Also called: RAM-scraping attack, Memory scraping, RAM scraping, POS memory scraping
What a memory-scraping attack is
A memory-scraping attack is a type of malware attack that searches a computer's working memory, or RAM, for sensitive information. Payment terminals are a known target because they briefly hold card data in readable form while processing a transaction.
The data can include magnetic-stripe details such as the account number, cardholder name and expiration date. If malware captures and removes that information, the incident can become a data breach. A memory-scraping attack describes the method used to access data, while a data breach describes the exposure or loss of protected information.
Encryption protects data in transit, but readable data in a payment terminal's memory can still be exposed.
How the attack affects a payment system
Attackers need access to a system before memory-scraping malware can search its memory. Once present on a payment terminal, malware can look for card data while the terminal or payment application handles it, then collect and send the data outside your business.
Encryption in transit protects data as it moves between systems, but it does not protect information while an application needs to read it in memory. Point-to-point encryption can reduce this exposure by encrypting card data at the reader, before it reaches the payment system's memory in readable form.
What it means for your business
Stolen card data can be used for counterfeit-card or other payment fraud. Responding to an incident can also take systems out of service and require investigation and remediation. The resulting costs depend on what data was exposed and how much of your payment environment was affected.
There is no standard memory-scraping fee on a merchant statement. A PCI non-compliance fee is a separate charge that a processor can bill when you have not validated PCI DSS compliance. As of 2026, PCI DSS v4.0.1 is the current version.
What you can actually change
You cannot guarantee that attackers will never target your business, but you can limit how far they can get and how much payment data is exposed. Keep payment systems separate from office and guest networks, restrict remote access, and reduce the time card data remains readable.
- Use validated point-to-point encryption where it fits your payment setup.
- Require multi-factor authentication for remote access and limit accounts to the access each person needs.
- Separate payment systems from office computers and guest Wi-Fi, and restrict unnecessary outbound connections.
- Keep payment software updated and monitor payment endpoints for unfamiliar accounts, processes or network activity.
- Check your reader. Confirm whether your card readers encrypt card data before it enters the payment system.
- Restrict remote access. Require multi-factor authentication and remove remote accounts that no longer need access to payment systems.
- Separate payment systems. Keep point-of-sale devices on a network separate from office computers and customer Wi-Fi.
Frequently asked questions
What is a memory-scraping attack?
It is a malware attack that searches a computer's memory for sensitive data while an application is processing it. Payment terminals are a known target because card data can briefly be readable in memory during a transaction.
Is memory scraping the same as a data breach?
No. Memory scraping is a way malware tries to capture information from a system's memory. A data breach is the exposure or loss of protected information. A successful memory-scraping attack can lead to a data breach.
Does encryption stop memory scraping?
Encryption in transit does not protect data while an application needs to read it in memory. Point-to-point encryption can reduce that exposure by encrypting card data at the reader before it reaches the payment system in readable form.