Shimming devices are used to target chip-based cards in ATM fraud.

• A. True
• B. False
• C. Not common
• D. Only on mag-stripe cards

Answer: (A)

Shimming devices exploit the interface between an EMV chip and the ATM’s card reader. A thin shim can be inserted to interfere with how the reader communicates with the chip, allowing the attacker to access data from the chip or to simulate a mag-stripe interaction, which can be used to clone cards or obtain card data for fraudulent withdrawals. Because this technique targets the chip-based cards themselves, it is associated with chip-based ATM fraud. It isn’t simply a mag-stripe issue, and while not every ATM is vulnerable, shimming has been a real threat and is a reason for stronger tamper-detection and anti-shimming measures.