My IP Help

Skimming

Also known as: Magecart, e-skimming, web skimming

Theft of payment-card data at the point of entry — physical skimmers on ATMs and POS terminals, or malicious JavaScript (web skimming / Magecart) injected into checkout pages.

Last updated:

What is skimming?

Skimming is the theft of payment-card data at the moment the cardholder enters it. Two distinct attack surfaces share the name:

  • Physical skimming — a hardware overlay on an ATM or fuel-pump card reader, often paired with a pinhole camera or fake PIN pad, captures the card stripe and PIN. "Shimmers" are a newer variant that reads chip-card data from inside the slot.
  • Web skimming / Magecart / e-skimming — malicious JavaScript injected into an e-commerce checkout page exfiltrates card numbers, CVVs, and billing addresses to an attacker-controlled server. Named after the Magecart groups that industrialized the technique against Magento and other shopping platforms starting around 2015.

How web skimming works

Attackers compromise either the merchant site itself (via a vulnerable admin plugin, a stolen CMS password, or a leaked SSH key) or a third-party script the site loads — analytics snippets, review widgets, A/B test libraries, chatbots. Once the attacker can modify a script the checkout page loads, they add a few hundred bytes of JavaScript that watches the payment form and POSTs each keystroke to a server they control. The card data then feeds underground carding markets.

Detection

  • Subresource Integrity (SRI) on every third-party script stops modified scripts from executing
  • Content Security Policy (CSP) with reporting catches connections to unexpected exfiltration endpoints
  • Monitor third-party script hashes — unexpected changes are the earliest signal
  • IP reputation on exfil endpoints — the domains and IPs used for card drops are shared across campaigns

Check whether a suspicious exfiltration domain's IP has abuse history with our IP abuse report checker.

Frequently Asked Questions

"Skimming" is the broad term for stealing payment-card data at the moment it is entered — physical (ATM/POS overlays) or digital (compromised checkout pages). "Magecart" specifically refers to web skimming, named after the loose collection of threat actor groups that industrialized JavaScript injection against e-commerce platforms (originally targeting Magento, hence the name) starting around 2015. All Magecart attacks are skimming; not all skimming is Magecart.
Median dwell time has historically been 22 days, with many skimmers running for 6 months to over a year on smaller merchants without dedicated security monitoring. The longest documented skimmers ran for years on sites that loaded compromised third-party scripts — the merchant's own code was untouched, so internal audits did not flag anything. Subresource Integrity and CSP with reporting are the most effective controls because they catch the change immediately regardless of where the skimmer lives.
Hard to spot manually — the skimmer is usually a few hundred bytes of JavaScript that doesn't change the visible page. Reliable detection requires automated monitoring: subresource integrity (SRI) hashes on every script, CSP report-only mode that logs every connection the page makes, third-party monitoring services (Akamai Page Integrity Manager, Source Defense, Tala, c/side), and synthetic monitoring that checks out a test order regularly. Manual signs are limited to chargeback patterns weeks after the fact.
SRI is an HTML attribute that lets a page declare a cryptographic hash of the script it expects to load (`<script src="..." integrity="sha384-...">`). The browser computes the hash of the actual script it receives and refuses to execute it if the hash doesn't match. This stops Magecart-style attacks where an attacker compromises a third-party CDN or analytics provider and modifies a script the merchant trusts. SRI is well-supported by all modern browsers and is the single highest-value control against web skimming.
Significantly more resistant than magnetic stripe, but not immune. Chip-and-PIN dramatically reduced traditional ATM and POS skimming because the chip data cannot be cloned to a magstripe card that works at modern terminals. But "shimmers" — thin overlays inside the chip slot that intercept chip data during read — exist, and chip data stolen this way can sometimes be replayed against poorly-implemented terminals. Card-not-present web transactions are completely unaffected by chip security and remain the dominant carding-fraud vector.
Back to glossary