Web-Skimming (Magecart) Checkout Scam

Web skimming — often called Magecart, after the criminal groups that made the technique notorious — is the digital version of an ATM skimmer, planted inside a real online shop. Criminals compromise a legitimate store's website, or one of the third-party scripts it loads, and inject a small piece of malicious code into the checkout page. As you type your card number, expiry date, security code, name, and address, the code copies each field and sends it to a server the criminals control. The store is genuine, the padlock and web address are correct, your payment is processed, and your goods usually arrive — nothing signals that your card details were stolen along the way. This is what makes web skimming so dangerous: it defeats all the standard advice about checking the URL and shopping with real retailers. A single compromised shop can leak the details of every customer who checks out until the code is found and removed, and the stolen data feeds card-not-present fraud worldwide.

The attackers first get their code onto the checkout page. Sometimes they breach the store directly through outdated shop software, weak admin passwords, or vulnerable plugins. Just as often they compromise a supplier instead: a chat widget, analytics tag, advertising script, or hosted library that hundreds of shops load into their pages. One poisoned script then skims every site that uses it. The injected code is small, disguised to look like normal site functionality, and often activates only on pages with payment fields. When you check out, it reads the payment form as you type or when you press pay, and sends a copy of the data to the criminals' collection server while the genuine payment goes through as usual. A common variant overlays a fake payment form on top of the real one: you enter your details, see a message that the payment failed, and are passed to the legitimate form, so the transaction succeeds on the second attempt. The stolen card details are typically sold or used for online purchases weeks later, far removed from the shop where they were taken.

Every visible trust signal is genuine. The web address is correct, the padlock is real, the store may be one you have used for years, and your order is confirmed and delivered. There is nothing a shopper can inspect that would reveal the skimmer — the malicious code runs invisibly among dozens of legitimate scripts. The delay between theft and fraud also hides the cause: when strange charges appear weeks later, the successful, uneventful purchase never comes to mind. Even the store is often unaware, since the compromise sits in code most merchants rarely review, sometimes inside a supplier they trusted.

'Payment failed. Please re-enter your card details to complete your order.' — shown after a fake form has already captured them

'You are being redirected to our secure payment partner.' — landing on a domain with no connection to the shop

A checkout that normally offers wallet payment suddenly insists on typed card details due to a technical issue

You cannot audit a shop's code, so protect the card instead of the checkout. Pay with a digital wallet where offered — the merchant receives a one-time token, so a skimmer captures nothing reusable. Ask your bank about virtual or single-use card numbers for online shopping, which become worthless after the purchase. Prefer a credit card to a debit card online so fraud never draws on your bank balance directly. Treat a checkout that errors and asks you to re-enter card details, or that redirects to an unfamiliar payment page, as a reason to stop. Keep instant transaction alerts on so any misuse of the card surfaces immediately.