Skip to main content

Best Practices: Identifying Skimming and Responding to a Merchant Breach

If you find an ATM skimmer: 

  1. Take the machine out of commission and do not handle the skimming device. Any movement of the device might make it more difficult for a fraud analyst to gather information that may be helpful in stopping future attempts by fraudsters.
  2. Contact local law enforcement and file a police report. If your local law enforcement agency has a White Collar crime unit, file the report directly with them.
  3. Immediately gather any video that may help with the investigation. Having video available for the responding law enforcement officers will help keep your investigation moving.
  4. Contact the U.S. Secret Service. You can use this link to locate the closest office to your location. www.secretservice.gov/investigation/
  5. Determine what the Window of Exposure (WOE) is from any video you are able to obtain, and begin notifying customers that may be at risk.
  6. Begin inspecting all of your ATMs. Most issuers use the same model ATM within their entire fleet. This means skimming devices can be on multiple ATMs.

If you suspect a gas pump skimmer:

  1. Contact local law enforcement and file a police report. If your local law enforcement agency has a White Collar crime unit, file the report directly with them.
  2. Contact the U.S. Secret Service. You can use this link to locate the closest office to your location. www.secretservice.gov/investigation/
  3. Using your data, try to determine what the Terminal ID number is for the particular gas pump that is suspected of being skimmed. This will help you determine which customers may have been affected by the specific pump, and which customers are not affected because they used different pumps.
  4. Determine the Window of Exposure (WOE) by linking the times to the first known exposure. Begin notifying customers that may be at risk.

If you suspect a merchant is breached: 

  1. Report the suspected merchant compromise to your signature network, debit network(s) and processor.
  2.  Contact local law enforcement to share your findings with them. The goal is to try to stop the breach as soon as possible.
  3. Contact the U.S. Secret Service. You can use this link to locate the closest office to your location. www.secretservice.gov/investigation/

For additional information around best practices when it comes to breaches or skimming click here.