What is ATM skimming?

ATM skimming is a card-cloning attack where a device captures your card data and PIN at a compromised ATM, then a clone of your card is used elsewhere within hours. Tabiji has documented four sub-variants across 19 countries: overlay skimmers (a fake faceplate fitted over the real card slot, capturing the magnetic stripe as the card passes through); shoulder-surf PIN capture (an observer or pinhole camera records your PIN while you type); private-ATM machines (standalone ATMs in pharmacies, mini-markets, and hotel lobbies that have skimming hardware built in by the operator); and Lebanese-loop card traps (a thin plastic loop traps your card in the slot, then a 'helpful stranger' returns later to extract it after you leave). The defense is the same for all four: use major-bank ATMs, wiggle the card slot, cover the keypad, stay at the machine until your card and receipt are in your hand.

How do I spot a skimmed ATM?

Five tells, any one of which means walk away. (1) The card slot wiggles or has plastic play when you push it gently with a finger; legitimate slots are firm. (2) The faceplate around the slot looks slightly off-color or has visible seams. (3) The PIN keypad is a thin plastic overlay sitting on top of the real keypad; press one key to confirm; the keys should have firm tactile feedback, not feel mushy. (4) There is a small pinhole or unusual marking on the faceplate above the keypad — sometimes housing a hidden camera. (5) The machine is in a recessed alcove, dimly lit doorway, or off the main pedestrian flow — these are preferred operator locations because they reduce witness density. Any one tell, walk to the next bank-branch ATM.

Are private ATMs safe?

No. Private ATMs in pharmacies, mini-markets, hotel lobbies, currency-exchange counters, and standalone street kiosks are the highest-risk category for tourist card fraud. The mechanism: the operator owns the machine, controls the cash inside, and can install skimming hardware permanently in the cassette and card-reader path. There is no bank oversight. Your bank's chargeback claim is harder to win because the dispenser was an authorized merchant, not a fraud event in the usual sense. Use ATMs only at named major-bank main branches: BNP Paribas / Crédit Agricole / Société Générale / LCL (France), Intesa Sanpaolo / UniCredit (Italy), Santander / BBVA / CaixaBank (Spain), Bangkok Bank / Kasikornbank / Siam Commercial Bank (Thailand), Česká spořitelna / ČSOB (Czech Republic). The fee differential is at most 1-2%; the fraud risk differential is an order of magnitude.

What do I do if my card is cloned abroad?

Within five minutes of the alert: call your card issuer's 24/7 international fraud line (printed on the back of every card; save a photo of all your card backs separately on your phone for exactly this moment). Freeze the card; the issuer will block all future transactions and reverse the fraudulent ones under Visa/Mastercard zero-liability policies. Within thirty minutes: file a police report with the local tourist-police line. Most card issuers' fraud-investigation teams require the police report number for full reimbursement above a small threshold. Within 24 hours: order a replacement card; most major issuers (Amex, Chase, Capital One) offer overnight emergency-replacement cards via DHL or FedEx to your hotel. Keep a backup card from a different network in a separate physical location (not your wallet) so you have immediate spending capacity while the primary is being replaced.

Should I use Wise, Revolut, or my home bank's ATM card abroad?

All three work, with trade-offs. Wise and Revolut multi-currency cards offer real-time fraud alerts, instant card freeze in-app, and the ability to load a separate sub-balance for the trip (so a clone can only drain that sub-balance, not your main account). Home-bank cards typically have stronger fraud-reimbursement protections under domestic banking law and may have a higher tolerance for unusual location patterns. Best practice for travel: carry both — use a Wise/Revolut card as the daily ATM card with a low loaded balance, and keep the home-bank card as backup in the hotel safe. Set both to push real-time transaction alerts. The combination defeats every common card-cloning attack vector while keeping you liquid if one card is compromised.

ATM Skimming & Card Cloning: 2026 Atlas

Q: What is the Lebanese loop card-trap scam?

The Lebanese loop is a card-trap variant where a thin plastic loop is inserted into the card slot, designed to grip your card so it cannot return. You attempt several PIN entries, the machine reports an error, you eventually walk away assuming the bank kept your card. A waiting operator extracts the trapped card and uses it before you can call your issuer to freeze it. The defense: if your card does not return within 30 seconds, do NOT walk away. Stand at the machine and call your card issuer's 24/7 fraud line on the back of any other card you have, while photographing the ATM and noting the location. Most banks can flag the card mid-trap. The Lebanese-loop variant is most documented in Eastern European tourist zones (Prague Wenceslas, Bucharest Old Town, Sofia city center), but surfaces in Western European cities at lower volumes.

