Good Carder
Professional
- Messages
- 938
- Reaction score
- 533
- Points
- 93
From carder to carders. While everyone else is struggling with API carding and 3DS bypasses, a quiet alley near an ATM continues to bring in cash. Skimming is hardcore, analog cash-out, but physical access to a payment terminal is the ultimate, where a miscalculation in the OPSEC system leads not to an account ban, but to actual handcuffs.
Skimming is the theft of data from a card's magnetic stripe, which is still used in the US, at gas stations, and in older ATMs. According to reports, the payment skimming market is estimated at $4.49 billion in 2026, showing steady growth (CAGR 12.5%). Europe is also experiencing turmoil, with the number of skimming attacks increasing by 24%.
In this article, we'll explore why the magnetic stripe is still around, what equipment is needed to clone a card, the most vulnerable devices (NCR, Diebold, gas stations), cash-out schemes using clones, and how the police catch those who install counterfeit cards.
Where it's still used: The US, Canada, gas stations, older ATMs, and some POS terminals in hotels and restaurants. In Europe, the magnetic stripe is slowly dying out, but skimmers still capture data at tourist ATMs and gas stations.
Shimming is a cruel joke of evolution: terminals have switched to EMV (chip), but cards haven't yet. The device is installed inside the card reader and is nearly impossible to see without a special flashlight. Finding a shimmer in an ATM is only possible if you know where to look.
Attackers use modified NFC apps (NGate, NFCGate) to intercept and relay contactless card data to a remote payment terminal. Popular in Brazil (since November 2025), observed in China (January 2026).
This is no longer a "skill," but an industrial method. Comparison:
Custom kits are sold on closed darknet forums, and shipping is charged separately (sometimes up to $500 per shipment).
1. Installation. You go to the ATM and spend 5-10 minutes installing the skimmer cover and PIN skimmer. You use gloves, a balaclava, and a rental car. Work in pairs: one sets it up, the other monitors the situation. The best time is early morning (4:00–6:00) or late evening (10:00–12:00), when traffic is minimal.
2. Collection. The skimmer accumulates tracking data. The PIN skimmer records PIN codes. Return in 2–7 days and remove the equipment. To avoid being detected, use Bluetooth skimmers with remote data reset.
3. Cloning. In a home workshop or in your car, transfer the tracks to clean white plastic using the MSR206. If there's a PIN, the card is ready for ATM withdrawals. If not, use it in stores like a regular card until fraud monitoring is triggered.
4. Drain. Look for ATMs without cameras or with cameras covered by a visor, and use the card's daily limit. Use a hat, glasses — any disguise. With a card with a limit of 1,000, you can withdraw 1,000 from one ATM and $500 from another.
5. Launder. The received cash needs to be converted. Either exchange it for cashless currency at exchange offices (loss of 10-20%), or use it to purchase goods for subsequent resale.
Never approach an ATM without a disguise. Wear a baseball cap, glasses, a balaclava — anything that will hide your face from cameras. ATM cameras are ubiquitous these days, and your face will be the first thing reported to the police. Work with a spotter. Rent a car, don't use your own. Ideally, a stolen car, where the owner cannot be traced.
Use Bluetooth skimmers with remote data reading. Don't return to the ATM if you can retrieve the data over the air. Only approach the ATM to install and remove it, and don't leave it for weeks.
Use clean ATMs in areas with poor video surveillance. Avoid ATMs in rural areas, at gas stations, and in shopping malls with poor cameras. Don't work near police stations. Wash
your power tools. Clean your equipment of fingerprints after use (with alcohol or wipes). Store skimmers, MSR206s, and plastic in a rented garage, not at home. No one will want to testify during a search.
Banks are increasingly abandoning magnetic stripes, migrating customers to chip cards. But older ATMs are still in use, and as long as they are, skimming will continue.
American gas stations are easy money, but security there can be unexpectedly vigilant. European tourist areas are high-risk, but also highly trafficked. Shimming is a long-term game; results may come in a week, or they may not come at all.
The main rule: don't be greedy. Withdraw a thousand — leave. Don't try to cash everything in one place. Change your disguise, change your car, change your ATM. And never, do you hear me, never approach an ATM without a mask.
A quick one-line reminder:
"An NCR card reader overlay costs €8,000, a custom pin pad costs €1,500, an MSR206 for recording costs €250, and a plastic card costs 2. Selling tracks on the darknet pays for itself in a week. But a pair of handcuffs is free. Skimming is alive as long as the magnetic stripe is alive. And as long as there are fools who approach an ATM without a balaclava."
