Shimmer
Definition
Thin sliver-shaped device inserted inside the chip reader of an ATM or POS to intercept data exchanged with the EMV chip.
- Target
- EMV chip data exchange, not the magnetic stripe
- Placement
- Inserted inside the card-reader slot of an ATM or POS terminal
- Physical form
- Thin flexible sliver, thinner than a card, sits against the chip contacts
- Limitation for attacker
- Captured chip data alone cannot clone a working chip card; typically used to build a magstripe fallback card
Common questions
Why can a shimmer not simply be used to clone a chip card?+
EMV chips use dynamic, cryptographically signed transaction data that changes each time, so a static capture of one transaction cannot be replayed to authorize a new one. Shimmed data is instead typically used to encode a magnetic stripe clone or to attempt a downgrade attack forcing a terminal to fall back to stripe-only processing.
How does a shimmer differ from a skimmer?+
A skimmer sits over or inside the reader to copy magnetic stripe data as the card is swiped. A shimmer instead sits against the chip contacts to intercept the EMV data exchange, so it targets chip-enabled cards rather than the stripe.
Related terms
- BIN / IIN
- Bank Identification Number, formally the Issuer Identification Number under ISO/IEC 7812. The first six digits of the PAN identify the issuing institution...
- CVV / CVC
- Card Verification Value (Visa) or Card Verification Code (Mastercard). CVV1 is encoded on the magnetic stripe, CVV2/CVC2 is the 3-digit printed code...
- Embossing
- Raised characters on older card fronts produced by an embosser; modern cards are increasingly flat-printed because POS imprinters are obsolete.
- EMV Chip
- Integrated-circuit chip following the EMV (Europay-Mastercard-Visa) specification. Contact interface per ISO/IEC 7816, contactless per ISO/IEC 14443. Generates dynamic cryptograms that defeat static-data...
- Hologram
- Diffractive optical security feature: Visa dove, Mastercard interlocking globes, RuPay tricolour. Hard to reproduce without specialised embossing equipment.
- Magnetic Stripe
- Ferromagnetic strip on the card reverse encoding account data on three tracks per ISO/IEC 7811. Track 1 alphanumeric (79 chars), Track 2...
- NFC
- Near Field Communication, the 13.56 MHz contactless radio interface used for tap-to-pay. Built on ISO/IEC 14443 and underlies UPI Lite and RuPay...
- PVC Card Body
- Standard payment card construction: polyvinyl chloride core sandwiched between two transparent laminated overlays. Card dimensions 85.60 by 53.98 mm per ISO/IEC 7810...
- Signature Panel
- White panel on the card reverse printed with a tamper-evident background (often the issuer name repeated or the word VOID appearing if...
- Skimmer
- Overlay device fitted on an ATM card slot or POS terminal that reads and stores the magnetic stripe data of cards swiped...
- Tokenisation
- RBI-mandated mechanism that replaces the PAN stored at merchants with a token usable only by that merchant, reducing the value of stolen...