Skimming data breach: what it is and how to spot it

Skimming means copying your card details at the moment you use your card, without you or the business noticing. There are two common forms.

Physical skimming

A criminal fits a device to a cash machine or card reader that captures the card data as you insert or tap your card. Action Fraud, the UK's fraud reporting centre, describes fraudsters modifying genuine PIN entry devices and capturing the details as you withdraw cash, then using them to take money from your account in shops, online or at cash machines. The PIN is often caught with a hidden camera or by someone watching over your shoulder.

Online (web) skimming

Here the attacker doesn't touch a card reader. They break into a shop's website and add code to the payment page, so that a copy of whatever customers type is sent to a server the attacker controls. The customer still completes the purchase as normal, which is why it can go unnoticed for weeks.

The best-known UK case is British Airways. The ICO's penalty notice of 16 October 2020 sets a fine of £20m. It says the attack ran from 22 June to 5 September 2018, that payment details typed into the airline's site were copied to a lookalike domain, and that the personal data of approximately 429,612 people was potentially accessed. A third party alerted the airline on 5 September 2018.

Why it counts as a data breach

When a business's checkout is compromised, card numbers and customer details leave its control. Under UK GDPR that is a personal data breach the business must deal with and, where required, report to the ICO. For you it means your card details can be used by someone else, even though you did nothing wrong.

Skimming vs. phishing

Phishing tricks you into handing over details yourself, usually through a fake message or website. Skimming steals them from a real card reader or a real shop, so there is nothing for you to spot as fake.

How to protect yourself

Check the machine before you use it

Look at the card slot and keypad. If anything looks loose, bulky or tampered with, don't use it and tell the bank. Cover the keypad with your hand when you type your PIN.

Check your statements often

Skimmed details are usually used within days or weeks. Turn on transaction alerts in your banking app so an unfamiliar payment reaches you quickly.

Report fraud to your bank at once

If you see a payment you didn't make, call your card provider straight away so the card can be blocked and replaced. You can also report it to Action Fraud.

Use a card, not a debit card, for online shopping where you can

Credit cards and payment services such as Apple Pay or Google Pay add a layer between the shop and your card number. Ask your bank about its own protections.

Find out where else your details are exposed

Stolen card details often come with your name, address and phone number. Serus finds where your personal info is listed online and removes it where it can be taken down, and monitors breach databases for your data.

Frequently asked

How do I know if my card has been skimmed?

Usually you see a payment you don't recognise on your statement or in your banking app. Small test payments are common first. Report anything unfamiliar to your bank right away.

Can a card be skimmed when I tap it?

Skimmers mainly target the card data read when you insert a card or swipe it, and the PIN you type. Fraud on a card number can also come from a hacked online shop, where no reader is involved at all.

Who is responsible when a website is skimmed?

The business running the site is responsible for securing its checkout and, under UK GDPR, for handling the breach. In the British Airways case the ICO fined the airline £20m.

What is a skimming data breach?