Card cloning / skimming : fonctionnement, signaux et que faire

Banking fraud · médio

In skimming, a device hidden in an ATM, fuel pump or card terminal reader copies the card's stripe, while a camera or fake keypad captures the PIN.

In digital cloning, data comes from fake sites, phishing, malware or store breaches. Criminals use the data for online purchases, make physical cards with copied stripes or sell the data on illicit markets.

They usually start with small purchases to test the card, then make larger purchases or withdrawals.

Sinais / Signs

Card reader that's loose, protruding or looks different.
Keypad raised or covered with an overlay.
Small unknown charges on your statement.
Purchase alerts from sites or countries you didn't use.
Card terminal taken out of your sight.

Prevenção / Prevention

Use contactless, a digital wallet or the chip rather than the stripe.
Cover the keypad when entering your PIN.
Turn on purchase notifications in your card app.
Use a virtual (ideally single-use) card for online purchases.
Prefer ATMs inside bank branches and busy locations.

O que fazer / What to do

Block the card in the app or through the official hotline immediately.
Dispute unrecognised charges with the issuer and request a new card.
File a police report (many Brazilian states accept online reports) and keep screenshots, receipts, numbers and links.
Change passwords for email, banking and social media, turn on two-step verification and sign out of other devices.
In the US, report to the FBI IC3 (ic3.gov) and the FTC (reportfraud.ftc.gov); if your identity was misused, follow the plan at identitytheft.gov.

FAQ

My card was cloned without leaving my hands. How?

The data may have been captured on a website, in a store breach, by a tampered reader or through phishing. Block it and dispute the charges.

Will the bank refund cloned-card purchases?

Unrecognised charges can generally be disputed. Report quickly; if refused, complain on Consumidor.gov.br or to Procon.

CERT.br — Cartilha de Segurança para Internet · Consumidor.gov.br · Finsiders — Golpes com Pix e boletos falsos (Datafolha/FBSP) · FTC — ReportFraud