Chip-Shimming Scam

Chip shimming is the successor to card skimming, built for chip cards. A shim is a paper-thin flexible circuit board that a criminal slides inside the card slot of an ATM or payment terminal, where it sits invisibly between your card's chip and the machine's reading contacts. Every time someone inserts a chip card, the shim silently records the data that passes between the chip and the machine. Because the device is inside the slot rather than stuck on the outside, there is usually nothing to see and the machine works normally. Chip cards were designed to defeat cloning, and a shim cannot produce a perfect copy of a chip. What it can capture is often enough to create a working magnetic-stripe version of your card or to fuel online purchases in your name. Shimming matters because many people believe chip cards ended this type of theft, and that confidence is exactly what the technique exploits.

A criminal loads the shim into a card-shaped carrier, inserts it into the target machine like a normal card, and leaves the shim lodged against the reader's contacts — the whole operation takes seconds and needs no tools. From then on the shim eavesdrops on every chip transaction the machine processes, storing card numbers, expiry dates, and other data exchanged during authorisation. The criminal returns later with another carrier card to retrieve the device, or in more advanced setups collects the data wirelessly. The harvested data cannot clone a new chip, but it can be written onto a magnetic stripe. Those counterfeit stripe cards work at machines that still accept stripe transactions or fall back to swiping when a chip fails — a fallback some banks and terminals handle less strictly than they should. The data also feeds card-not-present fraud, where the number, expiry, and name are used for online spending. As with skimming, your own transaction completes normally, so the first sign of trouble is usually an unfamiliar charge days or weeks later.

Shimming defeats the checks people have learned to make. Advice about skimming says to look for bulky attachments, loose slots, and hidden cameras — but a shim lives inside the reader, so even a careful inspection finds nothing. Chip cards are also widely described as impossible to clone, which leads both cardholders and staff to assume insert transactions are safe. The transaction itself succeeds, giving no warning. Finally, the gap between capture and use works in the criminals' favour: by the time fraudulent charges surface, you have used your card in dozens of places and have no way to identify the compromised machine.

'The chip reader is temperamental today — push your card in firmly and hold it there.'

'Tap isn't working on this one, you'll have to insert your card.'

A self-service kiosk fails your chip twice, then invites you to swipe the magnetic stripe instead

You cannot reliably see a shim, so shift your habits instead. Pay attention to how the card enters the slot: unusual resistance, scraping, or a tight grip on the card can indicate something lodged inside, and if insertion feels wrong, cancel and use another machine. Prefer contactless payment or a mobile wallet whenever available — a tap never touches the chip contacts, so a shim learns nothing. Be wary of any machine or attendant that insists you insert when tap normally works. Use ATMs inside bank branches, turn on instant transaction alerts, and treat any prompt to swipe the stripe after a failed chip read as a reason to stop.