What Is E-Skimming? How Digital Skimming and Magecart Attacks Steal Payment Data

E-skimming, also called digital skimming, web skimming or online skimming, is a form of payment-data theft in which malicious code is inserted into an ecommerce website or a script used by that website.

When a shopper enters payment details into a compromised checkout page, the malicious code can secretly copy information before or while the legitimate payment process continues. The shopper may see a normal-looking order confirmation and have no obvious sign that data was intercepted.

Magecart is a term widely used by security researchers and the media for groups and attack campaigns associated with web-skimming activity. PCI Security Standards Council guidance notes that the term has also become shorthand for the broader attack technique.

Quick answer: E-skimming is the digital equivalent of a card skimmer: attackers compromise an ecommerce payment page or one of its scripts so payment and personal data can be copied during checkout. Magecart is a common umbrella term associated with these web-skimming campaigns.

How Is E-Skimming Different From a Physical Card Skimmer?

A physical skimmer is hardware attached to, or hidden inside, a payment terminal or ATM. E-skimming is software-based and targets online payment pages.

Feature	Physical skimming	E-skimming
Target	POS terminal, ATM or kiosk	Ecommerce website or payment-page scripts
Method	Hidden hardware captures card data	Malicious code copies data entered in the browser
Where theft occurs	At a physical card reader	During online checkout
Visibility	May require physical inspection	Can be nearly invisible to the shopper and merchant

How Does Digital Skimming Work?

The exact intrusion method varies, but the defensive concept is straightforward: an attacker first gains a way to change code that affects the payment page, then inserts a skimming script that watches for sensitive information.

1. A website or third-party component is compromised.

Attackers may exploit vulnerable ecommerce software, stolen administrative credentials, phishing, weak access controls or a compromised third-party script supplier.

2. Malicious JavaScript or similar code is introduced.

The code is placed directly on the merchant website or delivered through a trusted third-party script or service.

3. The shopper reaches checkout.

The legitimate payment page loads along with the compromised code.

4. Payment information is entered.

The skimming code can copy fields such as card details and personal information as the shopper types or submits the form.

5. Stolen data is exfiltrated.

The copied data is sent or made available to infrastructure controlled by the attacker while the legitimate checkout may continue normally.

What Is Magecart?

Magecart is not one single piece of malware. It is an umbrella term commonly used for several threat groups and web-skimming campaigns that target ecommerce payment environments.

PCI SSC explains that Magecart has been used both to describe groups responsible for online skimming and, more broadly, the attack technique itself.

What Data Can E-Skimming Steal?

The information collected depends on the malicious script and the fields available on the compromised page. PCI SSC has documented attacks that targeted payment-card details as well as names, billing addresses, email addresses, phone numbers, usernames and passwords.

Payment-card number
Expiration date
Card verification code if entered into the page
Cardholder or customer name
Billing and shipping information
Email address and phone number
Account credentials if the compromised page captures them

A well-designed payment page should minimize unnecessary exposure of sensitive data, but any information available to compromised client-side code may become a target.

Why E-Skimming Can Be Hard to Detect

The legitimate checkout can continue to work normally.
The shopper may still receive a real order confirmation.
The malicious code can be small and blend into legitimate JavaScript.
A third-party script can introduce risk even if the merchant's own application code was not directly altered.
Attackers can modify or replace skimming code to evade simple signatures.
The compromise may exist only in the browser-rendered page, making server-side checks alone insufficient.

How Third-Party Scripts Create Supply-Chain Risk

Modern ecommerce pages often load external JavaScript for analytics, customer support, advertising, ratings, tag management and other functions.

PCI SSC warns that a compromised third-party service can distribute malicious JavaScript to many merchant websites at once. That is why payment-page security needs controls over scripts regardless of whether the script was written by the merchant.

Common Ways Ecommerce Sites Become Vulnerable

Unpatched ecommerce platforms, plugins or extensions
Stolen or weak administrator credentials
Phishing of privileged users
Compromised third-party JavaScript or software libraries
Insecure deployment pipelines or unauthorized code changes
Poor visibility into which scripts are allowed to run on payment pages

PCI DSS and E-Skimming Protection

PCI DSS v4.x strengthened ecommerce payment-page controls specifically because browser-side scripts have become an important attack target.

PCI SSC's 2025 payment-page security guidance highlights Requirements 6.4.3 and 11.6.1. These controls focus on authorizing payment-page scripts, checking their integrity, maintaining an inventory and detecting unauthorized changes to payment pages and security-impacting HTTP headers.

What Do PCI DSS Requirements 6.4.3 and 11.6.1 Address?

Requirement area	Core idea	Why it matters
6.4.3	Manage and authorize payment-page scripts and verify integrity	Reduces the chance that unknown or altered scripts silently run at checkout
11.6.1	Detect unauthorized changes to payment pages and security-impacting headers	Helps identify tampering that could enable e-skimming

How Merchants Can Reduce E-Skimming Risk

Keep ecommerce platforms, plugins, themes and dependencies patched.
Use strong, unique administrator credentials and multi-factor authentication.
Maintain an inventory of scripts that are permitted on payment pages.
Authorize payment-page scripts and verify their integrity.
Monitor payment pages and security-impacting HTTP headers for unauthorized changes.
Minimize unnecessary third-party JavaScript on checkout pages.
Use a reputable payment provider and hosted payment components where appropriate.
Restrict administrative and deployment access using least privilege.
Monitor client-side behavior, not only server logs.
Have an incident-response plan for payment-page compromise.

