Formjacking: When Your Checkout Form Works for Someone Else

Your checkout can be stealing from customers while working flawlessly for you. Formjacking plants a small piece of JavaScript on your payment page that lets the order complete normally — and simultaneously mails a copy of the card number, name, and address to a server the attacker controls. Nothing fails. Nobody complains. The first sign is often a bank tracing fraud back to your store.

Interception, not infection of your server

Classic card skimming compromises the server and reads data there. Formjacking is different: it runs in the customer's browser, harvesting keystrokes at the moment of typing. That distinction matters because the malicious code often never touches your server at all — it rides in through a script you legitimately load from someone else.

The scripts you load but don't control

Count the third-party JavaScript on your checkout: analytics, chat widgets, review badges, tag managers, font loaders. Each loads from an outside server at page time, meaning each of those vendors — and anyone who compromises them — can run code on your payment page. The most damaging formjacking campaigns broke into one widely-used widget provider and instantly reached every store that embedded it. Your security became their security the day you pasted the snippet.

Subresource integrity: a tamper seal for scripts

SRI lets you pin a script tag to a cryptographic fingerprint by adding an integrity attribute; if the file changes even slightly, the browser refuses to run it. It only works for scripts that don't change legitimately, so it can't cover everything — but for static libraries it turns a silent swap into a hard failure you'll notice. A Content-Security-Policy header adds a second layer by restricting which domains the page may send data to, blocking the exfiltration step itself.

Fewer scripts, smaller blast radius

The cheapest defense is subtraction. Does the chat widget need to exist on the payment step, or only on product pages? Many platforms let you exclude scripts from checkout — use that. Every script you remove from the payment flow is one vendor whose breach can no longer become your breach.

Watching for the swap

Because a formjacked page looks perfect to the owner, detection means comparing what loads now against what should load. Do a periodic pass in your browser's developer tools: open the Network tab on checkout and question any domain you don't recognize. Better, use monitoring that inventories your page's scripts continuously and alerts on new or altered ones — the change usually happens overnight, not while you're watching.

Trust Guard's external scanning examines your pages the way a visitor's browser sees them, flagging injected and altered scripts before the card data flows elsewhere. It's the watchful eye a busy checkout deserves.