ATM Card Fraud and Skimming
A skimmer copies the stripe and a camera catches the PIN. The chip, the limits and fast blocking decide what it is worth.
ATM card fraud covers every way a fraudster gets cash or goods using a customer's debit card at a machine: copying the card, stealing the PIN, trapping the card itself, or attacking the ATM's software. The classic case is a skimmer fitted to an off-site ATM with no guard, used for a weekend, then removed before anyone checks.
The defence has two halves. The card and the machine must make copying useless, and the bank must spot and stop the cash-out quickly when copying succeeds anyway.
You save ₹300
- Full 120-question mocks
- Cyber law coverage
- Module-wise practice
One payment, no subscription · Valid for 2 months
How ATM Card Frauds Work
Skimming
How it works
A device fitted over or inside the card slot copies the magnetic stripe data as the card is inserted
What it needs
The card data, plus the PIN from a hidden camera or a fake keypad overlay
Card cloning
How it works
Skimmed data is written onto a blank card and used elsewhere
What it needs
A machine or terminal that still accepts the magnetic stripe
Shoulder surfing
How it works
Someone watches the PIN being entered, then steals or swaps the card
What it needs
Customer not shielding the keypad
Card trapping
How it works
A device in the slot holds the card; a 'helpful' bystander suggests re-entering the PIN
What it needs
The customer leaving the ATM to report it
Cash trapping
How it works
A false front over the cash slot holds back dispensed notes
What it needs
The customer assuming the machine failed
ATM malware
How it works
Malicious software, often loaded through an exposed USB port or the ATM's network, makes the machine dispense cash or records card data
What it needs
Weak physical and software security on the ATM
| Fraud | How it works | What it needs |
|---|---|---|
| Skimming | A device fitted over or inside the card slot copies the magnetic stripe data as the card is inserted | The card data, plus the PIN from a hidden camera or a fake keypad overlay |
| Card cloning | Skimmed data is written onto a blank card and used elsewhere | A machine or terminal that still accepts the magnetic stripe |
| Shoulder surfing | Someone watches the PIN being entered, then steals or swaps the card | Customer not shielding the keypad |
| Card trapping | A device in the slot holds the card; a 'helpful' bystander suggests re-entering the PIN | The customer leaving the ATM to report it |
| Cash trapping | A false front over the cash slot holds back dispensed notes | The customer assuming the machine failed |
| ATM malware | Malicious software, often loaded through an exposed USB port or the ATM's network, makes the machine dispense cash or records card data | Weak physical and software security on the ATM |
Why the EMV Chip Matters
The magnetic stripe holds static data: copy it once and it can be replayed. An EMV chip card is a smart card. The chip holds secret keys it never reveals and generates a fresh cryptographic value for each transaction, which the issuer verifies. A skimmer can still read the stripe on a chip card, but a clone made from that stripe fails wherever the chip is required.
RBI's Digital Payment Security Controls Directions, 2026 accept an EMV chip with server-side verification as a dynamic or non-replicable authentication method for card-present transactions, alongside the PIN. The weak point is any ATM or terminal that still falls back to the stripe.
Controls RBI Requires
- check_circleATM hardening: BIOS password, USB ports disabled, auto-run disabled, current operating system patches, terminal security software and time-based admin access.
- check_circleAnti-skimming and whitelisting solutions on ATMs (whitelisting lets only approved software run).
- check_circleEvery ATM upgraded to a supported operating system version.
- check_circlePIN generation and CVV validation inside a hardware security module (HSM), with PCI standards followed for PIN handling and terminals.
- check_circleTransaction limits at card, BIN and bank level, set at the card network switch itself, with separate domestic and international limits.
- check_circleMonitoring of breaches 24x7, including weekends and holidays, with particular watch on overseas cash withdrawals, plus alert rules for strings of invalid PINs or CVVs that point to counterfeit cards.
Quick practice on banking operations. No signup.
New Cards Start Domestic and Contact-Only
Under RBI's January 2020 circular on card security, new and reissued cards are enabled only for contact-based use at ATMs and PoS terminals in India. Online, international and contactless use must be switched on by the cardholder, who must be able to turn each channel on or off and set limits 24x7 through the app, internet banking, ATM or IVR. A card that is never used abroad cannot be cashed out abroad.
When a Customer Reports a Skimmed Card
- 1
Block the card at once
Through any 24x7 channel. Every debit after the customer's report is the bank's loss, not the customer's.
- 2
Register the complaint
Give the customer a complaint number with the date and time of the report, and advise a complaint on 1930 or cybercrime.gov.in.
- 3
Trace the point of compromise
Find the ATM or terminal common to several affected cards. That machine needs inspection and its other recent users need warning.
- 4
Settle liability under RBI's rules
Skimming at a machine is usually not the customer's fault, so a prompt report normally means zero liability. See the customer liability page.
How the IIBF Exam Tests This
Expect definition questions (skimming versus shoulder surfing versus card trapping) and control-matching questions (anti-skimming device, chip card, PIN shield, transaction limits). The usual trap: assuming a chip card cannot be skimmed. The stripe on a chip card can still be copied; the chip stops the copy from working where the chip is enforced.
FAQs
What is ATM skimming?expand_more
Fitting a hidden device to an ATM's card slot to copy the card's magnetic stripe data, usually with a camera or fake keypad to capture the PIN, so the data can be loaded onto a cloned card.
How can I tell if an ATM has a skimmer?expand_more
Look for a card slot that is loose, bulky or a different colour, a keypad that feels raised, or a small hole or bar above the keypad that could hold a camera. Cover the keypad with your hand every time, and prefer guarded ATMs.
Can a chip card be cloned?expand_more
The chip's secret keys cannot practically be copied, but the magnetic stripe on the same card can be skimmed. A clone made from the stripe works only where a machine accepts the stripe instead of the chip.
Will the bank refund money stolen through a skimmed card?expand_more
Usually yes, if reported promptly. Skimming is not the customer's negligence, so RBI's rules give zero liability for a prompt report; the reporting window depends on whether the old or the revised rules apply to the transaction date.
Next steps
- Credit Card Fraudarrow_forward
- Card Not Present Fraudarrow_forward
- Customer Liabilityarrow_forward
- Syllabusarrow_forward
120 questions, 2 hours, scored instantly.