I’m aware that card skimmers at ATMs and gas stations are a very real threat. I always pay attention when using a card machine, but to date, I’ve never seen a card skimmer in the flesh. Maybe that’s because they’re way, way sneakier than I’d imagined.
Well-known security researcher Brian Krebs found these videos of ATM skimmers in action. They come from skimmer manufacturers, and are designed to show off their wares.
They’re both “deep insert” skimmers, which is a new and slightly terrifying kind. “Normal” ATM skimmers sit around the card slot, so you can visually inspect the slot to see if it looks strange or abnormal.
Deep insert skimmers are placed further inside the machine, and sit right around the magnetic stripe reader. Thieves have to use a special tool to pull them in and out, so they’re completely undetectable to the average user, even if you’re being vigilant.
There’s nothing you can really do to stop your card data being skimmed, apart from general good practice: use ATMs in well-secured buildings, rather than shady bars. But having your card data swiped isn’t the end of the world: in order to withdraw cash with a cloned card, you also need the PIN.
As Krebs points out, there’s two common ways to steal PINs from ATMs: fake number pads, and hidden cameras overhead. The cameras are much more common, but all you need to do to defeat them is physically cover your hand as you enter the PIN. Even if no-one else is around, it could save your bank account in the long run.