E-commerce security: being an e-commerce merchant isn’t a differentiator in today’s digital world; it’s the default entry point for businesses that recognize modern consumers’ demand for convenience.
E-commerce sales, an estimated $4.9 trillion worldwide in 2021, are projected to reach $8.1 trillion by 2026. Amid this exponential growth, an insidious threat underscores the importance of e-commerce security: e-skimming, a client-side attack targeting the vast amount of financial data entered online.
Cybercriminals’ relentless drive to exploit online trends to steal payment data and personal information has driven a surge in these attacks, also known as digital skimming, web skimming, data skimming, or Magecart attacks.
What is E-Skimming?
E-skimming attacks are client-side attacks in which cybercriminals inject malicious code into an e-commerce website to compromise sensitive data, typically payment card data, entered by users on checkout pages and other online forms.
These malicious actors often gain access to an e-commerce site by compromising assets from outside its security perimeter, including client-side web assets—the files and resources downloaded and executed by a user’s web browser when they visit a website.
During this process, cybercriminals typically target JavaScript, the fundamental programming language used client-side by over 98% of all websites to create interactive web pages.
JavaScript’s ubiquity and inherent security vulnerabilities make it a prime target for cybercriminals who weaponize it against organizations with malicious skimming code. Once injected—either through a supply chain attack or a direct website hack—the code infiltrates the e-commerce website’s point of sale, allowing cybercriminals to intercept customer credit card details and personal data.
Crucially, these JavaScript skimming attacks occur outside the corporate network and therefore fall outside traditional security controls, creating a blind spot for e-commerce businesses.
The malicious code’s ability to hide in plain sight for weeks or even months means that once it infiltrates an online checkout or cart, customers will keep submitting their payment information, unaware their data is being compromised.
Once detected, the severe impact of these client-side attacks on businesses becomes apparent, from operational disruption and the cost of technical remediation to reputational damage and regulatory penalties. For example, British Airways was issued a £183m GDPR fine – reduced to £20m – in 2020 after its website and mobile app were breached by an e-skimming attack. Hackers copied and modified JavaScript payment forms to redirect payment data to a server they controlled, stealing sensitive information from 380,000 customers.
Digital Supply Chain: The Risks
The digital supply chain, an intricate web of interconnected technologies, data flows, and collaborations, is the fulcrum of modern digital business operations.
This virtual ecosystem of software, networks, vendors, partners, and data streams can enhance efficiency; however, it also exposes e-commerce businesses to risks, such as third-party vulnerabilities and data breaches, that, if exploited, can disrupt operations, compromise data, and tarnish their reputation.
Gartner underscores this threat by identifying digital supply chain risk as one of its top seven security and risk management trends for 2022. Take JavaScript, for example. This programming language runs on all major browsers, making it a core technology for building web applications and websites. However, this widespread use exposes e-commerce businesses and their users to an inherent security flaw: it lets cybercriminals deliver malicious scripts that run on the front end of a system.
In e-skimming, this third-party code represents a chink in the digital supply chain’s armor that proponents of this fraudulent technique attempt to exploit.
A typical e-commerce website’s client-side code mainly originates from outside the organization. These include open-source script libraries and third-party add-ons that web developers use to build user-friendly features like customer login pages and payment processing.
Despite saving time and resources, the opaque nature of this third-party code prevents e-commerce businesses from fully seeing the scripts on their sites, leaving them blind to client-side supply chain attacks like e-skimming.
Therefore, e-commerce merchants must balance leveraging third-party code to stay relevant in a dynamic, expanding digital world with managing its inherent risks in the digital supply chain. To shield themselves from client-side supply chain attacks and demonstrate best practices, they must comply with the Payment Card Industry Data Security Standard (PCI DSS).
The PCI DSS’s fourth, and most recent, iteration aims to meet the payment industry’s evolving security needs, promote security as a continuous process, increase flexibility, and improve procedures to help organizations achieve their security goals.
