In short, it’s the digital equivalent of those physical skimming devices that criminals insert into ATMs to steal card data as it’s entered: it’s highly effective and happens completely without the knowledge of the cardholder.