What it targets | Debit and credit card EMV chip data | Debit and credit card magnetic stripe data |
| Sophistication level | Highly sophisticated | Less advanced |
| Detection difficulty | Ultra-thin and hard to detect; some transmit stolen data via Bluetooth | Bulkier devices; external devices easier to detect |
How to Protect Yourself From Shimming
Here are five proactive steps you can take to help protect yourself from shimming:
- Use contactless payments. Take advantage of contactless payment methods like Apple Pay or Google Pay that use a one-time code for security to help prevent fraud.
- Pay inside. At gas stations, pay for your fill-up inside the station rather than at the pump.
- Use bank-owned ATMs. Try to use a bank-owned ATM rather than a nonbank ATM you might find at convenience stores or other retail outlets. Nonbank ATMs may not be as secure as ATMs operated by financial institutions.
- Look for a safer ATM. Scammers tend to install shimming devices in ATMs in poorly lit, less public places. The Federal Deposit Insurance Corp. (FDIC) advises consumers to choose ATMs where security cameras and other people are nearby.
- Watch the card slot. Pay attention to how easily your card fits into a card reader slot. If it's difficult to slide your card into the slot, don't force it. Cancel the transaction and notify the bank or business that a shimming device may be inside the terminal.
What to Do if You're a Victim of Credit Card Shimming
If you suspect you've been a victim of shimming, act quickly.
1. Contact the Card Issuer Right Away
As soon as you're aware that your credit or debit card has been shimmed, reach out to your card issuer or bank to cancel the card and get a replacement. It's also a good idea to change your debit card's PIN to be safe.
Check your statement because it likely gives guidelines on how to report fraudulent charges or dispute a bill. If you have an idea where your card might have been shimmed, notify the business or ATM operator so they can check for a shimming device.
2. Set Up Fraud Alerts
You have the right to request a free fraud alert through Experian or the two other major credit bureaus (TransUnion and Equifax). A fraud alert tells creditors to verify your identity before approving new credit in your name.
You only need to set up a fraud alert at one of the three major credit bureaus, and that bureau must notify the other two bureaus. You can do so quickly and easily through the Experian Fraud Alert Center or the Experian app. Sign in to your Experian account or create one if you don't have one. Choose the type of fraud alert and follow the prompts to finish the process.
Learn more: How to Place a Fraud Alert
3. Keep an Eye on Your Accounts
Review your credit card and bank statements to see if any suspicious transactions show up. Look for purchases and withdrawals you don't recognize, which could even be from out of your area. Keep checking your accounts even if everything appears clear for now because bad actors may not use your information right away.
Be aware: Tiny charges may be a red flag for fraud. Thieves often run small test charges to see if stolen credit card information works before racking up larger charges.
Also activate account alerts in your account's online dashboard or app so you can catch any suspicious activity early. Consider getting free credit monitoring from Experian to receive alerts about new accounts, hard inquiries and credit report changes.
4. File a Report With the Federal Trade Commission (FTC)
Visit the FTC's IdentityTheft.gov website to submit a report about the fraud. You'll get an FTC Identity Theft Report, which can help you prove the fraud to businesses and resolve any problems resulting from it.
You should also receive a personalized recovery plan based on the information you provided in your report. The plan gives you a step-by-step guide tailored to your situation and includes prefilled forms and letters you'll need to help you clear up issues stemming from the fraud.
5. File a Police Report
Consider filing a police report to see if the police can help you track down who stole your debit card or credit card information. They may not be able to help if the perpetrators live in another country or if there's little evidence. Even so, filing a report may be worthwhile because some banks or credit card companies may require a copy before conducting their own fraud investigation.
Frequently Asked Questions
Can You See Shimming Devices?
Typically, you can't really see when a device is tucked inside an ATM or point-of-sale terminal unless you take apart the machine and look for a shimming device. The super-thin shimming device is positioned inside the machine's card reader slot and is designed to be undetectable to anyone using the terminal. Once the device has shimmed data from unsuspecting cardholders, the fraudster may pull the shim out of the machine to retrieve the stolen data.
Whenever you insert your card, look for signs of tampering, such as a card reader that looks damaged or a tight card slot.
How Common Is Credit Card Shimming?
Shimming was initially uncommon compared to skimming, as EMV chips on credit and debit cards largely thwarted scammers' efforts. Now that criminals have figured out how to steal data from these chips using shimming devices, this form of credit card fraud is a growing problem. Fraud from shimming and skimming now combines to cost U.S. consumers and financial institutions over $1 billion each year.
The Bottom Line
Scammers are always looking for a way to make a quick buck. One of their favorite methods is credit card shimming. By installing a shimming device at a gas pump, for instance, a thief can steal data from a card's microchip and then create a fake card. If you think your card was shimmed, take action as quickly as possible to help protect yourself from losing money.
Along with contacting your card issuer or bank, consider freezing your credit. You have the right to place a free security freeze on your Experian credit report. A security freeze helps limit the access lenders and creditors have to check your credit report when someone applies for credit in your name. To protect each of your credit reports, freeze your credit at all three credit bureaus.