E-Skimming
Also: Digital skimming, Formjacking, Magecart
PCIComplianceHubLast updated
The online equivalent of skimming, also known as digital skimming, formjacking or Magecart. An attacker injects or modifies JavaScript on a checkout page so that card details are copied to an attacker-controlled destination as the customer types them, while the payment itself completes normally. Because the data is taken in the browser before submission, server-side controls and payment provider security do not detect it. PCI DSS v4.x addresses this directly through the payment page script and change-and-tamper detection requirements.
Applies to. E-commerce merchants and the providers whose forms they embed: any page where card data is typed into a browser.
Example. A third-party chat widget on a checkout page is updated at its source to include a few lines that copy the card fields on submit to an attacker's server. The payment succeeds, the customer sees nothing, and the merchant's own logs show a normal order.
Limits. Server-side controls, the provider's security and TLS do not see it: the copy happens in the browser before submission, over an encrypted connection of the attacker's choosing. PCI DSS answers it with 6.4.3 (know and authorise every script) and 11.6.1 (detect changes to headers and scripts as the browser receives them). SAQ A merchants using a redirect or an embedded form are targets too, which is why SAQ A for v4.x gained ASV scanning and the script-attack eligibility criterion.