Also called: Digital skimming, Electronic card skimming, Web skimming
What e-skimming is
E-skimming is a cyberattack on an online store or app. Malicious code in a checkout page or a script loaded by that page copies information customers enter, such as card numbers, expiration dates, security codes, names and addresses. The code sends the stolen data to a domain controlled by the attacker.
The attack targets payment data in the customer's browser, before or alongside legitimate payment processing. HTTPS protects data sent between the browser and a website, but it does not stop malicious code running in the browser from reading checkout fields. E-skimming is related to skimming, but it targets online checkout rather than a physical card reader or terminal.
A successful checkout does not prove the payment page was safe; malicious code can copy card details while the order goes through.
How an e-skimming attack reaches checkout
Attackers introduce the code through a weakness in the e-commerce platform, stolen administrative credentials, or a compromised third-party component. Scripts for analytics, chat, advertising and other site features can create an entry point if an attacker changes what the page loads.
The code can copy form entries when a customer submits payment, add a fake form over the real one, or alter where a payment iframe sends information. A legitimate order can still go through, leaving the customer and your staff unaware that the same details were copied.
What it means for your business
E-skimming is not a card-network charge or a standard line on your processing statement. The financial impact comes from stolen data being used for fraudulent purchases, customer disputes, investigation and recovery work, downtime, and damage to customer trust. There is no standard e-skimming fee amount to compare or negotiate.
PCI DSS v4.0.1 includes payment-page protections. As of 2026, requirements 6.4.3 and 11.6.1 require controls for authorizing and checking payment-page scripts and detecting unauthorized changes. The future-dated requirements became mandatory on March 31, 2025. The relevant controls depend on how your payment page and its embedded components are built.
What you can actually change
Reduce the code that runs on pages collecting card data, and watch for changes to the page and its scripts. HTTPS alone does not prevent e-skimming, so include browser-side scripts and third-party components in your security checks.
- Inventory every script on payment pages, including scripts loaded by third-party tools, and document why each one is needed.
- Use controls that authorize payment-page scripts and detect unauthorized changes, as required by PCI DSS controls 6.4.3 and 11.6.1.
- Review changes to payment forms, embedded frames and outbound connections against an approved baseline.
- If you find suspicious code, preserve a copy, identify how it was added, change affected credentials and follow your incident-response plan.
- Map checkout scripts. List the scripts and third-party components that load on each page where customers enter payment details.
- Monitor page changes. Set up checks that alert you when payment-page scripts, forms or embedded frames change without approval.
- Prepare a response. Document who will preserve suspicious code, secure credentials and coordinate the investigation if an attack is found.
Frequently asked questions
What is the difference between e-skimming and skimming?
E-skimming steals payment data through malicious code on an online checkout page or in a script the page loads. Physical skimming uses a tampered card reader or terminal to capture data from a card. Both target payment information, but the attack happens in different places.
Can HTTPS prevent e-skimming?
No. HTTPS protects data in transit between a customer's browser and your site. E-skimming code running in the browser can read checkout fields before that protection applies, so you also need controls for payment-page scripts and changes.
Does e-skimming appear as a fee on my processing statement?
No. E-skimming is a cyberattack, not a standard processing fee or statement line. Its business costs come from the incident, such as investigating the attack, responding to fraud reports, restoring the site and addressing customer concerns.