If you’ve discovered unauthorized charges on your bank or credit card statement after using an ATM or gas pump, you may be a victim of card skimming. When criminals drain your debit card, they’re taking actual cash—sometimes a victim’s entire life savings. This isn’t a minor inconvenience; it can be a devastating, life-altering event that affects your ability to pay rent, buy groceries, or meet other basic needs. When the card that gets compromised is a credit card, the victim can also face serious consequences, including over limit fees and damage to his or her credit.

For many victims, the nightmare gets worse when their bank denies their fraud claim or refuses to fully reimburse them. Here’s what the banks often won’t tell you: federal law provides significant protections for consumers who are victims of card skimming. And if your bank has denied your claim or only offered a partial refund, they may be violating the law.

Many consumers wrongly assume that hiring a lawyer won’t be financially viable, either because they assume they will be asked for a sizeable retainer or because the loss they have suffered, while serious, may not be large in relation to the attorney’s fees that a lawyer will need to incur in order to protect the consumer’s rights. But because the relevant federal statutes provide for attorney’s fees, typical case resolutions include recovery of both the amount of the unauthorized charges and, in addition, fees and costs paid by the bank or card issuer. This changes the economics of obtaining qualified counsel to assist the consumer, and makes cases that would otherwise not be financially viable worth litigating.

What Is Card Skimming?

Card skimming occurs when criminals install hidden devices on ATMs, gas pumps, or point-of-sale terminals to capture your card data and PIN. According to the FBI, skimming costs financial institutions and consumers more than $1 billion every year.

These devices are designed to be nearly invisible. A skimmer may be a thin plastic overlay placed over the card slot, while a hidden camera or fake keypad captures your PIN. The stolen data is then used to create counterfeit cards or make unauthorized purchases.

The threat is real and ongoing. In recent prosecutions, the Department of Justice has obtained convictions against organized skimming rings operating across multiple states. In one case from the Eastern District of Missouri, five individuals were sentenced for installing skimming devices on ATMs in the St. Louis area. Investigators found a laptop containing hundreds of videos of customers entering their PINs. In another multi-state case, a criminal ring installed skimmers on gas pumps across Alabama, Louisiana, and Florida, using the stolen card data to purchase thousands of gallons of diesel fuel with counterfeit cards.

Skimming vs. Shimming: What’s the Difference?

You may have also heard the term “shimming.” While related, shimming is a newer and more sophisticated threat that targets the EMV chip on your card rather than the magnetic stripe. Shimming devices are paper-thin and inserted inside the card slot, making them even harder to detect than traditional skimmers.

The legal protections discussed in this article apply to both skimming and shimming fraud. We will address shimming in more detail in an upcoming blog post.

Your Legal Rights When Your Card Is Skimmed

Federal law provides important protections for victims of card fraud, but the rules differ depending on whether you used a debit card or credit card.

Debit Cards: The Electronic Fund Transfer Act (EFTA)

If your debit card was compromised, the Electronic Fund Transfer Act (EFTA) limits your liability for unauthorized transactions. If you report the fraud promptly, your maximum liability is $50. Even if you don’t discover the fraud until your statement arrives, your liability is generally capped at $500 for charges that appear on that statement.

Under the EFTA, when you report unauthorized transactions, your bank must investigate and, in most cases, provisionally credit your account within 10 business days while it investigates. Banks frequently fail to follow these requirements—or misapply the liability rules in ways that harm consumers.

EFTA Remedies: When banks violate the EFTA, consumers may be entitled to significant remedies, including: actual damages (which can include not only the amount of the unauthorized transactions but also related consequential damages such as emotional distress); statutory damages; and treble damages for willful noncompliance. The statute also provides for attorney’s fees, which makes it possible for consumers to obtain legal representation even in cases involving smaller dollar amounts.

For more detailed information on the EFTA and how to properly dispute unauthorized debit card transactions, see our comprehensive guide: Fighting Back: A Guide to Identity Theft, Credit Reporting Errors, and Unauthorized Charges.

Credit Cards: TILA and FCBA

If your credit card was skimmed, you have protections under two federal statutes: the Truth in Lending Act (TILA) and the Fair Credit Billing Act (FCBA).