Q: What countries have the worst ATM skimming for tourists?

Tabiji's 2026 archive shows highest documented exposure in France (Paris Champs-Élysées and Marais standalone ATMs, Marseille Vieux-Port, Nice Promenade des Anglais), Italy (Rome Termini, Florence Duomo, Venice San Marco standalone machines), Spain (Barcelona Las Ramblas and Gothic Quarter, Madrid Sol-area private ATMs), Thailand (Bangkok Sukhumvit and Khao San, Phuket Patong, Pattaya Walking Street), Czech Republic (Prague Wenceslas and Old Town private ATMs), Bulgaria (Sofia city center), Romania (Bucharest Old Town), Mexico (Cancún Hotel Zone), and Indonesia (Bali Kuta and Seminyak). The pattern follows tourist density and the prevalence of non-bank ATMs. The European Card Payment Association tracks card-fraud rates by country annually; tourist-zone ATMs show 5-10× the fraud rate of branch ATMs in the same city.

By Bernard Huang

Editor, tabiji.ai · Published April 30, 2026

ATM skimming and card cloning four-panel comic illustration: tourist at a Paris standalone ATM, a stranger approaching with a dropped bill while an accomplice watches the keypad, a skimmer overlay on the card slot, and the cloned-card alert on a phone screen the next morning

ATM skimming and card cloning runs four mechanics across 19 countries: overlay skimmers, shoulder-surf PIN capture, private-ATM machines, and Lebanese-loop card traps. The universal defense is a 60-second routine. Use major-bank ATMs (BNP Paribas, Intesa Sanpaolo, Santander, Bangkok Bank), inside the branch when possible. Wiggle the card slot before inserting; legitimate slots have zero play. Cover the keypad with your free hand on every PIN entry. Stay at the machine until your card and receipt are physically in your hand, ignoring any "helpful stranger" who approaches mid-transaction. Set up real-time card-fraud alerts before you leave home. The clone-to-first-fraud window is typically four to twelve hours; an instant alert lets you freeze the card before the second charge lands.

📋 Browse the full Atlas 💵 Counterfeit currency 🍽 Restaurant bill padding

A scene · Paris Champs-Élysées · 6pm Saturday

The €4,000 cloned in three seconds while a stranger handed you a €20.

Paris Champs-Élysées ATM skimming comic, tourist at standalone ATM while a man approaches with a dropped bill and an accomplice watches from across the plaza

You walk up to a standalone ATM half a block off the Champs-Élysées at 6pm on a Saturday because the BNP Paribas queue is fifteen people deep. The standalone says "International Cards Welcome," in five languages. The slot looks normal. You insert your card and start the withdrawal.

Behind you, a man in a windbreaker approaches with a smile and a €20 note in his hand. "Excuse me, monsieur, you dropped this." You half-turn. Your PIN goes into the keypad while your eyes are on him. His partner across the plaza, phone raised like a tourist photo, has just captured your four digits.

The €20 he's holding was always his. While you thank him and turn back, your card is already being swapped for a near-identical decoy by a third person who came up on your other side. You finish the withdrawal, take the cash and the wrong card, and walk away. By the time your bank flags the cloned-card transactions in Marseille that night, you're €4,000 in.

That is the universal mechanic, executed at the Paris archetype: a private ATM with skimming hardware, plus a three-person team running shoulder-surf PIN capture and a card swap. A March 2025 DailyMail investigation estimated 1 in 10 tourists to France, 212,000 people across five years, had been scammed, with ATM fraud a significant contributor. The same crews work the Champs-Élysées, the Marais, Montmartre, and the perimeter of Sacré-Cœur. Le Parisien publishes annual coverage of the Champs-Élysées card-fraud belt; arrests are made in cycles and the activity resumes within weeks.

The rest of this page is the four-mechanic playbook, the four other cities where it runs, and the 60-second wiggle-cover-stay routine that defeats every variant.

