Card Skimmer
PCIComplianceHubLast updated
A physical device fitted to or inside a legitimate card reader to capture and store the data from cards inserted or swiped through it, usually with a camera or false keypad to capture the PIN as well. The transaction it sits on completes normally, which is what lets it go unnoticed.
Applies to. Any entity operating point-of-interaction devices that read cards by physical contact: terminals, ATMs, fuel dispensers and unattended kiosks.
Example. An overlay the same colour as the terminal, glued over the card slot, reads the magnetic stripe as each card passes. Staff who inspect device surfaces against a photograph of the original (9.5.1.2) notice the extra thickness; staff who do not, do not.
Limits. The controls are not anti-skimmer technology; they are an inventory of devices (9.5.1.1), periodic inspection for tampering and substitution (9.5.1.2), and training so that staff verify a technician's identity and recognise a swapped or altered device (9.5.1.3). A device inspected against nothing in particular is not being inspected. Skimming's online counterpart, e-skimming, uses none of this and is governed by 6.4.3 and 11.6.1.