Card skimmer prevention: Adding a physical layer beyond inspections

Surveillance footage from a recent Los Angeles investigation revealed that it took less than two seconds to install a card skimmer on a payment terminal.

The financial incentive behind these attacks is significant. A single skimming device can store up to 40,000 card records, including the PAN, cardholder name, and other sensitive data. Even without a PIN, each stolen record can be sold for approximately $20. When PIN data is captured, that value can increase to $100 per record. At scale, a single compromised terminal can generate between $800,000 and $4 million per harvest cycle. This is why even partial data capture remains highly attractive to attackers.

The reality is simple. A skimmer can capture customer data before anyone discovers it.

How skimmer and shimmer attacks work

A skimmer sits on top of a legitimate payment terminal and captures card data as customers transact. On its own, that data is still highly valuable and can be monetized through resale or fraudulent transactions. What makes it even more actionable is the addition of a PIN.  

That is why attackers may pair skimmers with a hidden camera or another method of capturing PIN entry. The combination turns a single transaction into something that can be monetized quickly through ATM withdrawals or high-value debit transactions. Security guidance now commonly advises consumers to cover the keypad while entering their PIN when no physical shield is present.

More advanced variants, known as shimmers, operate differently. Instead of sitting on the outside of the device, they are inserted into the card slot itself. They are invisible to the customer and can intercept transaction data during normal use. Because they are internal, they bypass most visual detection methods.

Why daily terminal inspections aren’t enough on their own

The industry’s primary recommendation is straightforward. Merchants are asked to inspect every terminal, every day, for signs of tampering.

Daily terminal inspections remain an important part of any security program. The problem is that they’re being asked to do a job they weren’t designed to do alone.

Consistent inspections can be difficult to maintain across busy stores and large terminal estates. Staff turnover makes training difficult to maintain, while high-quality skimmers are designed specifically to avoid detection, even under scrutiny.

Even trained store associates can struggle to identify a purpose-built fraud device during a quick visual check. Relying on human vigilance alone leaves a gap that becomes harder to manage at scale.

How privacy shields help deter skimming and limit PIN exposure

A privacy shield adds a physical barrier around the PIN pad, limiting visibility of PIN entry and changing the terminal’s profile.

It creates a controlled viewing angle around the PIN pad, limiting visibility to the person standing directly in front of the device. This helps block both shoulder surfing and the hidden pinhole cameras attackers use to capture PINs alongside card data.

It also changes the physical structure of the terminal. Any overlay device must now account for that shape, which makes skimmers harder to install and easier to detect. At the same time, the card slot becomes more restrictive, making it more difficult to insert internal devices such as shimmers.

Once installed, the shield provides a physical layer of protection without adding a daily task for store teams.

Deployed at scale: Verifone's privacy shield

This approach isn’t theoretical. Verifone terminals with permanently affixed privacy shields have been deployed at scale in the German market for years, where enhanced physical security requirements have driven industry-wide adoption.

Privacy shield configurations are available to order today. Your Verifone Account Executive can confirm availability for your devices and market.

Why this matters for merchants

When card data is captured, it already carries meaningful value and risk. When a PIN is captured alongside that data, the impact increases significantly. That is when fraud becomes immediate and actionable, enabling unauthorized withdrawals, high-value debit transactions, and broader financial damage for both customers and merchants.

For those accepting EBT, the implications extend beyond individual fraud losses. Criminal networks have been documented timing cash-out activity to align with monthly benefit distribution schedules – targeting the window immediately after funds are loaded when balances are highest. A single compromised terminal in a high-traffic grocery or c-store environment can affect hundreds of benefit recipients in a single distribution cycle.

A privacy shield does not eliminate every possible attack. It adds an obstacle for attackers by limiting PIN exposure and making overlay devices harder to fit.

A practical step you can take now

For merchants looking to strengthen protection beyond inspections, a privacy shield offers an additional physical control.  

Inspections and privacy shields work differently but work best together. Inspections identify tampering after or during an attack. A permanently affixed privacy shield reduces the likelihood of a successful attack in the first place by disrupting the physical installation of overlay devices and restricting PIN capture. Neither replaces the other. Together, they create a layered defense that is significantly harder for attackers to defeat than either control alone.

See the full layered picture
Physical controls are one layer of a bigger strategy. Explore Verifone's 9-layer approach to in-store payment security, from tamper-resistant hardware to validated Point-to-Point Encryption and tokenization. Download the infographic.

This matters most in high-traffic environments. These locations are frequent targets, and small vulnerabilities scale quickly. Privacy shield variants are already available to order, require no change to how teams operate, and add a physical layer of protection at the point where risk is highest.

If you are planning a new deployment or refreshing an existing estate, specify the privacy shield variant in your next terminal order. Contact your Verifone Account Executive to confirm compatibility and availability for your device estate.

Frequently asked questions

Q: Does a privacy shield replace daily terminal inspections?

A: No – and it shouldn’t. Daily inspections remain an important part of any terminal security program. A privacy shield adds a preventative physical layer that reduces the likelihood of a successful attack, while inspections identify tampering after or during one. Used together, they provide stronger protection than either measure alone.

Q: What is the difference between a skimmer and a shimmer?

A: A skimmer is an overlay device attached to the outside of a payment device that captures card data as shoppers transact. A shimmer is inserted directly into the card slot and operates internally, intercepting transaction data during normal use. Because shimmers are internal, they bypass most visual detection methods, which is why physical controls at the card slot level are particularly valuable.

Q: Does a privacy shield prevent skimming entirely? 

A: No single measure eliminates fraud entirely. What a permanently affixed privacy shield does is significantly raise the level of difficulty. A skimmer overlay must now be fabricated to fit over the shield rather than the base terminal, which changes the required form factor, reduces precision fit, and makes the device more visibly noticeable.

At the same time, the shield blocks the most common method of PIN capture by limiting the ability of cameras to view the keypad during entry. By disrupting the capture of both card data and PIN—while also recognizing that stolen card data alone remains valuable—it makes fraud materially harder to execute and reduces the likelihood of successful exploitation.