With the rise in digital banking and online transactions, the number of automated teller machines (ATMs) worldwide declined to 2.95 million in 2025, according to the finance and crypto resource site CoinLaw. Despite this decline, ATM fraud continues to victimize innocent consumers, with global losses estimated at $2.4 billion in 2025.
Among the ATM-related security issues, card skimming accounted for almost 60% of all reported global ATM fraud cases in 2025, according to CoinLaw. Other ATM-related security threats include malware (21%) and cryptocurrency ATM scams. AI-driven ATM fraud, although still in its infancy (0.11% in 2025), is gaining traction as cybercriminals develop new phishing techniques.
In this guide, we will explore some of the security threats associated with ATMs, with a focus on skimming, and provide tips on protecting your data and money in your bank account.
What is ATM skimming?
ATM skimming is a form of payment card fraud where criminals secretly install illegal devices on card readers, fuel pumps, or point-of-sale terminals, which then steal your debit or credit card information. These devices, called skimmers, capture the magnetic stripe data from your card while hidden cameras or fake PIN pads record your personal identification number. With both pieces of information, criminals can create counterfeit cards or make unauthorized online purchases using your account.
Skimming devices have become increasingly sophisticated and harder to detect. Traditional overlay skimmers sit on top of legitimate card readers, but newer “shimmer” devices are inserted more deeply into the card slot, making them virtually invisible to casual inspection. These devices can store data from hundreds of cards before criminals retrieve them, often using Bluetooth technology to wirelessly download stolen information without physically accessing the skimmer.
ATMs remain the most common target for skimming attacks, but criminals also target gas station fuel pumps, which often have weaker security systems and less frequent maintenance checks. Point-of-sale terminals at retail locations, restaurants, and other businesses also present opportunities for skimming, particularly when employees are involved in the scheme.
The threat persists for several interconnected reasons. Payment card fraud is quite a profitable business and can be scaled across states or countries. Technology gaps also contribute to the problem, as many ATMs and payment terminals continue to use legacy magnetic stripe technology despite the introduction of more secure EMV chips in newer cards. Criminals also exploit legacy systems, especially if the ATM does not receive regular security updates.
Additionally, decommissioned ATMs can be freely gathered from junkyards or casually bought from online marketplaces, giving criminals the chance to collect personal data stored in the computer and study the discarded machine’s security features to improve their skimming techniques.
In some cases, used ATMs are purchased on eBay or Craigslist and then installed in areas with ample foot traffic. These machines, which can be powered by car batteries or simply plugged into a nearby outlet, are programmed to read and copy credit card data.
Consequences of skimming
When your card information is compromised through skimming, the financial and personal consequences can be significant. Criminals may drain your account through ATM withdrawals or fraudulent purchases, potentially leaving you unable to access your own money. Since debit card transactions often clear immediately, unauthorized withdrawals can cause overdraft fees and bounced check charges before you even realize your account has been compromised.
Beyond the financial losses, ATM skimming can lead to identity theft, where the personal information captured becomes part of larger criminal databases used in other fraud schemes.
Consequently, your credit score and banking relationships may also suffer if fraudulent accounts are opened in your name or if you’re unable to resolve unauthorized charges quickly. While the law gives you limited liability for fraudulent transactions, the process of restoring your accounts can be time-consuming and stressful.
Types of ATM skimming devices and how to spot them
Criminals use a range of devices—some obvious, others nearly invisible—to steal card data and PINs right at the machine. Knowing the main types of skimmers, what they look like, and where they’re usually placed can help you recognize them and avoid a compromised ATM.
Overlay card readers
The most common type of skimming device, overlay card readers are fake attachments that criminals place directly over the legitimate card slot of an ATM. As you insert your card, it passes through the skimmer first, which captures the magnetic stripe data from your card before it reaches the actual card reader.
Deep-insert or shimmer devices
An evolution of skimming technology, shimmer devices are extremely thin circuit boards that criminals insert deep into the card slot, making them nearly impossible to detect through visual inspection alone. When you insert your card, you might notice increased resistance, unusual vibrations, or your card feeling momentarily stuck.
