Technology
How crooks use skimmers, shimmers to steal your money at ATM
Have you ever had your debit card or credit card information stolen from an ATM? If you have, you may have fallen victim to a skimmer. Tiny devices used by fraudsters called “skimmers” can be attached to ATMs and used to steal data off of your debit or credit card magnetic strip.
There’s also an even smaller device called a “shimmer” that can be installed by fraudsters into an ATM that steals data from your credit or debit card chip if you have a newer chip-based card. If you’re worried about falling victim to skimmers and shimmers, your first line of defense is to understand what these things are and how to keep yourself safe.
CLICK TO GET KURT’S FREE CYBERGUY NEWSLETTER WITH SECURITY ALERTS, QUICK VIDEO TIPS, TECH REVIEWS AND EASY HOW-TO’S TO MAKE YOU SMARTER
Two examples of skimmers (Dubuque Police Department) (Kurt “CyberGuy” Knutsson)
How does a ‘skimmer’ work?
Skimmers are fake card readers that can be installed on top of legitimate card readers and steal data from every person who uses the card reader. These can be found on ATMs, gas pumps and nearly any other card reader device out in the public. Breaking into an ATM is no easy feat, so thieves typically put skimmers on top of the already-existing card reader.
Even more disturbing, though, is that these thieves will also place a hidden camera somewhere near the keypad of the card reader so that they can capture PINs. Some criminals even place false number pads to capture PIN codes, eliminating the need for a hidden camera.
MORE: TIPS TO FOLLOW FROM ONE INCREDIBLY COSTLY CONVERSATION WITH CYBERCROOKS
Example of hidden camera, skimmer and keypad overlay (FBI) (Kurt “CyberGuy” Knutsson)
How to spot a skimmer
Luckily, there are a few tell-tale signs to see if an ATM you are using has been corrupted by thieves with a skimmer. The first step to spotting a skimmer is to pay close attention to the color of the card slot. Typically, on most ATMs, the card slot and ATM will be the same color. If you notice that there’s a bulky, differently-colored card reader, there’s a pretty good chance it’s a skimmer. Skimmers are also installed over the original card reader, so you might notice some dried glue or adhesive around the card reader. Never use a card reader, whether at a gas pump or an ATM, if you suspect a skimmer device has been installed over the original card reader.
MORE: HOW TO FIGHT BACK AGAINST DEBIT CARD HACKERS WHO ARE AFTER YOUR MONEY
Beyond skimmers, beware of the rise in shimming
Skimming is less prevalent than it used to be, but you still should always inspect the card reader and keypad of an ATM before using it, in case a crook has installed a skimmer on it. This is especially pertinent if you are traveling abroad, where skimmers are frequently used by thieves in major tourist areas. However, as skimmers have declined, a new way to steal card data has become popular, called “shimming.”
Example of shimmer (Royal Canadian Mounted Police) (Kurt “CyberGuy” Knutsson)
MORE: GOT A CREDIT CARD FRAUD ALERT? HOW CROOKS SWIPE YOUR PAYMENT CARD DETAILS
What are shimmers?
Skimmers typically don’t work on chip-based credit and debit cards, called EMV cards, which offer a more robust set of security features, such as double encryption between the chip and the magnetic stripe on the back of your card. As you might expect, however, thieves adapt quickly and have developed a system called “shimmers,” which can be used to steal the data from your chip-protected card.
Shimmers are paper-thin devices with a microchip installed on them that are inserted by thieves into ATMs. You can’t see a shimmer from the outside like you can a skimmer, and once you insert your card into the affected ATM, the shimmer steals your card data off the chip, the same way a skimmer would steal your data from the magnetic stripe.
Example of shimmer (Royal Canadian Mounted Police) (Kurt “CyberGuy” Knutsson)
GET MORE OF MY SECURITY ALERTS, QUICK TIPS & EASY VIDEO TUTORIALS WITH THE FREE CYBERGUY NEWSLETTER – CLICK HERE
How to keep yourself safe from shimmers
Shimmers, as we just discussed, are impossible to see from the outside of an ATM or other pay terminal, but there are still a few easy ways you can keep yourself from crooks using shimmers.
