Credit card skimming is the capture of payment card data from a card, card reader, or payment page without the cardholder’s knowledge. Attackers use physical devices on terminals or malicious code in checkout flows to steal track data, card numbers, expiry dates, and sometimes verification values for later fraud.
How Credit Card Skimming Works
Credit card skimming is a capture-and-exfiltration problem. The attacker intercepts card data at the point of entry or presentation, then preserves enough payment information to reuse it for fraud, card testing, or counterfeit activity.
In physical settings, skimmers are usually hidden overlays, swapped reader parts, or compromised terminals that read magnetic stripe or card details before the legitimate transaction completes. In online settings, malicious checkout code can capture cardholder input directly from the browser or payment form, often without changing the user experience.
Why Skimming Is Dangerous
Skimming is dangerous because the stolen data is immediately monetisable and often hard for the victim to notice until unauthorised transactions appear. Card data can be combined with other personal details to support broader fraud, and stolen payment data may be sold quickly for repeated abuse.
Unlike some attacks that only disrupt service, skimming converts a normal payment event into a data theft event. The exposure is especially serious when the attacker captures track data, because that information can support more flexible downstream fraud than a simple card number alone.
Where Skimming Happens
Skimming appears in two main environments: physical payment infrastructure and web-based checkout flows. In person, weak physical inspection, poor tamper detection, or unattended terminals create opportunities for device theft and substitution. Online, compromised scripts, malicious third-party tags, and checkout injection can turn a legitimate site into a collection point for payment data.
That is why payment security depends on both the terminal or browser boundary and the broader trust chain around it. A store or website can have strong branding and still be exposed if the input path is manipulated before the payment processor receives the transaction.
What Good Defences Focus On
Effective defence starts with reducing where card data is exposed at all. Organisations should prefer payment methods and architectures that minimise direct card handling, isolate payment pages and terminals from unrelated systems, and monitor checkout code, devices, and vendor changes for unexpected modification.
For consumers and merchants, safer payment choices and clear reporting paths matter too. NHIMG’s Safe Online Shopping Guide and Payment Fraud Guide both reinforce the point that fraud resistance improves when card exposure is limited and payment flows are monitored for suspicious change.
When skimming is suspected, the response is not just to remove the device or malicious code, but also to review the rest of the payment path for related compromise. Stolen card data may indicate that the same system also exposed credentials, admin access, or other sensitive payment infrastructure components.
Risk and Threat Considerations
Skimming creates a direct confidentiality risk because the attacker is stealing payment data at the moment of capture, often before normal logging or antifraud controls can see anything unusual. In physical and online form alike, the same quiet capture method makes the attack attractive for repeated fraud and resale.
Failure mechanism: The attacker places a hardware overlay, swaps a reader component, or injects malicious checkout code so that payment data is copied before the legitimate transaction path can protect it.
Impact: The result can include card-present fraud, card-not-present misuse, chargebacks, customer trust damage, and the need to investigate whether the payment environment was also altered or backdoored.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8, NIST CSF 2.0, OWASP ASVS and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1056 — Input Capture | Skimming captures payment data from user input paths or devices. |
| Recommendation — Map checkout or terminal capture activity to input-capture techniques and hunt for tampered entry points. | ||
| CIS Controls v8 | CIS-5 — Account Management | Skimming often leads to fraud that requires rapid account and access containment. |
| Recommendation — Limit blast radius by tightly governing payment-related accounts and access paths. | ||
| NIST CSF 2.0 | PR.DS-01 — Data-at-rest is protected | Skimming is a data theft problem that benefits from minimising exposed payment data. |
| Recommendation — Reduce exposed card data and protect sensitive payment information across the transaction path. | ||
| OWASP ASVS | V14 — Data Protection | Online skimming targets sensitive payment data entered through web checkout flows. |
| Recommendation — Apply data protection controls to prevent card data exposure in checkout flows. | ||
| NIST SP 800-53 Rev 5 | SC-28 — Protection of Information at Rest | Card data stolen through skimming becomes sensitive information requiring protection and minimisation. |
| Recommendation — Protect payment data with controls that limit exposure and support rapid containment. | ||
Practitioner Guidance
Why practitioners should care: Skimming is often detected after the fraud has already spread, so merchants and payment teams need controls that reduce dwell time and make tampering visible sooner. A small change in checkout code or terminal hardware can create a large downstream fraud problem.
What to watch for: Look for unexplained terminal changes, unusual maintenance activity, unexpected checkout script additions, sudden fraud spikes, or a cluster of complaints tied to the same store, device, or payment page. Those signals often matter more than a single isolated transaction alert.
Related resources from NHI Mgmt Group
- Who is accountable when a third-party payment iframe is skimming card data?
- How should security teams redact credit card numbers in Salesforce without breaking support workflows?
- Why do credit card numbers leak into CRM systems in the first place?
- What breaks when credit card data is stored in Salesforce without automated redaction?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 29, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org