Under TILA Section 1643, your liability for unauthorized credit card charges is limited to $50—and in practice, most card issuers waive even that amount. Importantly, TILA’s protections are more flexible than many consumers (and even some banks) realize. Unlike the FCBA, TILA does not require written notice, does not require that you send your dispute to a special address, and does not impose a strict 60-day deadline. You simply need to provide “reasonable notice” that the charges were unauthorized.

The FCBA provides additional protections for “billing errors,” but its procedural requirements are stricter. If you meet the FCBA’s requirements, you can pursue claims under both statutes. But even if you miss the FCBA’s deadlines, you may still have recourse under TILA.

TILA and FCBA Remedies: When card issuers violate TILA or the FCBA, consumers may be entitled to actual damages, statutory damages, and attorney’s fees. These fee-shifting provisions are critical because they allow consumers to pursue legitimate claims regardless of the dollar amount at issue.

For more detailed information on TILA, the FCBA, and how to properly dispute unauthorized credit card charges, see our comprehensive guide: Fighting Back: A Guide to Identity Theft, Credit Reporting Errors, and Unauthorized Charges.

When Banks Get It Wrong

Despite these clear legal protections, banks regularly deny legitimate fraud claims. Common problems we see include:

• Claiming the transactions were “authorized” simply because a PIN was used (the PIN was captured by the skimming device)
• Misapplying the EFTA liability timelines
• Failing to conduct a proper investigation
• Refusing to provide provisional credit during the investigation
• Denying credit card skimming disputes on grounds that the consumer missed the FCBA deadline, even though TILA Section 1643 also requires reimbursement

If your bank has denied your claim or refused to fully reimburse you, that denial is not necessarily the final word.

What to Do If You’re a Victim

If you discover unauthorized transactions on your account, take the following steps immediately:

1. Report the fraud to your bank or card issuer immediately. Contact them as soon as you discover unauthorized transactions. The sooner you report, the better your legal protections.
2. Follow up in writing. Send a written dispute via certified mail with return receipt requested. Keep copies of all correspondence.
3. File a police report. This creates an official record of the crime and may be required by your bank. Provide a copy to your bank; if you have already disputed the charges, you can supplement your dispute with the police report.
4. Report the identity theft to the FTC. Go to IdentityTheft.gov to get an official Identity Theft Report and a personalized recovery plan. Provide a copy to your bank; if you have already disputed the charges, you can supplement your dispute with the Identity Theft Report.
5. Consider placing a fraud alert or credit freeze. Contact one of the three major credit bureaus to place a fraud alert (they will notify the others), or contact all three to place a credit freeze.
6. Document everything. Note when and where you last used your card, when you discovered the fraud, and keep records of all communications with your bank.
7. Report the skimming device. You can report skimming to the FBI’s Internet Crime Complaint Center at ic3.gov.

For detailed guidance on the dispute process, including step-by-step instructions, see our comprehensive guide: Fighting Back: A Guide to Identity Theft, Credit Reporting Errors, and Unauthorized Charges.

How Schlanger Law Group Can Help

Schlanger Law Group has represented victims of card skimming for many years, and is a national leader in credit card and debit card fraud litigation. Our attorneys are deeply versed in the relevant consumer protection statutes and litigate unauthorized charge issues as a core part of the firm’s practice. We regularly help victims recover their stolen funds and obtain additional damages for banks’ violations of the law.

As noted above, the EFTA, TILA, and FCBA all provide for attorney’s fees when banks violate the law. This means that in successful cases, the bank pays the legal fees—not the consumer. Our firm typically works on a contingency fee basis on card skimming and other card fraud cases, which means the consumer pays nothing out of pocket and the firm only gets paid out of any recovery.

If you’ve been victimized by card skimming and your bank has denied your claim or refused to make you whole, contact us for a free consultation. You can reach us at (212) 500-6114 or through our website at consumerprotection.net.

Attorney Advertising. Prior results do not guarantee a similar outcome. This article is for informational purposes only and does not constitute legal advice.