Skimming is the theft of data from a card's magnetic stripe, which is still used in the US, at gas stations, and in older ATMs. According to reports, the payment skimming market is estimated at $4.49 billion in 2026, showing steady growth (CAGR 12.5%). Europe is also experiencing turmoil, with the number of skimming attacks increasing by 24%.
In this article, we'll explore why the magnetic stripe is still around, what equipment is needed to clone a card, the most vulnerable devices (NCR, Diebold, gas stations), cash-out schemes using clones, and how the police catch those who install counterfeit cards.
Part 1: The Difference Between Skimming, Shimming, and NFC Relays
Before you go to the ATM with a screwdriver, figure out what exactly you're dealing with.1.1. Skimming (Magstripe Skimmer)
What it is: A card reader attachment that reads data from the magnetic stripe as you insert your card. The magnetic stripe data (tracks 1 and 2) contains the card number, expiration date, and sometimes the cardholder's name — everything needed to clone the magnetic stripe onto clean white plastic.Where it's still used: The US, Canada, gas stations, older ATMs, and some POS terminals in hotels and restaurants. In Europe, the magnetic stripe is slowly dying out, but skimmers still capture data at tourist ATMs and gas stations.
1.2. Chip Shimmer
What is it? An important clarification: a credit-card-thick shimmer is inserted directly into the card reader slot, intercepting traffic between the chip and the terminal during authentication. However, it cannot create a full clone of the chip — it only reads data sufficient to clone the magnetic stripe.Shimming is a cruel joke of evolution: terminals have switched to EMV (chip), but cards haven't yet. The device is installed inside the card reader and is nearly impossible to see without a special flashlight. Finding a shimmer in an ATM is only possible if you know where to look.
1.3. NFC Relay Attacks (Ghost Tap, NFCGate)
What is it: A software and hardware method for contactless theft via an Android smartphone. Ghost Tapped exploits NFC on Android devices to commit remote fraud without physical access to the victim's bank card. According to Group-IB, at least $355,000 in illegal transactions were recorded from a single POS vendor between November 2024 and August 2025.Attackers use modified NFC apps (NGate, NFCGate) to intercept and relay contactless card data to a remote payment terminal. Popular in Brazil (since November 2025), observed in China (January 2026).
This is no longer a "skill," but an industrial method. Comparison:
| Attack Type | What steals | Where is it placed? | Complexity |
|---|---|---|---|
| Skimming | Magnetic stripe | Card reader cover, outside | Low |
| Shimming | Chip data | Inside the card reader | High |
| NFC relay | Contactless data | Remotely, via software | Average |
Part 2. Equipment: From a $315 card reader to an €8,000 overlay
The skimming equipment market is a distinct industry. Darknet vendors offer everything from simple portable devices for collecting tracking data to custom attachments for specific NCR and Diebold ATM models.2.1. Pocket Skimmers
This is the simplest way to collect data, requiring almost no physical contact with the ATM. A pocket skimmer is a small magnetic device that reads and stores tracking data from a card with a simple swipe. This miracle costs about $315 (US). The pocket skimmer can store data for up to 2,048 payment cards and read numbers from a phone.2.2. Custom ATM Skimmer Overlays
This is the most expensive and professional segment. Overlays are 3D printed for a specific ATM model — NCR 5886, Diebold, Hyosung. The price of a custom kit reaches €8,000 including delivery. The kit includes: a card reader overlay (copying the original design down to the smallest detail), a PIN pad overlay (with a micro-camera or membrane keypad), and a Bluetooth module (for remote data collection without re-visiting the ATM).Custom kits are sold on closed darknet forums, and shipping is charged separately (sometimes up to $500 per shipment).
2.3. Card cloning equipment
Once you have the tracks from the magnetic stripe, you need to transfer them to clean plastic. To do this, you'll need:- The MSR206 is the gold standard for magnetic stripe recording. It costs about 2450 (pre-assembled). However, you can build one yourself: you'll need an Arduino Pro Micro (MicrochipATMega32u4), a small OLED display, and a power module. Total price: 30-50.
- Blank white plastic with a magnetic strip: 1–2 per card when purchased in bulk. Embossed clones (pre-printed numbers) cost 10–20 per card (usually sold on the darknet with delivery from China).
2.4. Collecting data from infected terminals
A Raspberry Pi connected to a terminal can intercept card data in real time. Attackers connect the Raspberry Pi to the terminal's internal USB port or install malware on the POS system that scrapes the memory in search of card data during a transaction.Part 3. Cash-out scheme: from card reader to clone
The entire process — from skimmer installation to cash withdrawal — is built on several stages. The more steps involved, the higher the risk of being detected, but also the greater anonymity.1. Installation. You go to the ATM and spend 5-10 minutes installing the skimmer cover and PIN skimmer. You use gloves, a balaclava, and a rental car. Work in pairs: one sets it up, the other monitors the situation. The best time is early morning (4:00–6:00) or late evening (10:00–12:00), when traffic is minimal.
