What is Skimming?
A type of cybercrime, 'Skimming', describes how criminals secretly collect sensitive information, usually payment card details, without the victim's knowledge. The stolen information can then be used to make fraudulent purchases, access accounts or create cloned payment cards.
- Home
- Knowledge Base
- What is Skimming?
Although skimming has traditionally been associated with devices attached to cash machines and payment terminals, criminals are increasingly using digital techniques to steal information entered into websites and online shopping forms.
As more financial transactions take place online, understanding how skimming works and recognising the warning signs can help individuals and businesses protect themselves against fraud.
Types of Skimming
The term covers several methods of stealing information, but two major categories are physical skimming and digital skimming.
- Physical Skimming: Involves using a concealed device to capture information from a payment card when it is inserted, tapped or swiped at a compromised terminal. Depending on the equipment used, criminals may also attempt to capture a card's PIN.
- Digital Skimming: Involves malicious software or code designed to collect information entered into a website, particularly during an online checkout. This may include payment card numbers, expiry dates, security codes and billing details.
Both methods aim to obtain valuable information while allowing the transaction or website to appear legitimate.
How Does Skimming Work?
The precise process depends on the type of attack, but most skimming incidents follow a similar pattern.
1. Compromised Payment Point or Website
In a physical attack, criminals may install a concealed device over or inside a cash machine or payment terminal.
In a digital attack, an attacker may exploit a vulnerability, compromise an administrator's account or inject malicious code into a website's payment page.
2. Information Captured Secretly
A physical skimming device may read information stored on a payment card's magnetic stripe. Additional equipment, such as a concealed camera or a fraudulent keypad overlay, may be used to capture a PIN.
Digital skimming code can monitor information entered into a checkout page and transmit the captured data to an external destination controlled by the attacker.
3. Victim Awareness
The compromised machine or website may continue to operate normally. A payment might even be completed successfully, making it difficult for the victim to realise that their information has been stolen.
4. Stolen Information Misused
Criminals may use the information themselves or pass it to other offenders. Depending on what has been captured, it may be used in fraudulent transactions, account attacks or further criminal activity.
Not every skimming attack succeeds and the information obtained may not always be sufficient to carry out a particular type of fraud.
Methods of Skimming
The are several methods which are used by malicious actors and criminals to capture the financial information of victims.
ATM & Cash Machine
ATM skimming occurs when criminals tamper with a cash machine to capture payment card information.
A device may be placed over the card slot or concealed within the machine, while also attempting to record the PIN using a tiny camera or a fake keypad.
The captured information can potentially be used to create a counterfeit card or support other forms of payment fraud.
Warning signs include:
- A card slot that looks loose, damaged or different from the surrounding machine.
- Unusual attachments around the keypad or cash machine.
- Signs that the machine has been tampered with.
- A keypad that feels unusually raised or does not fit properly.
If anything looks suspicious do not use the machine and if possible, report the issue to the bank or operator.
POS or Point of Sale
Targets payment terminals used in shops, restaurants, petrol stations and other retailers or businesses.
Criminals may tamper with a terminal or install a device that captures card information and in some cases, dishonest staff may use a separate device to copy details while handling a customer's card.
Contactless payments and PIN transactions can reduce exposure to certain forms of card copying but they do not eliminate every risk associated with compromised payment systems.
Where possible, keep your card in sight and use trusted payment terminals.
Online Payments
Online skimming, sometimes called e-skimming or web skimming, is a form of digital attack that targets online retailers and payment pages.
Attackers introduce malicious code into a website or compromise an existing script used by the checkout process. The code can then collect payment details as customers enter them.
These attacks can be particularly difficult to detect because the website may look genuine and the checkout may function as expected.
Padlock symbols and HTTPS connections indicate that a connection is encrypted but they do not prove that a website is trustworthy or free from malicious code.
Customers should therefore buy from reputable retailers, keep their browsers updated and monitor payment and banking accounts for suspicious activity.
Other Types of Skimming
Although payment card details are the most familiar target, the term can also be used more broadly for the malicious collection of information entered into online websites and applications.
Depending on the attack, criminals may attempt to collect personal details, login credentials or other sensitive information. Such activity can overlap with phishing, keylogging and other forms of information theft, although these are another type of cyber attack.
Understanding the specific method will matter as the best prevention measures differ, between the various forms of cyber attacks that can take place.
Learn More
In Summary
In cyber security, skimming generally refers to the unauthorised collection of sensitive data, by criminals or malicious actors during a payment or transaction, for the payment details to be used to.
Related Information
If you would like to learn more, you can take a look at the following resources and information from our Knowledge Base.
