Skimming

Card skimming involves installing a hidden device over a legitimate card reader to capture the data stored on a payment card's magnetic stripe. A small camera or overlay keyboard is often added simultaneously to capture the PIN.

Once the card data is cloned, fraudsters can create counterfeit cards for use in regions that still rely on magnetic stripe transactions, or sell the raw data for use in card-not-present fraud online.

Modern EMV chip cards are harder — though not impossible — to clone, because the chip generates a unique transaction code each time. However, many skimmer operations now focus on the online environment through 'web skimming' (injecting malicious code into checkout pages), also known as a Magecart attack.

Signs of a physical skimmer include card readers that feel loose, sticky, or are a different colour to surrounding fixtures.