Skip to content
BreachPathAttack Path LibraryStart
IntermediatePayment / invoice fraudData theft

Web skimming to payment fraud

A weakness in an e-commerce site or one of its third-party scripts is used to capture customers' payment details at checkout, which are then used or sold for fraud.

Technologies
Custom web applications
Entry points
Vulnerable application, Supplier compromise
Sectors
Retail, Charity / non-profit, SaaS & technology
Stages
3
01

The checkout flow or a third-party script is compromised

The attacker exploits a weakness in the site or in one of the third-party scripts it loads (a supplier compromise), gaining the ability to inject their own code into the checkout experience.

Attacker objective

Gain the ability to alter what runs on the payment page.

MITRE ATT&CK
Controls that should stop this
  • Subresource integrity and a strict content-security policy on payment pages
  • Vetting and monitoring of third-party scripts; minimise them at checkout
  • Use of a hosted/iframed payment field so card data never touches the page
What defenders should see
  • Unexpected changes to checkout page scripts or integrity failures
  • New or modified third-party script sources
  • CSP violation reports on payment pages
What a pentest validates
  • Application test of the checkout flow and its script supply chain
  • Review CSP, subresource integrity and payment-field isolation
  • Validate change monitoring on payment pages
Business impact

The attacker can influence what executes as customers enter card details.

02

Payment details are captured at entry

Injected code reads payment-form fields as they are filled and sends the data to attacker infrastructure, running quietly alongside the legitimate checkout so customers notice nothing.

Attacker objective

Silently collect card data as customers type it.

MITRE ATT&CK
Controls that should stop this
  • Payment fields isolated in a PCI-compliant hosted iframe
  • Egress restrictions and monitoring for data sent to unknown hosts
  • Regular integrity checks of the live checkout experience
What defenders should see
  • Outbound requests from checkout to unfamiliar domains
  • Script behaviour reading form fields unexpectedly
  • Anomalies in client-side network activity
What a pentest validates
  • Test whether injected script could read and exfiltrate card fields
  • Validate egress monitoring from the client experience
  • Confirm payment-field isolation prevents capture
Business impact

Customer card data is being stolen in real time at checkout.

03

Stolen card data is used or sold for fraud

The attacker uses the harvested details for fraudulent transactions or sells them onward, while the compromise may persist and continue harvesting until discovered.

Attacker objective

Monetise the captured payment data.

MITRE ATT&CK
Controls that should stop this
  • Rapid detection and removal of skimming code; incident response readiness
  • Fraud monitoring and customer notification processes
  • PCI-DSS-aligned handling that keeps card data off your systems entirely
What defenders should see
  • Spikes in customer chargebacks and fraud reports
  • Card-scheme or acquirer alerts
  • Continued exfiltration if the skimmer persists
What a pentest validates
  • Validate detection and response time for checkout tampering
  • Review fraud-monitoring and notification processes
  • Confirm scope of card data your systems actually handle
Business impact

Customers suffer fraud; the business faces chargebacks, penalties and reputational damage.

ATT&CK techniques in this chain

T1190Exploit Public-Facing ApplicationT1567Exfiltration Over Web ServiceT1195.002Supply Chain Compromise: Compromise Software Supply ChainT1056.003Input Capture: Web Portal CaptureT1657Financial Theft

If this chain completes

Theft of customer cardholder data directly from the checkout flow — driving payment fraud, chargebacks, card-scheme penalties and reputational harm, often undetected for a long period.

Should you test this against your environment?

Turn this chain into a scoped red-team brief — objective, systems and identities in scope, testing assumptions and the questions to answer before commissioning.

Generate my red-team test briefExplore more paths