Read the full Paris scam guide →

Key Takeaways

Use major-bank ATMs only, inside the branch when possible. The fee differential is at most 1–2%; the fraud differential is an order of magnitude.
Wiggle the card slot before inserting. Overlay skimmers are loosely attached and rock visibly. Five seconds defeats every overlay variant.
Cover the keypad with your free hand on every PIN entry. Defeats both shoulder-surf observers and pinhole cameras above the keypad.
Stay at the machine until your card and receipt are physically in your hand. Do not turn for any "helpful stranger." The Lebanese-loop and swap variants both depend on you breaking eye contact.
Set up real-time card-fraud alerts before traveling. The clone-to-first-fraud window is 4–12 hours; instant push notifications let you freeze before the second charge.

The wiggle-cover-stay routine

ATM skimming depends on you not noticing for the seconds it takes to capture your card data and PIN. The capture itself is fast, under three seconds, but unwinding it after a clone is in the wild requires hours of bank disputes and possibly an embassy visit if your access to cash is gone. The defensive routine is a 60-second sequence that runs once per ATM, in any country.

Use major-bank ATMs only, inside the branch when possible. France: BNP Paribas, Crédit Agricole, Société Générale, LCL. Italy: Intesa Sanpaolo, UniCredit, Banca Nazionale del Lavoro. Spain: Santander, BBVA, CaixaBank. Thailand: Bangkok Bank, Kasikornbank, Siam Commercial Bank. Czech Republic: Česká spořitelna, ČSOB. Avoid pharmacy, mini-market, hotel-lobby, and standalone street-kiosk ATMs entirely. The fraud rate at non-bank ATMs is 5–10× the bank-branch rate; the fee saving is 1–2%.
Wiggle the card slot before inserting. Overlay skimmers are loosely attached to the legitimate slot. A firm wiggle reveals plastic that comes off in your hand or rocks suspiciously. The genuine slot has zero play. Five seconds defeats every overlay-skimmer variant; takes longer to explain than to perform.
Cover the keypad with your free hand on every PIN entry. Cup your free hand over the keypad as you type. Defeats both shoulder-surf observers and pinhole cameras hidden in the faceplate. One second; the universal defense against PIN capture across all four sub-variants.
Stay at the machine until your card and receipt are physically in your hand. Do not turn around for any approach: a dropped bill, asked directions, a tap on the shoulder. The Lebanese-loop card-trap and the swap-during-distraction variants both depend on you breaking eye contact. If anyone approaches, finish the transaction first or cancel and walk away. The thirty seconds after PIN entry are when both lift variants execute.
Set up real-time card-fraud alerts before you travel. Most major issuers (Chase, Amex, Capital One, Wise, Revolut) offer push notifications on every transaction. Enable them. Keep a backup card from a different network in a separate physical location so a single compromise does not strand you. The clone-to-first-fraud window is typically 4–12 hours; instant alerts let you freeze before the second charge lands.

The four mechanics

Different countries and different operator crews lean on different mechanics within the same family. Here are the four sub-variants documented globally. Each has a recognition tell, a primary geography, and the routine step that defeats it.

Standalone ATMs · tourist plazas · recessed alcoves

1. Overlay Skimmer

A fake card-slot faceplate fits over the genuine ATM slot. As your card passes through, a battery-powered reader records the magnetic-stripe data. The overlay is colored and shaped to match the machine but is loosely attached, designed for fast install/removal between police patrols. Operators install in early morning and harvest data at end of shift.

Defense: wiggle the slot. Genuine slots are firm. Most reported in: Paris Champs-Élysées, Barcelona Las Ramblas, Rome Termini, Bangkok Sukhumvit.

High-traffic plazas · subway-station ATMs

2. Shoulder-Surf PIN Capture

An observer (human or pinhole camera) records your PIN as you type. The human variant runs as a "helpful stranger" approach combined with two- or three-person card-swap teams. The camera variant is a tiny lens hidden in a plastic strip above the keypad, often near a handwritten "use this ATM" sign. Both feed cloned cards.

Defense: cup your free hand over the keypad. Most reported in: Paris Métro and Champs-Élysées, Barcelona Plaza Catalunya, Madrid Sol.

Pharmacies · mini-markets · hotel lobbies · standalone kiosks

3. Private-ATM Machine

An ATM owned and stocked by a private operator (not a bank) that has skimming hardware permanently installed in the cassette and reader path. The operator gets a small per-transaction fee from the network plus all skimmed card data. Common branding: "Euronet," "Cardtronics," generic "ATM" signage. Bank-issued chargeback claims are harder against private-ATM transactions.