Pinhole cameras
Criminals use tiny cameras to capture your PIN as you enter it on the keypad. They are so small they can be hidden in seemingly innocent locations around the ATM. Look for a small camera attached to the top of the screen, hidden in a brochure holder, or even concealed in a fake security sign.
Fake PIN pads
These devices are placed over the legitimate ATM keypad to capture your PIN as you enter it. The keypad may feel spongier than usual, have a different texture, or seem thicker than normal. You might notice the numbers are printed differently, the buttons don’t press down as far as expected, or there’s a slight color difference between the keypad and the rest of the ATM. If the keypad feels loose, raised, or different from other ATMs you’ve used, don’t enter your PIN.
Bluetooth-enabled skimmers
Considered an advanced skimming technique, wireless Bluetooth-enabled skimmers can wirelessly transmit your stolen card and PIN data to criminals, eliminating the need for them to return to retrieve the device. You could detect them by checking your phone’s Bluetooth settings for unusual device names appearing in the area, though many criminals use generic names to avoid detection. If you notice people loitering near ATMs with mobile devices, especially if they seem to be monitoring ATM users, this could indicate that a Bluetooth skimming operation is in progress.
Combination attacks
Criminals often combine multiple types of skimming devices to maximize their data capture. A typical combination attack might involve an overlay card reader paired with a pinhole camera, or a shimmer device combined with a fake PIN pad. This is why security experts recommend following all protective measures when you use an ATM.
Emerging technologies
Recent advances in skimming technologies include devices that can be inserted through existing openings in ATMs without requiring external attachments, as well as skimmers that use near-field communication (NFC) technology to capture contactless payment information.
Protective steps to take before inserting your ATM card
Choose bank-operated ATMs in well-lit areas
Your safest bet is to use ATMs inside bank branches or those clearly operated by major financial institutions. These locations have better security measures, such as surveillance cameras and regular checks that detect tampering. At outdoor ATMs, select machines in well-lit, high-traffic areas where criminal activity is less likely to occur unnoticed. Avoid ATMs in dimly lit, isolated locations where skimmers can be easily installed.
Examine the card slot
Before inserting your card, closely inspect the card insertion slot. Legitimate ATM card readers should have a uniform appearance with smooth edges and consistent coloring. Look for unusual attachments or devices that seem to have been added on top of the original reader. The card slot should align perfectly with the surrounding ATM fascia. Any gaps, misalignments, or signs that something has been glued or attached should raise immediate red flags. Trust your gut.
Perform the wiggle test
One of the most effective ways to detect fake card readers on ATMs is through tactile inspection. Gently grasp the card reader and try to wiggle it. A legitimate card reader should feel solid and permanently attached. If the reader or the housing feels loose, this is a strong indicator of a skimmer. If anything moves when it shouldn’t, do not use that ATM and report it to the bank immediately.
Inspect the keypad
Examine the keypad carefully for any signs of modification or overlay devices. Overlay keypads often appear slightly thicker or misaligned with the surrounding area. When pressing the buttons, each one should have consistent resistance and feel. Any button that sticks or seems higher than others could indicate tampering. Pay attention to the area around the keypad for adhesive residue or scratches. Legitimate ATM keypads have consistent button spacing, uniform coloring, and should feel solid when pressed.
Check the ATM’s fascia and bezel
The ATM’s outer casing and bezel should have a uniform appearance with no obvious modifications such as loose panels, extra pieces of plastic, or areas with different coloring or texture from the rest of the machine. Check for any unusual wiring, small cameras, or devices that appear out of place. The area around the screen should be examined for any tiny cameras or recording devices that capture PIN entry. All text, logos, and branding should appear professional and consistent with the bank’s standard ATM design.
Survey the surrounding area
Before using any ATM, check the area for any unusual objects that could house cameras or recording equipment, including fake brochure holders, unusual signage, or any items that seem out of place. Check for people loitering nearby who seem to be watching ATM users or vehicles parked unusually close to outdoor ATMs with passengers or drivers who appear to be monitoring ATM activity.
Scan for Bluetooth devices
Before using an ATM, check your smartphone’s Bluetooth settings to scan for nearby devices with suspicious names, such as those with generic or random characters, or names that don’t correspond to legitimate businesses in the area. An unusual concentration of unknown devices near an ATM could be a warning sign. This technique works best in areas where there are typically few Bluetooth devices, such as standalone ATMs.
ATM safety tips
Enable and use contactless withdrawal
Enable contactless withdrawals through your bank’s mobile app to authenticate and authorize QR code-based transactions and reduce your need to use an ATM. This technology uses tap-to-pay functionality or near-field communication (NFC) features, providing the same convenient access to your funds. Contact your bank to learn about contactless ATM options and how to activate these features on your accounts.
Verify ATM authenticity through official channels
Bank websites or mobile apps usually show the locations of their legitimate ATMs. If you’re unsure about an ATM’s authenticity, check these official resources to confirm the machine is listed as a legitimate location. This step can help you avoid both skimming devices and other fraudulent ATM operations entirely. Be particularly cautious of ATMs in unusual areas. When traveling, stick to ATMs inside recognizable financial institutions.
Shield your PIN entry
Even when ATMs appear legitimate, always protect your PIN entry from potential observation. Use your free hand, body, or a purse to cover the keypad while entering your PIN to guard against both hidden cameras and shoulder-surfing by nearby criminals. Consider changing your PIN regularly and never write it down. If you suspect your PIN may have been compromised, change it immediately through secure channels.
Monitor your account activity vigilantly
Implement robust account monitoring to detect and address any skimming-related fraud as quickly as possible. Set up real-time account alerts through your bank’s mobile app to receive immediate notifications of all transactions. Review your account statements regularly and report any unauthorized activity immediately. Consider setting daily withdrawal limits to match your usage patterns to minimize losses if your card information is compromised.
Report suspicious ATMs immediately
If you notice signs of tampering or suspicious activity at an ATM, report it immediately to the bank to protect other customers from becoming victims and to help law enforcement track down the perpetrators. Contact the bank’s customer service line using the phone number on the back of your card, rather than the numbers displayed on the potentially compromised ATM. Document the ATM’s location, including the address and any identifying numbers or codes visible on the machine.
Stay informed about ATM fraud trends
Stay informed about the latest ATM skimming techniques and prevention strategies through reputable sources. Consumer alerts provide updated guidance on protecting yourself from these crimes, as do major credit card networks such as Visa and Mastercard. Following your bank’s security updates and fraud alerts helps you stay aware of new threats in your area and emerging criminal techniques to watch for during ATM transactions.
Avoid assistance from strangers
Be highly cautious of anyone offering to help you with ATM troubles, even if they appear well-intentioned, especially if they suggest using their phone to call the bank or offer to show you how to complete your transaction. If you encounter problems with an ATM, cancel your transaction, retrieve your card, and contact your bank directly.
Use ATMs during daylight or banking business hours
Criminals usually install skimming devices when fewer people are around to witness their actions. Daytime transactions in high-traffic areas increase the likelihood of suspicious behavior being noticed and reported. If you must use an ATM at night, choose one in a well-lit area with good visibility, preferably near businesses that are still open and have staff and customers present. Consider using indoor ATMs exclusively.
Keep your ATM receipts secure
Always take your ATM receipts and store them securely until you have verified the transaction on your statement. Don’t leave them at the machine or throw them away in nearby trash cans where criminals might retrieve them to gather information about your account; even partial account numbers and transaction details could be useful to identity thieves. You can shred the receipts once you’ve confirmed the transactions.
Understand your rights and protections
Familiarize yourself with your bank’s policies regarding ATM fraud and your rights under federal law. The Electronic Fund Transfer Act provides specific protections for consumers who experience unauthorized ATM transactions. These protections offer you up to 60 days to report unauthorized transactions to limit your liability, but reporting within two business days provides the strongest protection.
