Skimmers and tampered terminals: a five-minute inspection routine
A skimmer is a device attached to or inside a card reader that copies card data as customers pay. At a small store it arrives one of three ways: an overlay pressed onto the front of your terminal, an internal tap fitted while nobody was watching, or an entire terminal swapped for a compromised one. All three are physical crimes with physical evidence, which means a person can find them without any technical skill at all.
What defeats them is not equipment. It is the habit of looking.
What does a tampered terminal actually look like?
Something slightly wrong. An overlay sits a fraction proud of the housing, so the keypad feels spongy or the card slot is a shade deeper than it was. Seams that were flush show a line. A screw that was flat sits raised. There is glue where there was none, or a label that does not sit quite square.
The single most reliable tell is weight and give. Overlays are hollow. A keypad that gives more than it used to, or a card slot with a millimetre of play, is worth a second look even when nothing looks wrong.
How do you run the check?
Pick a fixed time — the Monday opening shift works — and go through five points in order. Lift the terminal and look at the underside and the cable entry. Run a thumbnail along every seam. Press each corner of the keypad. Compare the card slot to a photograph you took of the terminal when it was new. Check the security labels if your device carries them.
That photograph is the trick that makes the rest work. Memory is a poor baseline and a good photo is a perfect one. Take one of every terminal today, from four angles, and keep it where the opening cashier can pull it up.
What is the security seal on the device for?
Payment terminals are built and certified to resist physical attack, and part of that certification covers tamper evidence — seals, meshes and internal switches that respond to the case being opened. The certification programme is run by the PCI Security Standards Council, and it is the reason a modern terminal is a hard target internally.
The corollary is that the easy attacks are external and social. Nobody picks the lock on a certified device when they can glue something to the front of it, or walk in wearing a polo shirt and say they are here to swap the unit.
Who is allowed to touch your terminal?
That is the control that matters most, and it costs nothing. No technician takes a terminal without a scheduled appointment that you arranged, with a name you recognise, confirmed by a call to a number you already had. Not a number on their paperwork.
Terminal-swap fraud works because it is polite, plausible and time-pressured. A cashier alone at two in the afternoon does not want to be difficult. Give them a rule instead of a judgment: nobody touches the counter hardware without the owner on the phone.
What do you do if you find something?
Stop using the device, do not try to remove the attachment, and photograph it where it sits. Call your provider and the police. Preserve the transaction log, because the window of exposure is what determines who has to be notified.
Resist the urge to quietly swap the terminal and move on. Compromised card data from your counter becomes fraud somewhere else, and the record of when you found it is what separates a store that was attacked from a store that looks like it was involved.
Frequently asked questions
Are chip and contactless transactions safe from skimmers?
Safer, because chip and tap data is not static and cannot simply be replayed on a cloned card. Overlays still target the keypad to capture PINs, and the magnetic stripe on the back of the same card remains copyable. Chip acceptance narrows the attack; it does not remove it.
Can a skimmer be inside the terminal where I cannot see it?
It is possible but much harder, which is what the tamper-resistant design is for. The practical risk for a counter terminal is overlays and swaps. Internal attacks are more common on unattended devices like fuel dispensers and standalone ATMs.
How often should we inspect?
Weekly for counter terminals, and every opening shift for anything unattended or customer-facing in a low-visibility spot. The frequency matters less than the consistency, because the value comes from noticing a change rather than from any single inspection.
Does a camera over the register help?
Yes, both as deterrence and as evidence, but only if it actually covers the terminal rather than the general area. A camera aimed at the aisle behind the counter will show you that somebody stood there. It will not show you what they did with their hands.
What about the customer-facing PIN pad on a cord?
That is the highest-risk device on most counters, because it is handled, moved, and out of the cashier's direct sight while customers use it. It deserves the same inspection as the terminal and a look at its cable, which is where a tap would be fitted.
Should I train part-time staff on this?
Train them to notice and to escalate, not to investigate. "If anything about the terminal looks or feels different, stop and call me" is the whole instruction. Asking a part-timer to judge whether a seam is suspicious sets them up to talk themselves out of it.