Card skimming at checkout: how it works and how to prevent it

Digital skimming means injecting a small script into the payment page that copies what the customer types (card number, expiry date, CVV) and sends it to a server controlled by the attacker. The customer pays as usual and notices nothing. Weeks later, their bank detects the fraud.

How the script gets in

• A vulnerable module that allows writing to the database or uploading files.
• Stolen back office credentials: the attacker pastes the script into a text block or into the configuration.
• A compromised third-party library that your store loads from outside.

The most effective defence: keep the card away from your website

Use gateways where card details are entered in a form hosted by the gateway itself (an external payment page or a field embedded from its domain, such as Stripe Elements or the Redsys form). That way, even if someone injects a script into your store, they cannot read those fields.

Further measures

• Updates to PrestaShop and modules, especially payment and checkout ones.
• Two-factor authentication in the back office.
• Content Security Policy (CSP): restricts which domains the payment page can load from and send data to.
• Monitoring of changes to JS files and to database fields that accept HTML.
• Reviewing the scripts on the payment page at least once a month: do you know what each one does?