Tip #1 – Avoid non-bank ATMs
ATMs that are found in bars, convenience stores and other public places fall victim to card skimmers and shimmers more frequently due to their lack of security features when compared with bank ATMs. Bank ATMs are always the safest to use.
Tip #2 – Utilize contactless payments
An easy way to keep yourself safe when using pay terminals is to use contactless payment systems, such as Apple Pay, Google Pay, Venmo and PayPal, with your phone instead of inserting your card.
Apple Pay (Apple) (Kurt “CyberGuy” Knutsson)
MORE: BEST IDENTITY THEFT PROTECTION SERVICES 2024
Tip #3 – Activate bank alerts on your cards
You can activate mobile alerts on your cards through your bank’s mobile app, which will alert you to any charges being made. This can help keep you safe by quickly identifying any fraudulent charges that need to be canceled.
Bank alert (Bank of America) (Kurt “CyberGuy” Knutsson)
MORE: HOW TO EASILY ADD YOUR CREDIT CARDS AND LOYALTY PASSES TO YOUR IPHONE
Kurt’s key takeaways
Even if you do everything right and go over every inch of an ATM, you, unfortunately, can still fall victim to a shimmer. Always remember, if you suspect you’ve been a victim or credit or debit card shimming and skimming, report any fraudulent transactions to your bank immediately. You won’t be held liable, and your money will be returned to your account. Try to avoid using non-bank public ATMs as much as possible, and when possible, opt to use a contactless payment method instead of inserting your card reader into a terminal.
What additional security measures do you think could be implemented to protect consumers from skimmers and shimmers? Let us know by writing us at Cyberguy.com/Contact.
For more of my tech tips & security alerts, subscribe to my free CyberGuy Report Newsletter by heading to Cyberguy.com/Newsletter.
Ask Kurt a question or let us know what stories you’d like us to cover.
Answers to the most asked CyberGuy questions:
Copyright 2024 CyberGuy.com. All rights reserved.
Technology
Apple dials down Liquid Glass, and the Mac looks way better for it
MacOS 27 Golden Gate will usher in a bunch of changes to the Mac when it’s released later this year, with its biggest new features revolving around Siri AI. But for now, using the first developer beta, Siri AI is only offered through a waitlist. So what’s available to try is mostly about how the upcoming operating system looks and feels.
You’re not welcomed with any fanfare when you boot up the macOS 27 developer beta (that’ll probably come later), but there’s reason to celebrate. Jump to the appearance settings, and you find that Apple now has a Liquid Glass slider, allowing users to set the amount of UI transparency in macOS. On one end of the slider, it’s as seethrough as Liquid Glass gets, and on the other end the transparent accents are heavily frosted. Golden Gate starts you in the middle of the slider by default, for just a touch of frosting — perhaps a gentle admission that the original look went too far. You sadly can’t go fully opaque, but this frosted look does greatly reduce the distracting elements of Liquid Glass.
After spending just a short while with Golden Gate, I already prefer the minimum transparency look. I’d crank that slider in the full version and never turn back. For the strongest Liquid Glass haters out there, the Reduce Transparency option is still available in the Accessibility settings, but using it is like taking a hammer to all that glass — introducing lots of harsh gray and black backgrounds to the dock, Menu Bar, and Control Center.
The absolute wins for macOS 27’s design is the return of edge-to-edge sidebars with colorful icons and the increased corner radii of windows across the OS. The former is basically a backtrack to the way sidebars used to look (which looked better and easier to parse, with less wasted space). And the latter is just logical. How on Earth did Apple get so high on its own design supply that it allowed windowed apps to have mismatched corners?
I do have my nitpicks — the new battery icon taken from iOS is less legible (really, I hate it). Also, after Apple finally added the most basic window snapping feature in Sequoia, it hasn’t refined it one bit. Both Tahoe and now Golden Gate are leaving me wanting better and faster tiling controls like Windows 11, as well as the simple ability to rename virtual desktops. But so far, nothing.
