Card Skimming.

Card skimming covers two related attack families. Physical skimming uses tampered ATMs, fuel pumps, or point-of-sale terminals fitted with a thin overlay or a "shimmer" (a paper-thin insert that reads the EMV chip), often paired with a pinhole camera or keypad overlay to capture PINs; Bluetooth-enabled skimmers now exfiltrate data wirelessly. E-skimming, popularised under the umbrella name Magecart, injects malicious JavaScript into a vulnerable checkout page — or into a third-party script it loads — to siphon card numbers, CVVs, and addresses to an attacker server.

The most-cited case is British Airways: between 21 August and 5 September 2018 attackers modified a JavaScript file on BA's payment pages, compromising around 400,000 customers. The UK ICO initially proposed a record £183.39m GDPR penalty, later reduced to £20m in October 2020. The same year, Ticketmaster was breached through its third-party Inbenta chatbot script, and Newegg's checkout was skimmed — showing how supply-chain scripts widen the blast radius.

flowchart LR
  subgraph Physical
    A[Tampered ATM / pump / POS] --> B[Overlay or shimmer copies card]
    B --> C[Pinhole camera grabs PIN]
  end
  subgraph E-skimming
    D[Injected / third-party JS] --> E[Reads checkout fields]
    E --> F[Exfiltrates to attacker server]
  end
  C --> G[Card data monetised / sold]
  F --> G

Defences include EMV chip and tokenised wallets, tamper-evident and anti-skimming hardware, Subresource Integrity, a strict Content Security Policy, third-party script monitoring, and PCI DSS v4.0 controls for payment pages — notably requirement 6.4.3 (managing scripts) and 11.6.1 (tamper/change detection), mandatory since 31 March 2025.