Credit card skimmers are scarily-small devices that thieves attach to credit card readers, capturing the magnetic strip data and allowing clones of cards to be made. These days, they’re so phenominally small that they can be fit inside devices, making them nearly impossible to spot.
Luckily, security researcher Brian Krebs found a guide from credit card terminal manufacturer Ingenico, teaching retailers how to spot skimmers in the wild.
The guide details one particular kind of overlay for Ingenico iSC250 card terminals, which are most popular in self-checkout lanes, slowly creeping into stores nationwide. It looks legit in most aspects, but because it’s an overlay, it is noticeably bigger than the regular terminal.
“In order for the overlay to fit atop the POS [point-of-sale] terminal, it must be longer and wider than the target device,” says an Ingenico security bulletin. “For this reason, the case overlay will appear noticeably larger than the actual POS terminal. This is the primary identifying characteristic of the skimming device. A skimmer overlay of the iSC250 is over 6 inches wide and 7 inches tall while the iSC250 itself is 5 9/16 inch wide and 6 1⁄2 inches tall.”
There’s barely half an inch in it either way, but if you look closely at the red bars on the top image, you can see the difference.
Luckily, there’s also an easier way to spot the fakes. The overlay that catches people’s PIN also prevents the backlight coming through the pin pad. The final indicator is the stylus tray. Although people don’t seem to bother putting the stylus back, the overlay blocks the place that the stylus normally sits.
So, if you can’t see a light behind the numbers or a stylus tray, you should think twice before swiping your card — and maybe go inform a cashier.