The Skim Reaper Is Coming to Protect You From Credit Card Theft

Security researchers will soon begin selling a tool that can tell when a thief is trying to steal your credit card information

Photo: Nolen Scaife, Christian Peeters, Patrick Traynor
A newly designed Skim Reaper, which will go on sale in the coming weeks.

While consumers enjoy the ease at which a sale can be made with one swipe of a credit card, it also takes just one swipe for credit card theft to occur. Inside what looks like a regular point-of-sale device at the cashier’s counter or an ATM machine could be a skimmer, a gadget that records personal credit card information as you insert your card.  

Hoping to put a fatal end to this type of credit card fraud, several years ago a group of researchers at the University of Florida created a device, aptly named the Skim Reaper, that detects skimmers. After some fine-tuning, sales of the Skim Reaper are poised to begin in the next few weeks.

The demand for such a tool has the potential to be very high, at a time when credit fraud is increasing at an alarming rate. A 2018 report found that 60 million U.S. payment cards were compromised over a 12-month period, 75 percent of which were compromised at a point-of-sale device.

The inventors of the Skim Reaper experienced this type of fraud first-hand, prompting them to develop the device. “Frankly, we were tired of getting ripped off,” says Nolen Scaife, a co-developer who is now an assistant professor at the University of Colorado Boulder. “So, we set out to make something that works.”

Credit cards store our personal information as variations in the magnetic properties of the dark strip across the top of the card. As you slide a card through a point-of-sale device, an interior component called a read head begins to register the magnetic information. When a skimmer is added to a point-of-sale device, it contains its own read head, which duplicates the information for fraudsters.

The Skim Reaper is a card-shaped tool that you can swipe through the point-of-sale device first, to register how many read heads it encounters. If it detects a second read head, this indicates that a skimmer is present.

While the researchers first developed a prototype of a Skim Reaper several years ago, they’ve since been working to fine-tune it for commercialization.

“We’ve spent a lot of time working with our law enforcement and industry partners to better understand their needs and how the device performs in the field,” explains Scaife. “Since the initial prototypes, we have been working to place all of the equipment on a single card, which has fewer mechanical failure points and is more tailored to the use cases our partners need. We’re also eliminating the display on the prototypes and replacing them with LEDs to make it clear what the device is communicating.”

Details of the modified design were published in a study in IEEE Security & Privacy on 28 May. With sales poised to launch in the next few weeks, Scaife believes the initial customer pool will be made of businesses and law enforcement agencies. His team’s next goal is to create a new Skim Reaper design that allows the tool to be small enough to fit in a consumer’s pocket or wallet.