Card skimmers: how to check your reader

A card skimmer is a device criminals attach to or slip inside a card reader to copy card data. Card skimmer detection at a small store comes down to knowing what your reader normally looks like and checking it every day. It takes less than a minute, and it's one of the most practical fraud habits a store can build.

Plenty of owners assume skimmers only show up at gas pumps and ATMs. That's where they're most common, but countertop readers aren't immune.

What does a skimmer actually look like?

Skimmers come in a few forms.

Overlays sit on top of the reader. They might cover the card slot, the keypad, or the whole face of the device. Good ones are made to look like part of the reader.

Inserts, sometimes called shimmers, slide into the card slot. They're thin and hard to see from the outside.

Swapped devices are the boldest. Someone replaces your whole reader with a look-alike that captures data.

Hidden cameras sometimes go with skimmers to capture PINs. They might be tucked into a display near the register.

Chip and tap make stolen data harder to use. The EMV standard creates a unique code for each chip or contactless transaction, so copied data can't easily be replayed. Swipe data is easier to copy, which is one reason to dip or tap instead.

How do you check your reader?

Build a quick daily check into opening. Here's a simple one.

1. Look at the reader from the customer's side. Does anything look different, thicker, or loose?
2. Wiggle the card slot area and keypad gently. Nothing should move or come off.
3. Check the seams. Look for glue, tape, or scratches that weren't there yesterday.
4. Compare the serial number on the back or bottom with your records. A different number means a different device.
5. Look around the reader for anything new, like a small camera or an unfamiliar display.
6. Check any tamper seals or stickers, if your device has them.

Take a photo of your reader, front and back, and keep it on your phone. When you're not sure if something looks different, compare.

Where are the weak spots at a counter?

The biggest weak spot is time. A reader left unwatched, especially one near the door or at the edge of the counter, gives someone a chance.

Keep your reader in view of the cashier at all times.

Don't leave it unattended during slow periods.

Be careful with anyone who says they're a technician and wants to service or swap your reader. Ask for proof and call your processor using a number you already have to confirm the visit.

At closing, store handheld readers somewhere secure.

Honestly, the fake-technician trick works because people want to be helpful. A quick phone call to your processor is all it takes to shut it down.

What if you find something suspicious?

Stop using the reader.

Don't remove the device yourself if you can avoid it. Take photos first.

Contact your processor right away. NRS Pay has live support seven days a week.

Contact your local police. A skimmer is evidence.

Keep a record of when you last checked the reader and found nothing, and when you found the problem. That time window helps your processor and the banks figure out which cards might be affected.

For general guidance on protecting business data, the FTC has resources on privacy and security for businesses. And if you need a replacement reader, see NRS Pay equipment or talk to the NRS Pay team.