Card cloning is a type of fraud in which a person’s debit or credit card details are stolen, copied and used to make a fraudulent card. Criminals do this by accessing a card’s stored data and encoding it onto another card, allowing them to make illegal payments or cash withdrawals.  

Unlike physical card theft, card cloning allows fraudsters to steal and use payment information without the victim’s knowledge. Often, they only realise that their data has been stolen when suspicious transactions appear on their accounts.  

How does card cloning work? 

Card cloning is generally done by using an ATM skimmer to steal card data. This data is then copied, or “encoded,” onto a fraudulent card. The process of creating a clone credit card typically involves three distinct stages. Let’s take a look: 

1. Data harvesting: Capturing a card's information is the first step, and it’s usually performed at a POS terminal or ATM. Criminals use devices called skimmers, which are small electronic readers placed inside ATMs, POS terminals, or fuel pumps. These devices copy data from a card's magnetic stripe when it's swiped or inserted. Shimmers — thin devices inserted inside chip-reading slots — may also be used. Fraudsters sometimes install hidden cameras on or around ATMs or install fake keypads to capture customer PIN numbers. More advanced criminals may attempt contactless card cloning, employing portable RFID scanners to capture data from contactless-enabled cards. 

   
   

2. Fake card creation: Once the data is harvested, fraudsters use special equipment to encode the stolen information onto blank cards. The resulting cloned card looks like a legitimate one, and can be used to make unauthorised payments. 

   
   

3. Fraudulent transactions: Criminals then use the cloned card to make fraudulent purchases, request cash advances, or withdraw cash from ATMs.  

Most common types of card cloning  

For businesses looking to keep their customers’ data secure, understanding where and how card cloning occurs is essential. Here are the main ways card details are stolen and cloned: 

Point-of-sale terminal skimming 

Point-of-sale (POS) terminal skimming is one of the most common ways fraudsters harvest card data. The process involves installing hidden card-readers at POS terminals. These skimmers can be installed by plugging a device into a USB port or through other, more sophisticated means. When customers swipe or insert their cards, the skimmer copies the card data. The information is then either wirelessly transmitted to the criminals via Bluetooth or manually retrieved later.  

ATM skimming 

Because they are often unsupervised, ATMs are particularly vulnerable to skimming attacks. Fraudsters install skimmers directly over the card readers. These blend in seamlessly with the machine, making them particularly hard to spot. In some cases, criminals may bolster their operation by using hidden “pinhole” cameras to record customers entering their PINs. Alternatively, they may place a fake keypad on top of the original one to record the data that’s entered there.   

One important way to offset this risk is for the customers to cover their hand while entering their PIN number. For financial institutions, it’s also important to note that ATMs located in less-monitored areas or those not associated with major banks are more commonly targeted by fraudsters.  

Fuel pump skimming 

Gas station fuel pumps are prime targets for card cloning. Criminals can install skimmers within the internal wiring of payment processing machines. Because these skimmers are installed inside the pump's payment mechanism rather than externally, they can operate undetected for extended periods. 

Consumers can check for skimmers by looking at the security seal near the card reader. If the pump panel is open or the seal has been broken, the label will show "void," indicating that there might be a skimmer installed. 

How to prevent card cloning: A business perspective  

For financial institutions and payment processors, preventing card cloning involves a multi-layered strategy. Here are some things you can do to protect your customers and your business: 

Invest in security technologies 

If you’re a financial institution, you might want to consider implementing EMV chip technology across all payment infrastructure. EMV cards create unique encrypted codes for each transaction through tokenization, making it incredibly difficult to create functional clones. According to the ECB-EBA Joint Report, EMV adoption across Europe has significantly limited counterfeit card fraud. 

Using digital wallets are also a great way to prevent against card cloning — both for physical and online payments. Digital wallets use tokenization to encrypt card numbers, meaning the actual card numbers aren't transmitted during transactions. 

Deploy AI-powered fraud detection 

Real-time AI transaction monitoring systems can identify suspicious patterns that might indicate that a cloned card is being used. By reviewing indicators like transaction location, purchase patterns, and spending velocity, machine learning models use data to detect unusual patterns, such as an unexpected switch from an EMV chip to a magnetic stripe.  

Conduct regular security audits  

Financial institutions should periodically inspect all points where card transactions occur, such as ATMs, POS terminals, and online payment gateways. Ensuring these contact points are secured, monitored, and equipped with anti-skimming technology significantly reduces vulnerability to card cloning attacks.  

Educate customers and staff 

While advanced fraud detection systems can help identify suspicious payment patterns, educating customers and staff is one of the best lines of defence against card cloning and other forms of fraud. For example, businesses should remind customers to inspect card readers closely for anything suspicious or damaged, to check ATMs for hidden cameras, and to cover their hands when entering their PIN numbers. Furthermore, it’s important to monitor bank ostatements regularly and to report any suspicious payments as soon as possible. 

Card Cloning FAQs 

Q: Is card cloning a criminal offence? 

Yes, card cloning is illegal and prosecutable under law, whether you’re creating, possess, or use cloned payment cards. Penalties can include prison terms or large fines.  

Q: Can cloned cards be traced? 

Cloned cards may be traceable using transaction metadata such as the merchant, terminal ID, and timestamps, along with CCTV footage and/or digital clues like IP addresses. But even in these cases, it's extremely difficult to identify a perpetrator. Fraudsters often use multiple cloned cards simultaneously, make transactions in ways that hide their location, and quickly convert their stolen funds, making it hard to identify or convict them.