Credit Card Skimming at Petrol Pumps and ATMs: How to Stay Safe

Card skimming happens when a device copies your card's data, usually from the magnetic stripe, and a camera or fake keypad captures your PIN. Petrol pumps and standalone ATMs are the two places in India where it's most common. The best protection is to keep your card in sight, tap or insert instead of swiping, and turn off channels you don't use in your bank's app. Here's how the scams work and what to do if you're hit.

How skimming works

A skimmer is a small reader that copies the data on your card's magnetic stripe. Fraudsters use it in two ways:

• Handheld skimmers. A pocket-sized device that someone swipes your card through, usually while you aren't watching. At fuel stations, this is the main risk.
• Overlay skimmers. A fake slot fitted over a real ATM or terminal card reader, often with a pinhole camera or a fake keypad on top of the real one to capture your PIN.

With the copied stripe data and your PIN, criminals can make a cloned magnetic-stripe card and use it wherever stripe transactions are still accepted. The chip on modern cards is much harder to copy, which is why fraudsters go after the stripe.

Petrol pump risks and habits

The usual way it happens at a pump: you hand over your card, the attendant walks to the cash counter or a terminal you can't see, and the card goes through a skimmer before the genuine transaction.

Habits that work:

1. Ask for the terminal to be brought to you. Most pumps have wireless card machines. Don't let the card leave your hand or your sight.
2. Tap to pay where you can. Contactless payments don't expose the stripe at all. Since 2021, you can tap without a PIN for payments up to ₹5,000, which covers most fuel fills. Our contactless limit guide has the details.
3. Insert the chip rather than swiping. If the attendant insists on swiping a chip card, ask why.
4. Cover the keypad when entering your PIN, even if the attendant is standing next to you.
5. Check the SMS alert before you drive off. The amount should match the fill, and there should be only one charge.

Using a fuel card for its surcharge waiver is fine. Just keep the same habits at every station, including your regular one.

ATM risks and habits

Using a credit card at an ATM is a bad idea anyway, since it's a cash advance with a fee and interest from day one. If you hold a credit card mainly for spending, turn off domestic ATM use in your bank's app so a cloned copy can't be used to withdraw cash.

When you do use an ATM with a debit card, check for these signs:

• A card slot that looks bulky, loose or a different colour from the rest of the machine
• A keypad that feels raised, spongy or sits higher than normal
• A strip or small panel above the keypad that could hide a camera
• Glue marks, scratches or tape around the slot

Pull gently on the card slot. Genuine fittings don't move. If anything looks wrong, use a different ATM, ideally one inside a bank branch.

Settings that limit the damage

Even if your card is skimmed, the right settings can stop most misuse. Every Indian bank lets you switch individual channels on and off and set limits in its app or net banking. Our guide to international usage and transaction controls walks through them.

• Turn off domestic ATM withdrawal on credit cards if you never use it.
• Keep international usage off unless you're travelling. Cloned cards are often used abroad, where stripe transactions are still accepted more often.
• Set a modest point-of-sale limit that matches your normal spending.
• Keep SMS and app alerts on for every transaction, however small. Fraudsters often test a cloned card with a tiny charge first.

If your card is skimmed: what to do

1. Block the card at once through the app, net banking or the bank's 24x7 helpline. Our guide on reissuing a lost or stolen card covers the replacement process.
2. Report every unauthorised transaction to the bank, in writing or through the app's dispute option, and keep the complaint reference number.
3. File a cybercrime complaint on the national cybercrime portal (cybercrime.gov.in) or call the 1930 helpline. Many banks ask for this when you dispute a fraud.
4. Follow up on the dispute. Our chargeback and dispute guide explains the timelines.

How quickly you report matters. Under RBI's customer liability framework, if fraud happens because of a third-party breach (such as skimming) and you report it within three working days, your liability should be zero. Reporting later can leave you responsible for part of the loss. Check your bank's own policy for the exact terms.

Cards with built-in fraud or lost-card cover

Some cards include insurance against misuse after you report the card lost or compromised. In BestCard's data:

Card	Cover	Annual fee
SBI Card PRIME	Fraud liability cover of ₹1 lakh after reporting	₹2,999
IDFC FIRST Power	Lost card liability cover of ₹25,000	₹199
IDFC FIRST Power+	Lost card liability cover of ₹25,000	₹499

The SBI Card PRIME pairs its fraud cover with lounge access and accelerated dining rewards. The two IDFC FIRST cards are fuel cards with zero forex markup, so they suit people who refuel often. Insurance doesn't replace good habits, and claims usually require you to have reported the card quickly.

Common mistakes

• Handing the card over at the pump to save a few seconds.
• Ignoring a tiny unknown charge. A ₹1 or ₹10 debit you don't recognise can be a test before a larger fraud.
• Keeping every channel switched on "just in case".
• Sharing the OTP with someone who calls about a "failed transaction". Banks never ask for OTPs. Read our note on OTP fraud.
• Waiting until the statement arrives to check transactions.

For wider protection advice, see our fraud protection tips and the guide to tap-to-pay cards.

Card benefits mentioned here reflect BestCard's latest data, and issuers change insurance terms, so check the issuer's site. If you're choosing a new fuel or everyday card, the card matcher can shortlist options for your spending.