The Clone Wars: How Shimmers Copy Your Card, and Why Cloning Still Pays

Fraud Intel · Threat brief · Shimming and card cloning

Chip cards were supposed to end card cloning. Instead, criminals moved inside the chip reader. A shimmer is a circuit as thin as a sheet of paper that slides into a card slot and sits between your card's chip and the terminal. You cannot see it, the terminal still works, and every card you insert is quietly copied. The stolen data is then written onto counterfeit cards, a crime known as card cloning.

The data tells a striking story. Where card systems have stopped trusting static card data, cloning has nearly vanished. Where they haven't, it is still a billion-dollar business.

Skimming, shimming and cloning: what's the difference?

These terms are often used interchangeably, but they describe different steps in the same crime:

Anatomy of a shimming attack

1. Install. A criminal slides a shimmer into the card slot of an ATM, gas pump or store terminal using a thin insertion tool. It takes seconds, and nothing looks out of place.
2. Harvest. Each time a customer inserts a card, the shimmer records the chip data passing through the reader. A hidden camera or keypad overlay may record the PIN at the same time.
3. Collect. The data is downloaded later, often wirelessly over Bluetooth from nearby, so the criminal never has to touch the machine again.
4. Clone. The data is encoded onto blank magnetic-stripe cards or sold in bulk to other criminals.
5. Cash out. Cloned cards are used where stripe transactions are still accepted, such as ATMs and terminals that allow a card to "fall back" to swiping when the chip read fails, often hundreds of miles from where the card was copied.

The U.S. Secret Service describes the result plainly: criminals encode captured data onto blank cards, and "these copycat cards are then used to make fraudulent purchases."

If the chip is secure, why does shimming work?

A chip can sign a payment that cannot be copied. But most cards still carry data that can.XINTCARD FRAUD INTEL

A chip card does two different things. For each payment it generates a one-time cryptographic code, which a shimmer cannot reuse. But the chip also stores static data, including a copy of the card number and other details, that is read in every transaction. That static data is what a shimmer harvests.

On its own, the copied chip data cannot produce a working chip clone. It becomes valuable wherever card systems still accept a magnetic stripe or don't check the stripe data carefully:

• Fallback transactions. When a chip read "fails", many terminals and ATMs let the card be swiped instead. Criminals can trigger this on purpose.
• Stripe-only acceptance. ATMs, fuel pumps and terminals in some places still read only the magnetic stripe.
• Weak checks. Card issuers can spot chip-derived data written onto a stripe, but only if every issuer and processor checks for it on every transaction.
• Cards with no chip at all. Many U.S. food assistance (EBT) cards still have only a magnetic stripe, making them easy to clone. Families lost $470 million in SNAP benefits to electronic theft in 2025.

The evidence: what happens when static data stops working

Europe offers the clearest natural experiment. Its card systems moved to chip-and-PIN years ago and treat magnetic-stripe transactions with deep suspicion. The European Association for Secure Transactions (EAST), which collects terminal fraud data from across the continent, reports what happened next:

In 2024, nearly all remaining losses came from skimming, recorded as international losses: fraud on European cards outside the region, where stolen data can still be cashed out. By 2025, skimming in Europe had become so rare that EAST stopped reporting skimming losses altogether. In the UK, UK Finance describes counterfeit card fraud as "all but eradicated", at around £4 million in 2024, and credits chip technology.

The United States tells the other half of the story. FICO counted more than 243,000 U.S. debit cards compromised by skimming in 2025, with compromise events up 90%. The Secret Service ran 22 operations in 2025, visited more than 9,000 businesses and removed 411 devices. The FBI estimates skimming costs U.S. consumers and banks more than $1 billion a year. Cloning survives wherever the stripe and static data still work.

The next frontier: relay attacks

Criminals adapt. As copying card data stops paying in Europe, EAST reports a shift to data relay attacks, which exploit genuine transactions instead of copying cards:

Relay attacks show where the fight is heading. Copying static data is getting harder, so criminals try to borrow a live card in real time. The answer is the same principle taken further: every payment must be verified as it happens, checking who is paying, where and how, not just whether the card data is valid.

What actually defeats cloning

XintCard is designed around exactly this list: no magnetic stripe, no static card number, keys sealed inside a secure chip that never hands them over, a one-time cryptogram for every payment, and real-time verification of each transaction. A shimmer could sit in the slot all day and record nothing worth cloning. Launch a cloning attack in our simulator and watch it fail.

Field guide: protect yourself from shimmers

Shimmers are almost impossible to spot, so focus on habits that make them useless:

1. Tap instead of inserting your card, or pay with a phone wallet. A shimmer only works when the card goes into the slot.
2. Notice a tight slot. If your card feels unusually stiff going in or coming out, stop and use another machine.
3. Prefer bank ATMs inside or attached to a branch, which are inspected far more often than standalone machines.
4. Cover your PIN every time. A cloned debit card is far more dangerous with your PIN.
5. Be wary of "chip not working, please swipe". If a terminal keeps asking you to swipe, pay another way.
6. Never type your card details or PIN into a link sent by text or email. That is how card-to-terminal relay attacks begin.
7. Turn on instant alerts so you see a cloned card in use within seconds, not weeks.
8. On EBT cards, lock your card between uses if your state's EBT app allows it, and change your PIN regularly.

If you think your card was cloned

• Call your card issuer at once, using the number on the back of your card, to block it and dispute fraudulent transactions. With debit cards especially, reporting fast protects your right to recover the money.
• Change your PIN and get a new card with a new number.
• Tell the business where you think the card was copied so the terminal can be checked, and report the fraud to the Federal Trade Commission at reportfraud.ftc.gov.

The bottom line

Cloning doesn't need to be outsmarted. It needs to be starved. Europe shows that when static card data stops working, skimming and cloning collapse, from €173 million in losses to €3 million in two years. America shows what happens when it doesn't: hundreds of thousands of copied cards and a billion-dollar annual bill. The fix is a card that carries nothing worth copying and checks every payment in real time. That is the card we are building. Join the XintCard early-access list.

Sources

1. U.S. Secret Service, "Inside Our Nationwide Crackdown on Card Skimming and Fraud", January 2026.
2. EAST, "Data relay attacks drive up European terminal related fraud incidents", April 2026.
3. EAST, "European Terminal Fraud attacks double", April 2025.
4. Business Expert, "UK Payment Fraud Statistics", citing UK Finance's Annual Fraud Report 2025.
5. FICO Card Alert Service 2025 data and the FBI estimate, as reported by TechTimes, July 2026.
6. ProPublica, "Scammers Are Stealing Millions From Food Stamp Recipients", October 2026.