ATM skimming and card cloning
Card skimmer or hidden camera at an ATM captures your card details and PIN. Most-documented in Indonesia, Thailand, Mexico, South Africa. Field guide: how the scam works, how to spot it in five seconds, and what to do if you fall for it.
Also called: Card cloning, Card skimmer, Shoulder-surfing ATM.
How the scam works
A scanner device is fitted over the legitimate card slot, or a tiny camera is hidden above the keypad. Both record your card details and PIN as you withdraw. Criminals then clone the card and drain the account, often within hours of you using the ATM. Bali, Bangkok, Mexico City, Prague, and Cape Town airports have all had documented skimming rings in 2024-2025.
How to spot it in 5 seconds
- Card slot looks oversized, loose, or has plastic that wiggles when tugged
- A second small camera or pinhole is visible above the keypad
- The ATM is in a freestanding kiosk away from a bank branch (less monitoring)
- The keypad feels softer or "spongy" than usual (overlay)
- A "helpful" stranger offers to assist with the machine
What to do if you fall for it
- Block the card via your banking app immediately — every minute matters
- File a fraud report with your bank within 24 hours; most banks reverse skimming charges if reported promptly
- Use ATMs inside bank lobbies during business hours where possible
- Enable transaction notifications on your card so you see fraudulent withdrawals in real time
Frequently asked questions
Where is the ATM skimming and card cloning most common?
The ATM skimming and card cloning is most-documented in Indonesia, Thailand, Mexico, South Africa, Brazil. Reports come from FCDO and US State Department advisories, embassy briefings, and Warnely's editorial team. The scam can happen anywhere these patterns repeat — watch for the warning signs above regardless of country.
Is this scam dangerous or just annoying?
This scam is high-risk: it can involve significant financial loss, drugged drinks, or physical intimidation. Take the recovery steps above seriously and report to local police and your embassy.
What should I do if I am being scammed right now?
Step away from the situation if safe. Walk to a busier, public, well-lit area. If you have been robbed: block bank cards via your banking app within minutes. If you have been physically threatened: call the local emergency number (varies by country — see the country guide) and your embassy. Most embassies operate 24/7 emergency lines.
Will my travel insurance cover this?
Most travel insurance policies cover theft and fraud if you file a police report within 24 hours and provide the report number when claiming. Card fraud is usually reversed by your bank if reported promptly. Spiked-drink medical costs are typically covered as medical emergencies. Always check your specific policy before travel.