Shimming

Shimming is an evolution of card skimming designed to defeat EMV (chip-and-PIN) cards. A 'shim' is a paper-thin device — sometimes thinner than a business card — that sits between the card's chip and the reader's contacts. When a chip card is inserted, the shim reads and records the chip data transmitted during the handshake.

Although EMV chips generate a unique cryptogram for each transaction that cannot be reused for chip-on-chip payments, shimmers capture the magnetic stripe equivalent data broadcast by the chip. Fraudsters use this data to create cloned magnetic-stripe cards, which can then be used at terminals or ATMs that fall back to magstripe processing — typically in regions with lower EMV adoption.

Shims are extremely difficult to detect visually because they fit entirely inside the card slot. Consumers can reduce risk by using contactless payment (tap-to-pay) wherever possible, monitoring accounts for unexplained small transactions, and preferring well-lit, high-traffic ATMs.