Defense: avoid entirely. Use only major-bank-branded ATMs. Most reported in: Bangkok Sukhumvit and Khao San, Bali Kuta and Seminyak, Cancún Hotel Zone, Prague Wenceslas.

Eastern European tourist zones · subway-station bank-branch ATMs at night

4. Lebanese-Loop Card Trap

A thin plastic loop is inserted into the card slot before your transaction. The loop grips your card so it cannot return. You attempt several PIN entries; the machine reports an error; you eventually walk away assuming the bank kept your card. A waiting operator, who has watched your PIN entries via shoulder-surf or camera, extracts the trapped card and uses it before you can call your issuer to freeze it.

Defense: if your card does not return within 30 seconds, do NOT walk away. Stand at the machine and call your issuer. Most reported in: Prague Wenceslas, Bucharest Old Town, Sofia city center.

Where it runs

ATM skimming concentrates where two conditions overlap: dense tourist foot traffic and prevalence of non-bank ATMs. Western Europe and Southeast Asia account for over 70% of documented variants.

Country	Documented variants	Iconic location pattern
🇫🇷 France	8	Paris Champs-Élysées and Marais standalones · Marseille Vieux-Port · Nice Promenade des Anglais
🇮🇹 Italy	6	Rome Termini standalones · Florence Duomo perimeter · Venice San Marco private ATMs
🇪🇸 Spain	6	Barcelona Las Ramblas and Gothic Quarter · Madrid Sol-area private ATMs · Seville Santa Cruz
🇹🇭 Thailand	5	Bangkok Sukhumvit and Khao San private ATMs · Phuket Patong · Pattaya Walking Street
🇨🇿 Czech Republic	4	Prague Wenceslas Square · Old Town private ATMs · near-Charles-Bridge standalones
🇲🇽 Mexico	4	Cancún Hotel Zone private ATMs · Playa del Carmen Quinta Avenida · Mexico City Roma
🇮🇩 Indonesia	3	Bali Kuta and Seminyak private ATMs · Ubud monkey-forest perimeter
🇷🇴 Romania · 🇧🇬 Bulgaria	3	Bucharest Old Town · Sofia city center · Lebanese-loop heavy

Bar width is data-bound at 10 pixels per documented variant. The eight countries above account for 39 of 45 total variants, or 87% of the global atlas.

Four more cities, four more variants

The Champs-Élysées scene above showed the shoulder-surf and card-swap stack. Here are four more cities where different sub-variants dominate. Each links to the full city scam guide.

Barcelona, Spain · Las Ramblas & Gothic Quarter Overlay Skimmer · Pinhole Camera

Barcelona Las Ramblas standalone ATM comic, tourist using a non-bank ATM with the skimmer overlay visible on the slot

You step off Las Ramblas into a covered passageway housing a standalone ATM in front of a souvenir shop. The screen shows the bank network logos and "International Cards Welcome." The slot looks normal but the faceplate around it is a slightly off-color beige. You wiggle the slot before inserting; it rocks. The overlay comes off in your hand. The Las Ramblas and Gothic Quarter perimeter run overlay-skimmer hardware on standalones near Plaça de Catalunya, the Liceu Metro entrance, and the small alleys feeding off Carrer de Ferran. Pinhole cameras above the keypad pair with the overlay; the combination captures both stripe and PIN. The Mossos d'Esquadra publish quarterly card-fraud arrest numbers; Las Ramblas accounts for 30 to 40% of Barcelona's tourist-card-fraud incidents. Defense: walk back up Las Ramblas to the BBVA, Santander, or CaixaBank branch ATMs around Plaça Catalunya. The 200-meter walk saves four-figure cloning losses. The Mossos Tourist Help line at +34 932 903 000 takes English-language reports.

