How a location earns its score.

Green Protected = a paid business recently scanned the location clean with its own SkimGuard device. Blue Community Verified = enough individual users recently checked it clean. Amber Caution = a scan is overdue or verification is incomplete. Red Alert = a possible skimmer was detected recently. Grey = not scanned yet.

Protected is reserved for a paid business scanning its own location with a SkimGuard handheld or always-on agent, on a device that can scan Bluetooth Classic. One recent clean scan from that trusted device earns the green badge. Scans from passing customers can't, on their own, make a location green — that prevents anyone from faking clean scans to whitewash a compromised terminal.

When enough different SkimGuard users recently scan a location clean — and enough of them use a device that supports Bluetooth Classic — the location earns the blue Community Verified state. It's the highest rating the crowd can produce on its own; green Protected still requires the business's own scan.

A single scan from one phone builds confidence but isn't proof. It takes several independent clean scans from different people to reach Community Verified, and only a business's own SkimGuard device can make a location green. This keeps a bad actor from clearing a real skimmer with fake scans.

It means a suspicious Bluetooth device was detected at that location recently. We flag possible skimmers fast, from any source, because the cost of missing one is high — a re-scan can confirm or clear it. Treat an Alert as a reason to use a different terminal or pay inside until it's verified.

Skimmers can transmit over either Bluetooth Low Energy or the older Bluetooth Classic. A full scan covers both. iPhones can only scan Low Energy — Apple doesn't allow Classic scanning — and some Android devices lack a Classic radio too. That's why a verified “Protected” scan must come from a device that supports Classic scanning, and why community verification requires enough full-capable scans.

A rating loses confidence as the last trusted scan ages. Caution usually means a fresh scan is overdue, a monitoring agent went offline, or only a few people have checked recently. A new clean scan from a SkimGuard device brings it back up.

No. Every rating is time-bound — it reflects when the location was last scanned and what was found, not a permanent guarantee. A skimmer could be installed after a scan. SkimGuard reduces risk by keeping verification current and surfacing suspicious devices quickly.

Yes — the consumer app is free. Scan a terminal before you pay and see the safety map around you at no cost. Businesses pay for operator alerts, a verified badge, and always-on agent monitoring. See SkimGuard for Business →

Modern skimmers are wireless — they transmit stolen card data over Bluetooth so criminals never have to return for the hardware. SkimGuard scans for exactly those signals, so a transmitting skimmer near a terminal can be flagged before the next customer pays.

Yes. SkimGuard works anywhere there's a card reader — a bar, a restaurant table, a stadium concession, a festival vendor's stand, a nightclub door — not only gas pumps and ATMs. Those are also the places people pay while distracted: in a crowd, in a rush, mid-conversation, often after dark, and often at a terminal that was set up for one night. That's exactly when a compromised reader goes unnoticed, which is why it's worth a scan. The same limit applies everywhere: SkimGuard detects skimmers that transmit a Bluetooth signal, so a clear result means nothing was detected — not that the terminal is guaranteed safe.

Run the SkimGuard handheld or an always-on agent at your locations to earn the green Protected badge, get operator alerts before the public map does, and embed a “SkimGuard Protected” badge on your website. Start a free 14-day trial →

For merchants, yes. The business tiers include a payment-terminal inspection logbook that helps you document and meet PCI DSS v4.0.1 Requirement 9.5 — protecting POI devices from tampering and substitution — across 9.5.1.1 (device inventory), 9.5.1.2 (tamper inspections with photos), 9.5.1.2.1 (risk-based frequency) and 9.5.1.3 (staff training), plus an append-only, immutable audit trail of every device and inspection action of the kind Requirements 10.2 and 10.3 call for. It's not itself an attestation of PCI compliance, and doesn't cover logging across your whole cardholder-data environment — your QSA or acquirer assesses overall compliance. See the PCI inspection logbook →