2. Collection. The skimmer accumulates tracking data. The PIN skimmer records PIN codes. Return in 2–7 days and remove the equipment. To avoid being detected, use Bluetooth skimmers with remote data reset.
3. Cloning. In a home workshop or in your car, transfer the tracks to clean white plastic using the MSR206. If there's a PIN, the card is ready for ATM withdrawals. If not, use it in stores like a regular card until fraud monitoring is triggered.
4. Drain. Look for ATMs without cameras or with cameras covered by a visor, and use the card's daily limit. Use a hat, glasses — any disguise. With a card with a limit of 1,000, you can withdraw 1,000 from one ATM and $500 from another.
5. Launder. The received cash needs to be converted. Either exchange it for cashless currency at exchange offices (loss of 10-20%), or use it to purchase goods for subsequent resale.
Part 4. Vulnerable Devices and Geography (2026)
Skimming is a geographically dependent phenomenon. Wherever the magnetic stripe is still active, there are skimmers.4.1. USA
Skimming heaven. Gas stations (pay-at-the-pump), old Credit Union ATMs, terminals in restaurants and hotels, small retail stores — all of these still use magnetic stripes.4.2. Europe
In Europe, the magnetic stripe is dying, but not everywhere. According to reports, the number of skimming attacks on European ATMs has increased by 24%. Italy, Spain, Greece, and Eastern Europe are among the tourist destinations where data is still being hunted.4.3. Gas stations
The most vulnerable spot in the US. Outdoor pumps at gas stations are an easy target, as the terminals are located outdoors, unattended. Installing a skimmer takes 30 seconds. Gas stations often skimp on maintenance and don't update their terminals for years.4.4. Vulnerable ATM models
According to cybersecurity reports, the most popular ATM models among attackers are NCR, Diebold, and Hyosung. For each of these, there are ready-made 3D models of overlays that can be downloaded from the darknet and printed yourself. Custom kits can cost up to €8,000.Part 5. OPSEC for Skimmers: How to Avoid Getting Caught
Skimming isn't just "push a button and get the money." Every mistake in OPSEC carries a real risk of being investigated.Never approach an ATM without a disguise. Wear a baseball cap, glasses, a balaclava — anything that will hide your face from cameras. ATM cameras are ubiquitous these days, and your face will be the first thing reported to the police. Work with a spotter. Rent a car, don't use your own. Ideally, a stolen car, where the owner cannot be traced.
Use Bluetooth skimmers with remote data reading. Don't return to the ATM if you can retrieve the data over the air. Only approach the ATM to install and remove it, and don't leave it for weeks.
Use clean ATMs in areas with poor video surveillance. Avoid ATMs in rural areas, at gas stations, and in shopping malls with poor cameras. Don't work near police stations. Wash
your power tools. Clean your equipment of fingerprints after use (with alcohol or wipes). Store skimmers, MSR206s, and plastic in a rented garage, not at home. No one will want to testify during a search.
Section 6. Skimming Protection (for merchants and users)
Banks and ATM manufacturers aren't sleeping either. In 2026, the first fully functional anti-skimming technology, Diebold ActivEdge, was released. It's the first card reader to prevent all known forms of skimming. ActivEdge prevents the magnetic stripe from being read in the orientation required for skimming, rendering standard skimmers useless.Banks are increasingly abandoning magnetic stripes, migrating customers to chip cards. But older ATMs are still in use, and as long as they are, skimming will continue.
Resume from a carder
Skimming isn't high-tech, but it's alive and well as long as gas stations and old ATMs exist. Magnetic stripes are a security hole that feeds thousands of carders worldwide.American gas stations are easy money, but security there can be unexpectedly vigilant. European tourist areas are high-risk, but also highly trafficked. Shimming is a long-term game; results may come in a week, or they may not come at all.
The main rule: don't be greedy. Withdraw a thousand — leave. Don't try to cash everything in one place. Change your disguise, change your car, change your ATM. And never, do you hear me, never approach an ATM without a mask.
A quick one-line reminder:
"An NCR card reader overlay costs €8,000, a custom pin pad costs €1,500, an MSR206 for recording costs €250, and a plastic card costs 2. Selling tracks on the darknet pays for itself in a week. But a pair of handcuffs is free. Skimming is alive as long as the magnetic stripe is alive. And as long as there are fools who approach an ATM without a balaclava."