Why Content Security Policy and Script Controls Matter

Browser security controls can reduce the opportunities for unauthorized scripts to run or send data to unexpected destinations.

A carefully managed Content Security Policy, script allow-listing, integrity checks and change monitoring can strengthen a payment-page defense. These controls need ongoing maintenance because ecommerce integrations change over time.

What Is Client-Side Monitoring?

Client-side monitoring observes what scripts actually execute in the shopper's browser and where they communicate.

This matters because a payment page can appear clean in a server-side code repository while a compromised third-party dependency or runtime injection changes what the shopper receives.

Can Tokenization Stop E-Skimming?

Tokenization can reduce exposure of stored and reusable card numbers, but it does not automatically stop a skimmer from capturing information that a shopper enters into a compromised webpage before tokenization occurs.

The safest architecture minimizes merchant exposure to raw card data and combines tokenization with secure payment-page design, script controls, monitoring and strong authentication.

Does 3-D Secure Stop E-Skimming?

3-D Secure adds issuer-led authentication to online card payments, which can reduce the usefulness of stolen credentials in some transactions. It does not remove malicious code from a compromised merchant website.

Payment-page integrity and 3DS solve different problems and should be treated as complementary layers.

Warning Signs for Online Shoppers

Consumers usually cannot confirm e-skimming simply by looking at a page, but certain warning signs should increase caution.

A familiar retailer suddenly redirects checkout to an unexpected or misspelled domain.
The payment page behaves unusually or loads unexpected pop-ups.
The browser reports certificate or connection-security warnings.
A retailer asks for payment or identity information that is unrelated to the purchase.
Unexpected fraud alerts or unauthorized card activity appear after an online purchase.

A normal-looking page does not guarantee safety, so consumers should also rely on issuer alerts and regular account monitoring.

What to Do If You Think Your Card Was Exposed

Contact the card issuer using the official number on the card or issuer app.
Review recent and pending transactions.
Report unauthorized charges promptly.
Follow the issuer's instructions for locking or replacing the card.
Change passwords if the affected website account or credentials may also have been exposed.
Be alert for follow-up phishing messages that reference the purchase or retailer.

How Merchants Can Respond to a Suspected E-Skimming Incident

Restrict access and preserve relevant evidence before making unnecessary changes.
Engage the organization's incident-response and payment-security teams.
Identify and remove unauthorized code or compromised third-party components.
Determine how the compromise occurred and close the underlying access path.
Rotate affected credentials and review privileged access.
Coordinate with the acquiring bank, payment brands and qualified incident-response resources as required.
Monitor for reinfection instead of assuming code removal alone solved the incident.

E-Skimming vs Phishing

Phishing tricks a person into visiting a fake site or revealing information to an impersonator. E-skimming compromises a real or otherwise legitimate ecommerce site so the shopper can be victimized while using the expected checkout.

The two can overlap: phishing can be used to steal merchant administrator credentials that later enable a web-skimming compromise.

E-Skimming vs Malware on the Shopper's Device

E-skimming usually means the malicious code is delivered by the compromised ecommerce site or its dependencies. Device malware runs on the shopper's own computer or phone.

Both can steal payment data, but the security response differs because one focuses on the merchant's payment-page ecosystem and the other on the consumer device.

Frequently Asked Questions

What is e-skimming?

E-skimming is the theft of payment or personal data through malicious code inserted into an ecommerce payment page or a script used by that page.

Is e-skimming the same as digital skimming?

Yes. E-skimming, digital skimming, web skimming and online skimming are commonly used for the same general type of browser-side payment-data theft.

What is Magecart?

Magecart is an umbrella term commonly associated with groups and campaigns that conduct online payment-card skimming. It is also sometimes used as shorthand for the attack technique.

How does a Magecart attack steal card data?

A compromised checkout page or script can copy data entered by the shopper and send that information to attacker-controlled infrastructure while the legitimate purchase may continue.

Can shoppers see an e-skimmer?

Usually not. The malicious code can run invisibly in the browser, which is why merchant-side payment-page controls and monitoring are important.

Can CVV be stolen by e-skimming?

If a compromised payment page can access a CVV/CVC field while the shopper enters it, malicious client-side code may attempt to capture it.

Does tokenization prevent e-skimming?

Tokenization helps protect stored and processed card data, but it does not by itself stop malicious code from intercepting information before tokenization.

Does 3-D Secure prevent e-skimming?

3DS can strengthen authentication and reduce misuse of stolen credentials, but it does not clean or secure a compromised payment page.

What PCI DSS requirements focus on e-skimming?

PCI SSC's current payment-page guidance highlights Requirements 6.4.3 and 11.6.1 for managing scripts and detecting unauthorized changes affecting ecommerce payment pages.

What should I do after shopping on a site I believe was compromised?

Contact your card issuer, review transactions, report unauthorized activity and follow the issuer's instructions for securing or replacing the card.

Final Thoughts

E-skimming turns an ordinary-looking ecommerce checkout into a hidden data-theft channel. Instead of placing a physical device on a terminal, attackers compromise website code, third-party scripts or the broader software supply chain.

Magecart-style attacks are especially dangerous because the legitimate purchase can still succeed, leaving both the shopper and merchant unaware that information was copied.

For merchants, the strongest defense combines patched systems, tightly controlled administrative access, payment-page script governance, integrity monitoring and rapid incident response. For consumers, transaction alerts, account monitoring and prompt issuer contact remain important if payment information may have been exposed.

Authoritative References

Editorial note: This article is defensive and educational. It explains how e-skimming works at a high level for fraud awareness and prevention without providing deployment code, payloads or operational instructions for stealing payment data.