The scams keep evolving, but one of the oldest schemes remains among the most effective: skimmers. These are small devices, often hidden in automatic payment terminals, multibanco boxes or fuel pumps, capable of copying card data and, in minutes, allowing improper surveys or payments. The good news is that the best defense for this scam can be in your pocket: the mobile phone, and avoid using the card.
How the scheme works
A skimmer is a disguised accessory placed on the card reader. When inserting the card, the device can read data from the magnetic band. In more elaborate scenarios, the burns use microcâmaras directed to the keyboard or fake keyboards to capture the PIN.
The Judicial Police (PJ) confirms that this method remains active in ATMs and TPAs, including gas stations, and disseminates specific prevention recommendations.
Warning signs
Examine the equipment before use. If you notice loose pieces, grooves or misaligned keyboards, glue residues or other tampering, do not use and report. Prefer moved and lit places and cover the keyboard when entering the pin. These guidelines are contained in the councils of SIBS and PJ.
The mobile phone as a defense
Whenever possible, avoid using the magnetic band of the card. Mobile payments like Apple Pay and Google Wallet/Pay resort to tokenization: the merchant receives a virtual number (Device/Virtual Pan) and a dynamic code per transaction, not the actual number of the card.
In practical terms, data captured by a magnetic band skimmer do not replicate the contactless mobile transaction.
And if there is no contactless
If you have to use the physical card, do not lose sight of the payment, be suspicious of makeshift TPAs, choose ATMs in visible and illuminated places, and enable alerts from the bank’s app to detect suspicious movements. SIBS recommends to avoid isolated equipment and immediately report any anomaly.
If something goes wrong: who responds
Banco de Portugal recalls that, by PSD2, in unauthorized payment operations, the provider must immediately reimburse the amount after knowledge/communication.
The user’s responsibility, before reporting, is limited to € 50 when there is loss/theft/abusive appropriation of the instrument, except fraud or gross negligence. If strong authentication has not been required, the user does not support losses (except fraud).
Trends in Europe
According to the skimming attacks in Europe are at low levels against previous years, but continue to generate losses, often with cash -out outside the EU/markets EMV. Crime has evolved to other forms of terminal attack.
Skimming remains a real risk, but it is mitigable: use mobile phone/contactless when possible, watch the terminal, cover the PIN and immediately report foreign operations. These practices, recommended by PJ, SIBS and BDP, are the best protection.
Also read:
