How it happens
This family of attacks is often called Magecart, after the groups that made it widespread.
- An attacker gets into the store through an outdated platform, plugin or admin login, and adds a script to the checkout.
- Or a third-party script the store loads (a chat widget, analytics, a review tool) is itself compromised.
- The script copies what customers type into payment fields and sends it to the attacker.
Defenses
- Card fields hosted by your payment processor, in their own secure frame or page, so your site never handles card numbers. A skimmer on your page can’t read inside them.
- A Content-Security-Policy that only allows scripts from sources you approve. See security headers explained.
- Few scripts on payment pages. Every third-party script is a door.
- Monitoring for changes to checkout pages.
- Updates and two-step sign-in on the store’s admin.
What PCI DSS 4.0 changed
Version 4.0 of the card industry’s security standard added requirements, effective from March 2025, for managing and monitoring the scripts on payment pages. The exact requirements that apply to your store depend on how your checkout is built and which self-assessment questionnaire you complete; ask your payment processor which one applies to you.
Written by Nikita Huttenlocher, founder and lead engineer at Huttenlocher Technologies, a web design and software company in Myrtle Beach, South Carolina.