Read the full Barcelona scam guide →

Bangkok, Thailand · Sukhumvit & Khao San Private-ATM Machine

Bangkok Sukhumvit pharmacy ATM comic, tourist using a private ATM inside a 7-Eleven-style mini-market while a clerk watches behind the counter

You walk into a 24-hour mini-market on Soi Sukhumvit 11 at 11pm because the BTS Asok station ATMs are gated after midnight. The mini-market has a standalone ATM near the back, branded "AEON" or "Easy Pass" or just "ATM" with no bank logo. You withdraw 5,000 baht. Two days later, your bank flags 80,000 baht in transactions you did not authorize, all stamped Bangkok. The Sukhumvit and Khao San private-ATM circuit is documented through Bangkok Post, Khaosod English, and r/Thailand threads as the highest-density skimming exposure in Southeast Asia. The Tourist Police Bangkok line at 1155 (24/7, English-speaking) accepts card-fraud reports; the report number is what your card issuer needs for chargeback under Visa/Mastercard zero-liability. Defense: Bangkok Bank, Kasikornbank (KBank), and Siam Commercial Bank (SCB) operate 24/7 ATMs at most BTS stations and major shopping centers (Terminal 21, EmQuartier, ICONSIAM). The Bangkok Bank ATM at Asok station is open round-the-clock and is the canonical safe alternative to Sukhumvit private ATMs.

Read the full Bangkok scam guide →

Prague, Czech Republic · Wenceslas Square & Old Town Lebanese Loop Card Trap

Prague Wenceslas Square ATM Lebanese loop comic, tourist standing at a private ATM with card stuck in the slot

You insert your card at a standalone ATM at the bottom of Wenceslas Square at 9pm. The PIN works. Then the machine displays "Card retained" and your card does not return. You walk away assuming the bank kept it for some routine reason. A man who has been watching from a doorway moves in, slides a thin tool into the slot, and extracts your card; he has your PIN from a hidden camera in the faceplate above the keypad. By the time you call your bank from the hotel, six transactions across Prague's private ATMs have already drawn your daily limit. The Wenceslas Square and Old Town areas (around Staromestske Namesti and the Charles Bridge approaches) run Lebanese-loop hardware most consistently. The Czech Tourist Police accepts complaints at the Old Town station off Bartolomějská; Česká spořitelna and ČSOB are the safer alternatives, with branches at Wenceslas nám. and Nám. Republiky. Defense: if your card does not return within 30 seconds, stand at the machine and immediately call your issuer's 24/7 fraud line on the back of any other card you have. Most banks can flag the card mid-trap.

Read the full Prague scam guide →

Nice, France · Promenade des Anglais & Vieille Ville Overlay Skimmer · Beach-Promenade ATMs

Nice Promenade des Anglais ATM skimming comic, tourist at a beachfront standalone ATM with palm trees and the Mediterranean visible in the background

You walk along the Promenade des Anglais at sunset. A standalone ATM sits in a small kiosk between two beachfront cafés, branded with the colors of a major French bank but missing the actual bank's logo. You wiggle the slot, it shifts. Skimmer hardware is fitted snugly inside the kiosk. The Vieille Ville (Old Town) of Nice and the eastern stretch of the Promenade between the Negresco and the Casino Ruhl run overlay-skimmer hardware seasonally; the operator crews follow the cruise-ship calendar from May through October. The Police Nationale Nice tourist help desk at the Hôtel de Police on Avenue Maréchal Foch accepts English-language reports. The Crédit Agricole and BNP Paribas branches at Place Masséna are 200 meters off the Promenade and have 24/7 ATM access. Defense: the standalone-on-the-Promenade pattern is the tell. Walk inland one block to a major-bank branch.

Read the full Nice scam guide →

Red flags

If two or more of these signals fire when you approach an ATM, walk to the next major-bank branch instead. The compounding rule: a single signal might be a coincidence; two signals are a script.

Standalone ATM in a recessed alcove, dimly lit doorway, or off the main pedestrian flow
ATM branded generically ("ATM" or "Cash" or no logo) without a major-bank name
The card slot wiggles or rocks when you push it gently
The faceplate around the slot is a slightly different color than the rest of the machine
The PIN keypad feels mushy or has visible plastic seams (keypad overlay)
A small pinhole or unusual marking on the faceplate above the keypad
A handwritten or laser-printed sign near the machine ("use this one" or arrow)
Someone approaches you mid-transaction with a dropped bill or asked direction
Your card does not return within 30 seconds of completion
The transaction receipt does not print at all, or prints partially

The phrases that shut it down

ATM skimming refusal is mostly non-verbal: walk away from suspicious machines, cup your free hand over the keypad, do not engage with anyone who approaches. But a clean phrase ends the rare verbal-distraction approach immediately and signals to nearby travelers that something is happening.

French (France)

"Excusez-moi, je ne parle pas. Allez-vous-en."

"Excuse me, I'm not talking. Go away." For Champs-Élysées and Métro approaches; ends most distraction attempts.

