What Is Web Skimming?

Web skimming is the injection of malicious code into a checkout or payment page that silently captures card details as customers type them, then sends the data to an attacker-controlled server. Named after Magecart, the loose collective of groups that popularized it against Magento stores, the technique is the digital descendant of the physical card-skimming device fitted over an ATM slot, invisible to the person paying, and functioning perfectly regardless of how well the merchant's own systems detect fraud, because the merchant's systems never see the theft happen.

Where the injection lives

The compromise rarely targets the retailer's own code directly. Checkout pages are collages of first-party code and third-party scripts, such as analytics, chat widgets, advertising pixels, and payment libraries, and skimmers exploit that supply chain: compromise one script that dozens of unrelated sites load, and the skimmer rides into every one of them simultaneously. Vulnerable e-commerce platforms and unpatched plugins are the other common entry point, giving attackers direct write access to checkout templates. Once installed, the skimmer code is built to be inconspicuous: it clones form fields, watches keystrokes, or intercepts submission, and typically exfiltrates data to a domain designed to look unremarkable in a network traffic log.

Why detection is slow

The victim experiences nothing: the payment completes, the order confirms, the goods ship. The breach surfaces only when stolen card numbers appear in card-not-present fraud or carding operations weeks or months later, at which point investigators trace the common point of compromise back to a checkout page that has, by then, processed thousands of poisoned transactions. Regulators have taken the pattern seriously: GDPR enforcement actions have fined breached retailers directly for inadequate checkout security, which makes web skimming both a fraud problem and a compliance one for any site handling payment data.

Defending the checkout supply chain

The core discipline is treating every script loaded on a payment page as a trust decision, not a convenience. A Content Security Policy that allowlists exactly which domains may execute or receive data on checkout pages blocks unauthorized exfiltration even from a successfully injected script. Subresource Integrity pins third-party scripts to a known hash so a silently modified file fails to load. Regular integrity monitoring of checkout page code, and prompt patching of the CMS and plugins underneath it, close the entry points attackers rely on. None of this defends against the reconnaissance and automated vulnerability probing that finds exploitable checkouts in the first place, which is where bot detection such as CaptchaFox does complementary work, keeping automated scanning and credential-testing traffic away from the admin and checkout surfaces that skimming campaigns use to gain their initial foothold.