Plan your cash needs in advance
Reduce your ATM usage by planning your cash needs and making larger, less frequent withdrawals to reduce your overall exposure to potential skimming attempts. Consider getting cash back during purchases at grocery stores, pharmacies, and trusted retailers, rather than using unfamiliar ATMs, especially when traveling or in unfamiliar areas.
Be extra vigilant during the holiday season
ATM skimming attempts surge during peak shopping and travel periods when foot traffic increases at malls, airports, hotel lobbies, and other commercial or tourist locations. Increased cash withdrawals, crowded shopping areas, and travelers using unfamiliar ATMs create ideal conditions for skimming operations. In addition, criminals know that holiday shoppers are often distracted, rushed, and less vigilant about using ATMs. That’s why it’s important for you to be extra cautious. If you must use an ATM, take a breath and slow down to thoroughly inspect the machine and your surroundings before inserting your card.
Immediate steps to take if your card was skimmed
The guidance below walks you through exactly what to do in the moment and right after, so you can limit risk to yourself and prevent others from becoming victims, too.
- Contact your bank immediately. Call the number on the back of your card or use your bank’s mobile app to report unauthorized transactions. Most banks have 24/7 fraud hotlines that can freeze your account within minutes to prevent further unauthorized use.
- Dispute unauthorized charges promptly. Your liability protections depend on how quickly you report fraud. For credit cards, federal law limits your liability to $50 for unauthorized charges. For debit cards, report any unauthorized transactions within two business days to limit liability to $50, or within 60 days to cap liability at $500. After 60 days, you could be responsible for all unauthorized transactions.
- Request a replacement card. Your bank will cancel your compromised card and issue a new one with different numbers. Most banks can expedite delivery within 1-2 business days, though some may charge a fee for rush delivery. Ask about temporary digital cards for immediate online use while waiting for your physical card.
- Inform your ID Theft protection provider. If you have an identity theft protection subscription, inform your service to activate proactive identity surveillance, monitor your credit and personal information, and seek support from fraud resolution agents who can work through the process of resolving the identity theft issues.
- Place a fraud alert on your credit reports. Contact one of the three major credit bureaus—Experian, Equifax, or TransUnion—to place a free fraud alert. This alert requires creditors to verify your identity before opening new accounts and automatically applies to all three bureaus for one year.
- Consider a credit freeze for enhanced protection. A credit freeze prevents new creditors from accessing your credit report and identity thieves from opening accounts in your name. You can freeze and unfreeze your credit for free with all three bureaus online, by phone, or by mail.
- Monitor your accounts closely. Review all bank and credit card statements for the next few months. Set up account alerts for transactions over a certain amount, and consider using your bank’s mobile app to check account activity daily during this period.
- File additional reports if identity theft occurs. If criminals used your card information for identity theft beyond just card fraud, file a report with the Federal Trade Commission and consider filing a police report. The FTC provides a personalized recovery plan and pre-filled forms for creditors.
- Update automatic payments. Replace your old card information with your new card details for any automatic payments, subscriptions, or saved payment methods with online retailers to avoid service interruptions.
- Keep detailed records. Document all communications with your bank, including dates, times, representative names, and reference numbers. Save copies of dispute forms and any correspondence related to the fraud investigation.
Final thoughts
Protecting yourself from ATM skimming requires ongoing attention, but you’re now equipped with the knowledge to use ATMs confidently and securely—perform a visual inspection, do the wiggle test, review the keypad, and be aware of your surroundings. Trust your instincts. If something feels wrong or looks suspicious about an ATM, consider finding an alternative location. Your intuition is a valuable tool in recognizing potentially compromised machines.
Share these ATM safety practices with your family members and friends to strengthen their security as well. Take a moment to revisit your bank’s fraud protection guidelines and ensure you understand their notification procedures for suspicious activity. Your financial institution can partner with you in preventing fraud, so don’t hesitate to reach out with questions about their latest security features.
Stay Updated
Follow us to stay updated on all things McAfee and on top of the latest consumer and mobile security threats.
