A shimming attack is a form of payment card theft that uses a thin malicious device inserted into a card reader to intercept data from chip or magnetic stripe transactions. The shim sits between the reader and card, capturing transaction details without obvious physical damage to the terminal.
What a shimming attack is in payment systems
A shimming attack is a card skimming technique that targets chip-enabled payment flows rather than the visible exterior of the terminal. The malicious shim is small enough to sit inside the reader path and capture card data as it passes through the device.
That makes the attack dangerous because it exploits a trusted payment interface while leaving little obvious evidence of tampering. The terminal can still appear to work normally, which delays discovery and lets the attacker collect transaction data over time.
How the shim intercepts card data
The shim acts as an in-line interceptor between the card and the reader electronics. In practice, it can observe or copy data exchanged during chip or magnetic stripe interaction, then forward enough of the signal to keep the payment process functioning.
Because the compromise happens inside the reader path, traditional visual checks may miss it. The attack is therefore more about covert interception than terminal destruction, and it often relies on brief physical access to install the device.
Why shimming attacks are difficult to spot
These attacks blend into ordinary point-of-sale operation, so defenders may not notice until fraud patterns emerge. A compromised reader may still accept cards, print receipts, and behave normally from the cashier's perspective.
Detection is usually indirect: unexplained card fraud, anomalies across a location or terminal set, or signs of physical tampering during inspection. Even then, a shim can be hard to distinguish from benign internal components without opening the reader.
For readers looking at the broader pattern of payment-device tampering, the attack is part of a larger class of real-world breach patterns involving stolen credentials and covert compromise, even though the mechanism here is physical rather than remote.
What organizations should do after exposure or compromise
Exposure checking starts with knowing which terminals are in use, where they are deployed, and whether any reader has been out of sight or left unsecured. Vendor advisories, incident reports, and physical inspection procedures matter because the attack surface is the device itself, not only the payment network.
If compromise is suspected, organizations should treat captured card data as potentially exposed and review payment infrastructure, cash-handling procedures, and site access controls. Where fraud indicators appear after a suspected shim installation, the response should include terminal replacement, forensic review, and coordination with payment and law-enforcement partners.
Related external guidance on payment-device tampering and broader threat handling can be tracked through CISA cyber threat advisories and payment security documentation from device vendors.
Risk and Threat Considerations
Shimming attacks matter because they turn a trusted payment reader into a covert collection point for card data. The main risk is silent theft at scale: a compromised terminal can continue processing transactions while exposing customer payment details and enabling downstream fraud.
Failure mechanism: A malicious insert intercepts chip or stripe communication inside the reader path, then passes enough data through to avoid obvious service disruption.
Impact: Stolen payment data can support fraud, card cloning, disputed transactions, customer harm, and costly terminal replacement or investigation.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-11 — Data Recovery | Shimming can expose payment data that requires recovery and incident handling. |
| CIS-12 — Network Infrastructure Management | Terminal integrity depends on controlled deployment and monitoring of point-of-sale infrastructure. | |
| Recommendation — Verify payment-terminal backups, replacement procedures, and recovery steps after suspected tampering. Harden and monitor point-of-sale infrastructure to reduce tampering and unauthorized device changes. | ||
| NIST SP 800-53 Rev 5 | PE-3 — Physical Access Control | A shim attack requires physical access to the card reader or terminal assembly. |
| SI-4 — System Monitoring | Suspicious reader behavior and fraud patterns require monitoring for compromise indicators. | |
| AC-19 — Access Control for Mobile Devices | Point-of-sale devices need access restrictions to reduce unauthorized handling and exposure. | |
| Recommendation — Restrict and monitor physical access to payment terminals and reader enclosures. Monitor terminals and transaction patterns for indicators of tampering or covert interception. Limit who can handle and maintain payment devices to reduce tampering opportunities. | ||
Practitioner Guidance
What to watch for: Focus on terminals that are physically accessible, poorly supervised, or outside routine inspection cycles. Unusual fraud concentration tied to a single store, lane, or reader model is often a stronger signal than visible device damage.
Governance implication: Shimming is not only a fraud problem, it is a physical security and payment-integrity control problem. Ownership should sit with the teams responsible for terminal hardening, inspection cadence, and incident handling, not just with payments operations.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 29, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org