In one day I found two more sites carrying malware designed to steal customers’ credit card details at checkout. I emailed both owners, because they had no idea.
The part that makes this hard to catch
What was interesting is that one site was linked to another site that was affected in the code. So in theory you would not find anything wrong in your own site’s code at all. The skimmer was being pulled in from somewhere else.
That is why “we scanned our files and they are clean” is not the reassurance owners think it is. If a third-party script, a shared library, an old plugin’s CDN or a partner site is compromised, your checkout serves the malicious code without a single altered file on your server.
Why nobody notices
Card skimming is designed to be invisible. The store looks normal, the checkout completes, the orders keep arriving. Nothing breaks, which is precisely why it can run for months. That is the same reason hacked stores stay hacked and why a skipped security audit can end a business.
The season makes it worse, because malware activity climbs going into peak trading when nobody wants to touch the site.
What actually protects you
Monitor continuously rather than scanning once. Watch what your checkout loads at runtime, not just what sits in your repository, and keep an inventory of every third-party script you allow near the payment page. Audit that list ruthlessly, because each entry is a door.
And when someone reports a problem to you, take it seriously instead of treating it as a sales pitch, which is the mistake that cuts both ways.
If you want your checkout checked for skimming code, including what it pulls from elsewhere, book a call.