Why ATM Skimming Is Rising Again in 2026

For years, the standard skimmer was a thin plastic overlay on the card slot that read the magnetic stripe. Chip-and-PIN made these skimmers nearly useless — the magnetic stripe carries less authentication data, and US banks now reject most magnetic-stripe transactions from ATMs that should support EMV.

Two new attack patterns have emerged since 2024:

**Deep-insert skimmers** sit inside the card-reader assembly itself, intercepting the chip-data exchange between the card and the ATM. They are invisible from the outside. Banks and ATM-network operators in Mexico, Brazil, Romania, and Bulgaria have documented these at increasing rates through 2025 and into 2026.

**Cardless-withdrawal exploits** target ATMs that allow withdrawal via QR code or one-time code from a banking app. Attackers compromise the app — typically through a phishing message or a malicious banking-app clone — and pull cash without physical card access. The first cardless skimming arrests in Bangkok and Buenos Aires happened in 2025.

Documented in country-level skimming reports as of 2025–2026:

• **Bulgaria, Romania, North Macedonia** — long-term hotspots; deep-insert skimmers documented in tourist areas of Sofia, Bucharest, and Skopje
• **Mexico (Cancún, Cozumel, Tijuana)** — standalone tourist-zone ATMs document significantly higher skimming rates than bank-branch ATMs
• **Brazil (Rio de Janeiro, Salvador, São Paulo)** — both physical skimming and cardless-app exploits documented
• **Indonesia (Bali, Jakarta)** — tourist-zone ATMs in Kuta and Seminyak have a long-running skimming history that has not abated
• **Greece (Athens, Mykonos)** — increased skimming during peak tourist season is a documented seasonal pattern

Five behaviors that meaningfully reduce skimming exposure:

1. **Use bank-branch ATMs during business hours.** Standalone ATMs in convenience stores, hotel lobbies, and tourist-zone kiosks have substantially higher skimming rates. Bank-branch machines are physically inspected and serviced regularly, and the bank takes liability more cleanly when fraud occurs. 2. **Cover the keypad while entering your PIN.** Most skimmers are paired with a pinhole camera mounted above the keypad. Covering the keys with your other hand defeats the camera even when the card data is captured. 3. **Wiggle the card reader before inserting your card.** Overlay skimmers — though increasingly rare — come loose with light pressure. If anything moves or feels glued on, walk to a different machine. 4. **Set transaction alerts on your bank app.** SMS or push alerts on every withdrawal mean you find out about unauthorized withdrawals within minutes rather than at month-end. 5. **Avoid cardless withdrawal in unfamiliar networks.** Cardless-withdrawal QR codes are convenient but are the attack vector for the new exploit class. If you have an account where cardless withdrawal is enabled, disable it before international travel and re-enable on return.

Three immediate actions:

• Notify the bank that issued the card. Most major banks have 24/7 fraud lines and will freeze the card within minutes of the report.
• Withdraw the rest of your trip cash from a different ATM at a different bank, in case attackers have already harvested data and are queueing withdrawals.
• File a police report locally. This is required for any insurance claim and is the documentation banks need to escalate to law enforcement when amounts are significant.

The single best protection remains card-level: a Schwab Debit Card refunds all foreign ATM fees worldwide, and Wise / Revolut accounts let you keep most of your trip funds in the app — with only small transfer amounts on the actual card — limiting exposure if the card is compromised.