With the Christmas season in full swing, many of us will be out shopping and spending, trying to get those last few items to put under the Christmas tree. But while you’re out trying to find the best deals, or the last Hatchimal on the shelf, you need to be careful.

The Christmas season isn’t just busy for businesses, it’s also a favorite time of the year for fraudsters and crooks.

The majority of retail transactions these days are handled through debit or credit cards. And why not? Debit and credit cards are convenient, portable, and lack the immediate risk that cash carries. If you happen to drop your card while out shopping, all you need to do is go to the bank and replace it. If you drop a $50 bill on the ground, it’s gone for good. So there are plenty of good reasons to carry less and less cash these days and depend more and more on your plastic.

However, that doesn’t mean debit and credit cards are risk free. While on the whole safer than just carrying loose cash, there are some sneaky skimming and cloning scams you should watch out for, particularly during this holiday season.

What is skimming?

Skimming is a type of fraud that tricks the victim into unknowingly handing over their debit card info and PIN to a criminal. Most often, this is done by a thief superstitiously installing a device into, or over, the part of a normal Interact or ATM reader that accepts your card. This device reads the identifying info on your card, allowing the thieves to either make online purchases using the info, or create a dummy version of the card. Depending on the type of skimmer, they’ll either have a fake keypad that records your PIN number as you input it, or a nearby camera set up to spy on the key pad.

Most skimming scams prey on soft targets. Thieves need to be able to compromise a device and install their skimming hardware, so they’ll often target gas station pumps, isolated ATMs, parking lot tills, and other card readers that are likely to be out of sight and poorly monitored. However, there are certainly plenty of cases out there of daring thieves compromising readers in busy retail stores and chain restaurants. The hustle and bustle around the self-checkout line at a major big box store can provide just enough distraction to let a thief sabotage a card reader, and wait staff often leave customers alone with debit paddles as they pay so they can serve other tables.

Worst of all are retailers who operate in bad faith and either compromise their payment systems themselves, or collude with a scammer for a cut of the take. This is most common with fly-by-night businesses for obvious reasons. Pop-up stores, booths, temporary ATM placements, and so on.

In the context of the holiday season, that can count for a lot of different businesses! Think about all the temporary kiosks that pop up in the mall, the arts and crafts shows and county fairs, the tree lots and jewelry crafters that show up for a month and move on. Of course, the vast, vast majority of these businesses are on the up-and-up, but it only takes one bad actor to compromise your accounts!

How to protect yourself

So how do you protect yourself from skimming and cloning? There are a few simple rules.

One, learn the tell tale signs of a skimmer. This isn’t always easy, many sophisticated skimmers are nearly indistinguishable from the real deal, but there are some clues. First, look for any obvious cracks, suspicious scratches, or other signs of tampering. If the reader feels loose or somehow off, don’t use it. Find another pump, ATM, or tell the shop keeper you’ll come back with cash. Better to put up with a little inconvenience than risk having your bank account cleaned out just before Christmas.

If your card feels like it is sliding too deep into a Interact paddle (so much that you’re only holding on by the edge of the card), that is a pretty good sign of a skimmer. If that happens, don’t put your PIN in. Inform the cashier or waiter and ask for a different paddle. If there are other paddles or tills available, compare the paddles for how far the card goes and check for any other sign of tampering (a slightly different colour of plastic, missing or broken seals, etc).

Two, and this may sound a little silly, but give your card a wiggle and block the PIN pad. A common technique to disguise a skimmer is to place a small plastic shell around them. However, these are quickly installed and often only superficial. A little wiggle is sometimes all it takes to knock one of these off and reveal the skimmer. Like I said, it’s silly, but this technique is recommended by the Secret Service so there must be something to it!

Covering your PIN when nobody is over your shoulder may make you feel like you’re being overly-paranoid, but remember that many skimmers rely on a secondary camera to see your PIN. Without that number, it’s much harder to directly scam a card (likely making it too much effort of the thief).

Third tip: Avoid shady situations by planning ahead. If you know you’re going to be out shopping, it might be wise to swing by a trusted bank ATM that is unlikely to be compromised and draw out a few bills before you go. That way you won’t be stuck later having to draw from a fly-by-night ATM found in the hallway to the washrooms at the mall, or paying debit at a pop-up street vendor during the Christmas parade.

Finally, keep in mind that you should always handle your card yourself and never let it out of your sight. This is especially true for credit cards. If you’re buying something and the clerk tells you they’ll be right back with your card, or is overly insistent on handling the debit paddle, inserting your card, and only letting you hit the buttons – it’s time to slam on the brakes! Maybe there is an innocent reason for that behavior, but why take the chance? Any time your card is out of sight is a chance for it to be copied. A paddle you can’t examine yourself is one that can’t be trusted. It’s worth being slightly impolite and being “that customer” than to let someone run a con on you.

Like Santa, check your list twice

Hopefully with a little awareness you’ll be able to make it through the holidays unscathed. But just in case you slip up or get unlucky, be sure to carefully monitor your bank and credit card statements through the holidays and afterward!

The best way to deal with a fraud situation is to report it quickly and accurately to your bank. The faster you spot a illegitimate charge on your bank account or credit card, the better the resolution is likely to be. Not all account thefts go for the jugular immediately. Many will wait until after some time has passed from when the card was stolen to confuse investigation efforts, while others will opt for a series of small monthly thefts (maybe only $10 or $20 a pop) in the hopes that you won’t notice the charges and they’ll be able to skim on a long term basis (this is more common with mass breached accounts, but is still something to watch out for). It’s important to keep a close eye on your statement for any irregularities.

If you can, try and keep track of when and where you use your card during the holiday season. A small notebook with the date, place, and amount spent can be a lifesaver when you’re reviewing your statement later and trying to decide if this weird $15 charge is a scam, or just that time you bought lunch at the little shawarma place you never usually go to.