Security Wiki

PII is any information that can identify a specific person, directly or in combination — from names and emails to IP addresses and device identifiers.

Price scraping is the automated bulk extraction of prices from a competitor's site — fueling undercutting strategies and a constant crawler load.

Privacy by design is the principle that data protection must be built into systems from the first architecture decision, not added on afterwards.

Proof of work is a cryptographic mechanism that requires solving a computational puzzle before an action is accepted, making abuse expensive at scale.

Proxy rotation is the practice of switching outbound IP addresses continuously so that large volumes of automated requests appear to come from many sources.

Rate limiting caps how many requests a client may send in a given time window, protecting services from overload and slowing down abuse.

Return fraud is the abuse of retail return policies — from wardrobing to empty-box refunds — increasingly organized through refund services and networks.

Schrems II is the 2020 EU court ruling that invalidated the Privacy Shield, reshaping how personal data may be transferred from the EU to the United States.

SIM swapping is the hijacking of a victim's phone number by porting it to an attacker's SIM — turning SMS-based security codes into the attacker's mail.

SMS pumping is a fraud scheme in which bots trigger masses of verification texts to premium-rate numbers, leaving the targeted business with the bill.

The BFSG is Germany's Accessibility Strengthening Act — the national law implementing the European Accessibility Act, in force since 28 June 2025.

The European Accessibility Act (EAA) is the EU directive requiring key products and digital services — including e-commerce — to be accessible since June 2025.

The GDPR is the EU's General Data Protection Regulation — the law governing how personal data of people in the EU may be collected, processed and shared.

TLS fingerprinting identifies client software by how it negotiates encryption — exposing bots that lie in their user agent before a single page loads.

Toll fraud triggers calls or texts to premium-rate numbers the attacker profits from — often by abusing an app's phone verification flow with bots.

Triangulation fraud uses a fake storefront to take real customers' money, then fulfills their orders from a legitimate shop using stolen cards.

Two-factor authentication secures logins by requiring a second, independent proof of identity beyond the password — knowledge, possession, or biometrics.

WCAG (Web Content Accessibility Guidelines) is the W3C standard defining how web content must be built so people with disabilities can perceive and use it.

Web scraping is the automated extraction of data from websites. It powers search engines and price comparison — and content theft and competitive abuse.