Criminals Using Shimming, New Form of Card Skimming, to Steal Info from Chip Cards

They can clone a mag stripe card that will defraud banks and merchants not paying close attention

Criminals Using Shimming, New Form of Card Skimming, to Steal Info from Chip Cards
Image: Pixabay
May 11, 2017

Remember all the hubbub surrounding the chip card when it first came out? Everyone was talking about how much safer it was than the old cards and how it would baffle criminals trying to steal credit card information.

Bad news: the criminals have caught up with technology.

Before the chip card, the bad guys would do something known as card skimming. They would attach fake fronts to outdoor ATMs and other point-of-sale terminals in order to "skim" your card's information off its magnetic strip. Then they would make a clone of your card and, before you know it, rack up hundreds or thousands of dollars of fraudulent charges.

Now, they put something called a shimmer into the card slot. A shimmer is a paper-thin shim the size of a card that contains flash storage and an embedded microchip. You can't see it from the outside of the terminal, and it takes data from your card's chip.

Card chip technology prevents scammers from being able to use this information to make a clone of an actual chip card. However, they can create a traditional card with only the mag stripe, and they use these to defraud merchants and banks not paying close enough attention to their card security protocols.

Shimmers are even more effective than skimmers were. Why? Because of their size and (lack of) thickness, they can be inserted with ease into terminals located in indoor retailers. When the scammers come by to get the shim, they look like they're simply paying at the terminal, just like anyone else.

So what is the consumer to do?

How to Protect Your Information from Shimmers

  1. Use your card's tap-and-go feature rather than swiping or inserting it into the terminal.
  2. Use a digital wallet like Samsung Pay or Apple Pay.
  3. Use banks inside ATMs rather than standalones.
  4. If you're withdrawing cash, use the services of a teller.
  5. When you enter your PIN number, cover up the keypad with your hand.
  6. If your card encounters resistance when inserted in a terminal, don't go through with the transaction.
  7. If you believe your card has been compromised, contact your bank, card issuer, and the merchant.