Securing Customer Data Entered Into E-Commerce Payment Forms
Cybercriminals use malicious code injections to skim payment data from input fields on existing web forms, amplifying the need for e-commerce businesses to secure these user interface components. On the one hand, payment forms let users submit personal information to make a purchase within minutes; on the other, they create an additional attack vector for cybercriminals to exploit.
Consequently, web form security – the set of tools and practices businesses use to protect web forms from e-skimming attacks – is a vital component of overall website security, and the benefits are compelling:
- Trust Building: Trust is the cornerstone of customer relationships in e-commerce. When customers provide their credit card information or other sensitive data, they expect it to be handled securely. By preventing breaches of this trust, e-commerce businesses can strengthen their reputation in this hyper-competitive market.
- Standards and regulatory compliance: Robust standards and regulations exist to reinforce web form security, such as GDPR and PCI DSS. These standards ensure that businesses that accept, process, store, or transmit credit card information maintain a secure environment.
- Revenue Protection: Well-designed web forms help e-commerce businesses convert website visitors into account holders, subscribers, or customers. By proactively securing customer data that’s entered into them, they can protect the revenue these forms facilitate.
- Third-party risk reduction: Web form security helps e-commerce businesses that use a third-party service or plugin to create and manage web forms assess security and data-handling practices, ensuring they follow best practices for data protection.
Client-Side Security Best Practices for Secure Forms
To securely collect data from users via web forms, they must be designed to incorporate a battery of proactive security measures, including:
Data encryption
Data encryption protects information users submit during transmission and when stored on the server. To maintain the confidentiality and integrity of user data, it harnesses robust encryption algorithms, public and private keys, and a trusted certificate infrastructure.
This is a fundamental aspect of web security and helps build user trust by demonstrating a commitment to protecting sensitive information.
Multi-factor authentication (MFA)/ Two-Factor Authentication (2FA)
MFA secures web forms by augmenting the traditional username and password authentication with the following verification factors:
- Something you have: Users must provide something physical that only they possess, such as a smartphone, security token, or smart card. This second factor can generate a one-time code or respond to a push notification.
- Something you are: This refers to biometric data unique to the user, such as fingerprints, facial recognition, or iris scans.
Spam Protection
Spam protection mechanisms—such as CAPTCHA (Completely Automated Public Turing Test to Tell Computers and Humans Apart)—enhance the security, reliability, and functionality of online forms by preventing unwanted or malicious submissions like automated bots, automated scripts, and spam submissions that overload the server. They also help ensure that the data collected is legitimate and trustworthy.
Secure Communication Protocols
Secure communication protocols like HTTPS and SSL/TLS encrypt web form data, ensure its integrity, authenticate the server, and provide a trust framework through certificate authorities.
For example, encryption algorithms scramble data transmitted between the user’s browser and the web server, making it extremely difficult for cybercriminals to intercept and decipher.
Client-Side Security
JavaScript security protects web applications from attack and ensures end users can safely interact with dynamic web pages on their devices.
For example, client-side validation using JavaScript to check user inputs for correctness, such as email format, password strength, and required fields, helps improve user experience and prevents basic errors before data is submitted to the server.
Also, regarding third-party scripts, it’s not necessarily the content they add to forms, but who can access them.
Conclusion
According to Mastercard data, almost three-quarters of publicly disclosed breaches in 2022 involved this technique, with skimmers infecting 4,500 new sites—a 129% increase from 2021. This number rose by another 2,700 in 2023. Amid this widespread deployment of e-skimming scams, the FBI estimates that they now cost cardholders and banks over $1 billion every year.
This proliferation of web skimming, or e-skimming, attacks against e-commerce businesses reflects the exponential growth of online retail sales and cybercriminals’ determination to exploit it.
This new reality has brought the need to strengthen e-commerce security against these client-side attacks into sharp focus for these online entrepreneurs, from implementing proactive security measures that secure web forms and reinforce third-party code to complying with PCI DSS v4.
By understanding the new PCI DSS v4 requirements and leveraging advanced solutions like Jscrambler, businesses can protect online transactions, ensure compliance, and maintain consumer trust.