Apple says Golden Gate is supposed to feel snappier, with faster search indexing. It’s too early to tell how much of a difference this makes on the MacBook Neo I’m testing it on — especially since dev betas are notoriously buggy and unstable. Using Spotlight search for local files on Golden Gate performed similar to another Neo I had on-hand running macOS 26 Tahoe. And opening apps on both systems side-by-side led to mixed results: Golden Gate opened Lightroom Classic and Slack faster, but Tahoe was faster to open Photoshop and Steam. I hope Apple’s under the hood improvements to memory and CPU usage will really show on the MacBook Neo, which could use all the efficiency it can get, but the jury’s out for now.
There’s still more to come with further beta releases of macOS 27, where we’ll at some point be able to fully test Siri AI, Visual Intelligence, and the revamped Spotlight Search. Last year’s power user-focused Spotlight with clipboard history was a nice improvement, but I’m skeptical that Siri AI being baked into Spotlight will be quite the gamechanger Apple’s billing it as. I’ll keep an open mind and be looking to find out once I’m off the waitlist.
For now, I’m relieved Apple is slightly backpedaling on Liquid Glass. While the look was never quite as bad on the Mac as it was on iOS, it’s a welcome change to be able to turn down these transparencies and get a little closer to the old looks from Sequoia. That and the other bits of UI polish are a nice upgrade on their own. Now, Apple has to show that it can nail all the new AI features, too — I’m eager to see how it fares.
Technology
AI voice scams can clone your family’s voice
NEWYou can now listen to Fox News articles!
Your phone rings. It’s your son’s voice. Panicked. He says he’s been in a car accident. He hurt someone. He’s about to be arrested. He needs $15,000 wired before the end of the day, and please, don’t tell anyone yet. You’d wire the money. Of course you would. Except it isn’t your son.
It’s a scammer who spent about 10 minutes online, pulled three seconds of audio from a Facebook video your son posted last Christmas, and fed it into an AI voice cloning tool that costs less than a Netflix subscription. The voice that broke your heart wasn’t real. The emergency wasn’t real. But the $15,000 transfer? That would have been.
This is already happening to families right now, in every state. And what most people don’t understand is that the voice clone is actually the easy part. What makes these attacks so devastatingly effective is everything that happens before the call.
Join CyberGuy Live: Lock Down Your Phone in 30 Minutes (Saturday, June 13, 10 am ET)
- Your phone holds your email, passwords, photos, banking apps and personal data. In this free, live online class, Kurt the CyberGuy will walk you step by step through simple phone security fixes you can do in real time. You’ll learn how to improve your privacy settings, spot the latest phone scams, use trusted security tools and walk away with a simple checklist to stay protected. Register here: CyberGuyLive.com
AI CYBERSECURITY RISKS AND DEEPFAKE SCAMS ON THE RISE
Data broker profiles can give scammers phone numbers, relatives’ names and addresses that make AI voice scams more convincing. (Matthias Balk/picture alliance via Getty Images)
The technology has crossed a terrifying threshold.
AI can now clone a person’s voice using as little as three seconds of audio, pulled from a social media video, a voicemail greeting, or a voice message. The technology copies tone, speech patterns, and accents closely enough that many people can’t tell the difference between a real voice and a fake one.
Three seconds. That’s shorter than it took you to read that sentence. AI scams surged 1,210% in 2025, and global AI scam losses could reach $40 billion by 2027. This isn’t a slow-building trend. It’s an explosion.
A new study found that 1 in 4 adults have already experienced an AI voice scam. One in four. That’s your neighbor. Your coworker. Someone in your family. But here’s the thing nobody’s telling you.
The voice clone is the last step, not the first
Every article you’ve read about AI voice cloning focuses on the technology. The scarily realistic audio. The three seconds of audio that’s “all they need.” What those articles miss is the setup that happens before the call. A voice clone is useless without answers to two questions: Whose voice do I clone? And who do I call with it?
To answer both of those questions, scammers don’t need to hack anything. They go to the same places anyone can access right now: data broker websites. Armed with your phone number and personal details from a data broker profile, scammers can call you directly and reference your name, address, or recent transactions to appear legitimate. Here’s the step-by-step process, because you need to know exactly how this works.