Spanish (Spain · Latin America)

"Apartese del cajero, por favor."

"Step away from the ATM, please." Las Ramblas and Plaza Catalunya effective.

Italian (Italy)

"Si allontani dal Bancomat."

"Step back from the ATM." Termini, Trastevere, Florence Duomo.

Czech (Czech Republic)

"Odstupte od bankomatu, prosím."

"Step away from the ATM, please." Prague Wenceslas, Old Town.

Thai (Thailand)

"อย่ามาใกล้"

"yaa maa glai" (don't come close). Sukhumvit, Khao San, Sala Daeng BTS.

English (universal)

"Step back from the ATM."

Said firmly, eye contact. Operators move on; the gesture alone is the signal you have seen the play before.

Universal physical defense

Cover the keypad. Wiggle the slot.

No verbal needed. The two physical moves defeat overlay skimmers and PIN capture across all four sub-variants.

If card does not return

Stay at the machine. Call your issuer.

Do not walk away. Lebanese-loop trap depends on you leaving. Photograph the ATM, photograph the location, call the issuer's 24/7 fraud line on the back of any other card.

If you got hit

Your bank flagged a transaction you did not make, or your card was retained at an ATM and the machine wallet shows charges already posting. The first hour matters most: the cloned card will be used in cycles until you freeze it, and Visa/Mastercard zero-liability policies require you to report the unauthorized transactions promptly.

Within five minutes: call your card issuer's 24/7 international fraud line. The number is printed on the back of every card; save photos of every card back separately on your phone for exactly this moment. Freeze the card; the issuer will block all future transactions and reverse fraudulent ones.

Within thirty minutes: file a police report with the local tourist-police line. The report number is what most card issuers' fraud-investigation teams require for full reimbursement above a small threshold.

Paris: Préfecture de Police 17 (24/7); SARIJ commissariats including 10 boulevard Strasbourg-Saint-Denis; English-language reports accepted.
Barcelona: Mossos d'Esquadra Tourist Help, +34 932 903 000 (24/7, English).
Madrid: SATE (Sala de Atención al Turista Extranjero), Calle Leganitos 19, +34 91 548 8537.
Rome: Carabinieri 112; Polizia di Stato 113; Termini-area Polizia Ferroviaria 06-481-661.
Bangkok: Tourist Police 1155 (24/7, English-speaking).
Prague: Tourist Police, Městská policie Praha; Old Town station off Bartolomějská; English-language reports accepted.
Nice: Police Nationale Hôtel de Police, Avenue Maréchal Foch.

Within 24 hours: order a replacement card. Most major issuers (Amex, Chase, Capital One, Wise, Revolut) offer overnight emergency replacement cards via DHL or FedEx to your hotel. Premium-tier travel cards (Amex Platinum, Chase Sapphire Reserve, Capital One Venture X) include emergency cash-advance assistance up to $1,000–$2,500. Keep a backup card from a different network in a separate physical location, not your wallet, so a single compromise does not strand you. The Visa/Mastercard zero-liability policy covers all unauthorized transactions made before the freeze, with the police report as supporting evidence.

Related atlas entries

Sister entries in the Scam Atlas. ATM skimming overlaps with currency-related scams (where cash withdrawal is the trigger event) and with distraction-theft tactics (where the helpful-stranger approach pairs with PIN capture).

Sources

DailyMail, March 2025 investigation: 1 in 10 tourists to France scammed (212,000 across 5 years), with ATM fraud as a significant contributor.
Le Parisien, multi-year coverage of Champs-Élysées and Marais ATM skimming arrests (Paris, 2018–2025).
La Repubblica, Termini and Trastevere ATM-fraud reporting (Rome, 2020–2025).
El País and La Vanguardia, Las Ramblas card-fraud coverage with Mossos d'Esquadra arrest data (Barcelona, 2021–2025).
Bangkok Post and Khaosod English, Sukhumvit and Khao San private-ATM skimming reports (2022–2025).
European Card Payment Association annual fraud-rate-by-country reports (2023, 2024, 2025).
Czech Police Wenceslas Square card-trap arrest summaries (Prague, 2023–2025).
r/travel, r/Paris, r/spain, r/Thailand, r/Prague continuing thread monitoring 2018–2026.

Get the full ATM-safety playbook for your destination.

