Skimmers take money directly from your checking account, but only if they get your PIN

A skimmer is a device or software that captures your debit card number and PIN when you swipe or insert your card at an ATM, gas pump, or point-of-sale terminal. If a skimmer gets both pieces of information, the person running it can drain your checking account by making withdrawals or purchases in your name. If they only get your card number without the PIN, they cannot access your checking account directly — they can only use the number for online purchases or to create a counterfeit card.

The difference matters because it determines how much money is actually at risk and how quickly you need to act. A skimmer at an ATM where you enter your PIN is far more dangerous than one at a checkout counter where you only swipe.

Key Takeaways

  • Skimmers need both your card number and PIN to drain your checking account; a card number alone lets them make purchases but not ATM withdrawals.
  • ATM and gas pump skimmers are the highest risk because you enter your PIN in full view of the device, while checkout skimmers usually only capture your card number.
  • Your bank is required to refund fraudulent debit card charges if you report them within a specific window, though the timeline depends on when you notice and report the fraud.
  • Checking your account regularly and setting up transaction alerts are the fastest ways to catch skimming before large amounts disappear.
  • Covering the PIN pad with your hand when you enter your code makes it much harder for hidden cameras to record your PIN.

How skimmers actually access your checking account

A skimmer works in two stages. First, it captures your card data — the 16-digit number, expiration date, and sometimes the three-digit security code on the back. Second, if there is a hidden camera or a second device nearby, it records your PIN as you type it. With both pieces, a thief can go to an ATM and withdraw cash directly from your checking account, or they can use the card number and PIN to make online purchases that draw from your account.

The location of the skimmer determines what information they can realistically capture. At an ATM or gas pump, you enter your PIN on the device itself, so a camera positioned above the keypad can record it. At a retail checkout, you either swipe your card (and the cashier may or may not see your PIN) or you insert it into a reader you control — the skimmer gets your card number but usually not your PIN. Online, skimmers cannot capture your PIN at all because you never enter it; they can only use the card number for purchases.

What happens to your money after a skimmer captures it

Once a thief has your card number and PIN, they typically move fast. They may test the account with a small purchase to confirm it works, then make larger withdrawals or purchases within hours or days. ATM withdrawals drain your account immediately. Online purchases or transfers may take a day or two to post, giving you a narrow window to notice and report before the money is gone.

The money does not stay in your account under a different name — it leaves your account and goes to the thief or is transferred to another account they control. Once it leaves, recovering it depends on your bank's fraud procedures and how quickly you report it. Your bank can reverse the transactions and refund your account, but only if you report the fraud within the required timeframe.

Your bank's responsibility to refund skimming fraud

Federal law requires banks to refund fraudulent debit card transactions, but the amount you recover depends on when you report the fraud. If you report unauthorized transactions within two business days of discovering them, your liability is capped at $50. If you wait more than two business days but less than 60 calendar days, your liability can be up to $500. If you wait longer than 60 days, you may lose the entire amount.

In practice, most banks refund the full amount even if you report late, especially if you report within a few days. However, the law does not require them to, so your protection weakens the longer you wait. This is why checking your account regularly — ideally daily — is critical. Many banks also offer free transaction alerts that notify you by email or text when a purchase or withdrawal occurs, which can catch skimming within hours instead of days.

Detecting skimming before large amounts disappear

The fastest way to catch a skimmer is to check your checking account balance and recent transactions at least once a week, and ideally more often. Most banks let you check online or through a mobile app in seconds. Look for transactions you do not recognize, especially small test purchases (often $1 to $10) followed by larger ones, or ATM withdrawals from locations you did not visit.

Set up transaction alerts if your bank offers them. These notify you immediately when a purchase, withdrawal, or transfer occurs, so you can spot fraud the same day instead of days later. Some banks let you set alerts for transactions over a certain amount, or for any transaction at all. The sooner you see an unauthorized transaction, the sooner you can call your bank and report it, which protects your refund may be able to access.

Protecting your PIN from skimmers

Your PIN is the key that unlocks your checking account to a thief. Protect it by covering the keypad with your other hand when you enter it at an ATM or gas pump — this blocks any camera positioned above the pad. Do not use a PIN that is easy to guess, like your birth year or a sequence like 1234. Do not write your PIN down or share it with anyone, including bank employees.

Inspect the ATM or gas pump before you use it. Skimmers are often loose or slightly raised compared to the rest of the device. If the card slot, keypad, or surround feels loose, wiggles, or looks like it does not fit flush with the machine, use a different ATM or pump. Report suspicious devices to the bank or gas station immediately — they take these reports seriously and will inspect the machine.

What to do if you discover skimming on your account

Call your bank immediately, even if it is after hours. Most banks have a fraud line that operates 24/7. Tell them which transactions are not yours and when you first noticed them. Your bank will freeze your account, cancel your debit card, and begin an investigation. They will issue you a new card, usually within 5 to 10 business days.

Ask your bank to reverse the fraudulent transactions and refund your account. They are required to do this, though the timeline varies — some banks credit your account within one business day, others take up to 10. While the investigation is underway, your bank may temporarily refund the amount so you have access to your money, then finalize the refund once they confirm the fraud. Do not use your old card after you report it; wait for the new one to arrive.

Frequently Asked Questions

Can a skimmer steal my money if I use my credit card instead of my debit card?

A skimmer can capture your credit card number the same way, but your liability is different. Credit card fraud is capped at $50 by federal law, and most credit card companies refund the full amount even without that cap. Debit card fraud is riskier because it pulls directly from your checking account, so using credit for gas and ATMs is safer.

How long does it take to get my money back after I report skimming?

Most banks refund fraudulent transactions within one to ten business days of your report, though some may take longer if they need to investigate. Your bank may issue a temporary refund immediately so you have access to your money while they confirm the fraud. The exact timeline depends on your bank's policy.

Will my bank tell me if my card was used at a skimmer?

Your bank will not know your card was skimmed unless you report the fraudulent transactions. They will see that unauthorized purchases or withdrawals occurred, but they cannot tell you where the skimmer was located or which device captured your information. You can report the location to the police and the business where you think the skimmer was, but the bank's job is to refund the fraud, not to investigate the skimmer itself.

What if the skimmer only got my card number, not my PIN?

Without your PIN, a thief cannot withdraw cash from your ATM or access your checking account directly. They can use your card number for online purchases or to create a counterfeit card, but those transactions are still fraudulent and your bank will refund them. Report the fraud the same way you would if they had your PIN.

Can I get my money back if I wait a week to report the skimming?

Yes, most banks will refund you even if you wait a week, though your legal protection is stronger if you report within two business days. After 60 days, your bank is no longer required to refund you by federal law. Report as soon as you notice unauthorized transactions to protect your refund and to help your bank stop the fraud faster.