Step 1: They find you (or your family member) on a people-search site
A scammer types your name into Spokeo, BeenVerified, or Whitepages. Within seconds, they have:
- Your age and current address
- Your phone number
- The names of your relatives, including your adult children and elderly parents
- Where you all used to live
- Estimated household income.
They didn’t hack anything. They paid a few dollars. Or nothing at all.
Step 2: They identify the right target and the right voice to clone
Once they have your family network mapped, they make a decision: Who’s the most vulnerable person to call? And whose voice will make them act?
5 STEPS TO PROTECT YOUR FINANCES FROM FAMILY SCAMS
Often, the target is an elderly parent. The cloned voice is a grandchild or adult child. That combination of a panicked young voice and an older parent who loves them is the most reliably devastating pairing a scammer can manufacture.
Then they go looking for audio. A Facebook video from Thanksgiving. A YouTube clip of a school play. A TikTok your kid posted last summer. Three seconds is enough. The AI tool replicates pitch, cadence, accent, and emotional inflection.
Step 3: They script the emergency
This is where the call starts to feel personal. Data broker profiles can reveal more than your phone number. Scammers may find relatives’ names, rough ages, your city, your property address and other public record details. Then they use those clues to make the fake emergency sound believable.
Scammers introduce physical excuses, like a broken nose or a bad connection, to cover any slight artifacts in the AI voice, then create maximum urgency. The victim is directed to wire money, send cryptocurrency, or hand cash to a “bail bondsman” courier who arrives at the door.
The call sounds real because it was built on real information. Your mother picks up. She hears her grandchild’s voice, the right name, the right emotional register, the right panic. Her rational brain doesn’t stand a chance.
Cybersecurity researchers have noted that the emotional realism of a cloned voice removes the mental barrier to skepticism. When it sounds like your loved one, your rational defenses tend to shut down.
AI voice cloning scams can use short audio clips and public personal data to make fake family emergencies sound real. (Kurt “CyberGuy” Knutsson)
Real families. Real losses
In one documented case in Florida, a woman lost $15,000 after receiving a call from her “crying daughter.” She withdrew cash and placed it in a box, which a driver came to collect from her house. Another call, and a larger money request, soon followed.
The Trapp family in the San Francisco Bay Area received a frantic call from their “son” saying he’d been in a car accident, injured a pregnant woman, and needed urgent help. The scammers posed not only as the son but also as police, instructing the mother to quickly withdraw $15,000 and hand it to a courier already on the way. The family became suspicious just in time and called their son directly. They were the lucky ones.
Hiya’s Q4 2024 Global Call Threat Report found that one-third of survey respondents across the US, UK, Canada, Germany, France, and Spain encountered deepfake voice fraud in 2024 and 30% of those who encountered it fell victim.
“But I don’t post videos of myself online”
Neither did some of the victims’ families. You don’t need to be the one posting. Your grandchild’s TikTok account, your daughter’s Facebook, your son’s YouTube channel, or any public audio of them is all the scammer needs.
And even if your entire family has locked down social media? The data broker profile built on you, listing your phone number, your relatives’ names, and your address, is still there, still searchable, and still pointing scammers directly at the most vulnerable people in your network.
Here’s an uncomfortable truth: data brokers update their databases constantly. Your information can be pulled from voter registration records, property filings, court documents, marketing surveys, and loyalty programs, none of which require your permission. You likely have a profile on dozens of sites right now that you’ve never seen. You can run a free scan to see exactly how exposed you are. Results usually arrive within an hour.
SPRING CLEAN YOUR DIGITAL FOOTPRINT: WHY RETIREES ARE SCAM TARGETS
Why removing yourself from data brokers disrupts the entire attack chain
The voice clone is only one part of the scam. The targeting makes it work. When you remove your family’s information from data broker sites, you cut off the scammer’s research. They may lose access to your mother’s phone number, your relatives’ names or clues about who lives alone. Without that personal map, it becomes much harder to choose the right target and the right voice to clone.
Data broker profiles might link your mobile number to your home address and your relatives’ names. That makes family scams, now frequently enhanced by AI voice cloning, much easier for criminals to execute.
This is why I recommend using a data removal service. It can automatically send removal requests to hundreds of data broker and people search websites on your behalf. It can also keep monitoring and resubmitting requests when your data reappears. Because it will reappear. That’s how these sites work.
Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com
Get a free scan to find out if your personal information is already out on the web: Cyberguy.com/FreeScan
Scammers may clone a loved one’s voice, claim there is an emergency and pressure relatives to send money immediately. (Kurt “CyberGuy” Knutsson)
Five things to do right now
Beyond removing your data, do these things this week:
THE ONE THING THAT COULD PROTECT YOUR PARENTS FROM SCAMMERS
1) Create a family code word
Pick something random, “purple cactus,” “blue kettle,” anything unconnected to your actual life. Every family member agrees: any emergency call requesting money must include this word before anyone acts. Scammers cannot guess it. No data broker sells it.
2) Establish a callback rule
No matter how real a voice sounds, hang up and call the person back at their known number, not the number that called you. Real emergencies can wait two minutes for a callback. Scammers count on the panic preventing exactly this.
3) Lock down family members’ social media
Set profiles to friends only. Limit public videos. The less audio of your family that’s publicly available, the harder voice cloning becomes. Talk to your kids and grandkids about this specifically.
4) Warn your most vulnerable relatives directly
Don’t assume they’ll figure this out. Have a specific, explicit conversation: “If you get a call that sounds like me asking for money, stop. Ask for our code word. Call me back at my number. It might not be me.”
5) Never wire money, use gift cards, or hand cash to a courier based on a phone call alone
This is how every one of these scams ends. The payment method itself is the red flag. Legitimate emergencies don’t require Venmo, wire transfers, or a courier showing up at your door.
Kurt’s key takeaways
AI voice scams work because they sound personal. A scammer may only need a few seconds of public audio to copy a loved one’s voice and make a fake emergency feel real. However, the voice clone is only part of the attack. Scammers also use data broker and people-search sites to find phone numbers, family connections and personal details that make the call more convincing. That is why a simple family code word can help stop panic before money changes hands. So can a strict callback rule, locked-down social media and direct conversations with older relatives before a scammer calls. The best defense is to slow the moment down. Hang up, call your loved one directly and never send money, crypto, gift cards or cash to a courier based only on a phone call.
CLICK HERE TO DOWNLOAD THE FOX NEWS APP
If a phone call sounded exactly like someone you love asking for help, would you stop long enough to question it? Let us know by writing to us at Cyberguy.com
Sign up for my FREE CyberGuy Report
- Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox.
- For simple, real-world ways to spot scams early and stay protected, visit CyberGuy.com – trusted by millions who watch CyberGuy on TV daily.
- Plus, you’ll get instant access to my Ultimate Scam Survival Guide free when you join.
Copyright 2026 CyberGuy.com. All rights reserved.
Technology
Instagram is finally letting everyone reorganize their profile grid
Nearly a year after it was announced, Instagram says it’s delivering the ability to rearrange the posts in your profile grid. It had been available to some people in test groups, but as of June 8th, it’s rolling out widely via the Android and iPhone mobile apps.
Until now, the posts on your Instagram profile have been locked in chronological order beyond the ability to pin three posts at the top, but once the feature is live on your account, you can long-press and drag posts freely, no matter how old they are. Any posts that are pinned will remain at the top.
-
Finance2 minutes agoMarcellus Assets Create New Financing Possibilities
-
Fitness5 minutes agoI Ran 5K Every Day for 28 Days – Here’s What it Did to My Body, My Fitness and My Strength
-
Movie Reviews17 minutes ago‘Office Romance’ movie review: Jennifer Lopez and Brett Goldstein fail to prop up this confused, dreary rom-com
-
World25 minutes ago
A government-commissioned study found drinking risks. US guidelines didn’t feature its findings
-
Lifestyle1 hour ago‘Office Romance’ stars J.Lo as a CEO with a bad case of Brett Goldstein : Pop Culture Happy Hour
-
Technology1 hour agoApple dials down Liquid Glass, and the Mac looks way better for it
-
World1 hour agoUS adversaries China, North Korea strengthening ties as Xi, Kim set to begin talks
-
Politics1 hour agoTrump’s SAVE America Act shows signs of life in the Senate despite Republican revolt