Each Travel Safety atlas covers every documented ATM-skimming variant in one country, plus the country's full scam catalog: taxi, restaurant, pickpocket, fake authority. Buy once, lifetime updates as scams evolve. $4.99 on Kindle.

France: Tourist Scams

Read on Kindle ↗ $4.99 Italy: Tourist Scams

Read on Kindle ↗ $4.99 Thailand: Tourist Scams

Read on Kindle ↗ $4.99

Frequently asked questions

ATM skimming is a card-cloning attack where a device captures your card data and PIN at a compromised ATM, then a clone of your card is used elsewhere within hours. Four sub-variants documented across 19 countries: overlay skimmers (a fake faceplate fitted over the real card slot), shoulder-surf PIN capture (an observer or hidden camera), private-ATM machines (standalone ATMs in pharmacies, mini-markets, and hotel lobbies with skimming hardware built in), and Lebanese-loop card traps (a thin plastic loop traps your card so an operator can extract it after you leave). The defense is the same for all four: use major-bank ATMs, wiggle the card slot, cover the keypad, stay at the machine until your card and receipt are in your hand.

Five tells, any one of which means walk away. (1) The card slot wiggles or has plastic play. (2) The faceplate around the slot is slightly off-color. (3) The PIN keypad feels mushy (overlay sitting on top of the real keypad). (4) A pinhole or unusual marking on the faceplate above the keypad. (5) The machine sits in a recessed alcove, dimly lit doorway, or off the main pedestrian flow.

No. Private ATMs in pharmacies, mini-markets, hotel lobbies, currency-exchange counters, and standalone street kiosks are the highest-risk category for tourist card fraud. The operator owns the machine, controls the cash, and can install skimming hardware permanently. Use major-bank ATMs only: BNP Paribas / Crédit Agricole / Société Générale / LCL (France), Intesa Sanpaolo / UniCredit (Italy), Santander / BBVA / CaixaBank (Spain), Bangkok Bank / Kasikornbank / SCB (Thailand), Česká spořitelna / ČSOB (Czech Republic).

A thin plastic loop is inserted into the card slot before your transaction. The loop grips your card so it cannot return. You attempt several PIN entries; the machine reports an error; you walk away assuming the bank kept your card. A waiting operator extracts the trapped card and uses it before you can call your issuer. Defense: if your card does not return within 30 seconds, stand at the machine and call your issuer's 24/7 fraud line on any other card you have. Most documented in Prague Wenceslas, Bucharest Old Town, Sofia city center.

Highest documented exposure in France (Paris Champs-Élysées and Marais standalone ATMs), Italy (Rome Termini, Florence Duomo, Venice San Marco standalone machines), Spain (Barcelona Las Ramblas and Gothic Quarter, Madrid Sol-area), Thailand (Bangkok Sukhumvit and Khao San, Phuket Patong, Pattaya Walking Street), Czech Republic (Prague Wenceslas Square private ATMs), Bulgaria (Sofia city center), Romania (Bucharest Old Town), Mexico (Cancún Hotel Zone), Indonesia (Bali Kuta and Seminyak).

Within five minutes of the alert, call your card issuer's 24/7 international fraud line and freeze the card. Within thirty minutes, file a police report with the local tourist-police line; the report number is what most issuers require for full reimbursement above a small threshold. Within 24 hours, order a replacement card; major issuers offer overnight emergency replacement via DHL or FedEx to your hotel. Keep a backup card from a different network in a separate physical location.

Mostly, but not completely. Chip-and-PIN (EMV) cards use a dynamic cryptogram for each transaction, so skimmed magnetic-stripe data is harder to clone for in-store payment. However, the magnetic stripe is still on every card and can still be skimmed; cloned stripe data can be used for online purchases or in-country transactions where merchants fall back to magnetic-stripe processing. The shoulder-surf PIN capture variant is unaffected by chip-and-PIN. Defense in depth: chip-and-PIN cards, cover the keypad, prefer tap-to-pay where available, and enable real-time fraud alerts.

All three work, with trade-offs. Wise and Revolut multi-currency cards offer real-time fraud alerts, instant card freeze in-app, and the ability to load a separate sub-balance for the trip. Home-bank cards typically have stronger fraud-reimbursement protections under domestic banking law. Best practice for travel: carry both. Use a Wise/Revolut card as the daily ATM card with a low loaded balance; keep the home-bank card as backup in the hotel safe. Set both to push real-time transaction alerts.

ATM skimming, four ways your card gets cloned.