Card Skimming.

Theft of payment-card data by capturing it at the point of entry, either via a hidden physical device or malicious script on a website checkout. It belongs to the Attacks & Threats category of cybersecurity.

Theft of payment-card data by capturing it at the point of entry, either via a hidden physical device or malicious script on a website checkout.

Card skimming covers two related attack families. Physical skimming uses tampered ATMs, fuel pumps, or point-of-sale terminals fitted with a thin overlay or shimmer that copies magnetic-stripe or chip data, often paired with a pinhole camera or keypad overlay to capture PINs. E-skimming (also called Magecart) injects malicious JavaScript into a vulnerable e-commerce checkout page to siphon card numbers, CVVs, and addresses to an attacker-controlled server. Defences include EMV chip and tokenised wallets, tamper-evident hardware checks, anti-skimming sensors, web-application firewalls, Subresource Integrity, Content Security Policy, third-party script monitoring, and PCI DSS-compliant code reviews of payment flows.

Defences for Card Skimming typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Skimming, Magecart, E-skimming.