Skip to content

Fake payment form at checkout: how to spot and block it

Laís Peixoto

By Laís Peixoto

Growth Marketer, Proteside

Published · 4 min read

Malicious code shows a fake card form before the real one; the customer types their details, sees an error and types them again into the real form, never noticing the theft. Blocking it means making sure, on the shopper's screen, that the only card form displayed is the legitimate one.

A fake payment form is a scam in which malicious code draws, on a legitimate store's payment page, a card form that imitates the real one. The customer types their details there, sees an error message or is taken to the real form, and types everything again. The purchase is approved, but the details from the first attempt have already gone to the criminal. Blocking it means making sure the only card form on display is the legitimate one, and checking that on the shopper's screen, not just on the server.

How the scam works

  1. The criminal plants code on the page: through a flaw in the platform, a theme or a plugin, a stolen admin login, or a compromised partner script.
  2. When the customer reaches payment or clicks to complete the order, the code shows a fake form, on top of the real one or before it, with a padlock, colors and wording that look like the store's.
  3. The customer types card number, expiry date and security code, and a copy goes to an address the criminal controls.
  4. The code shows an error, or simply closes the window, and takes the customer to the real form.
  5. The customer types everything again, the purchase is approved and nobody connects the two.

The PCI Security Standards Council's guidance on payment page security, published in March 2025, calls this a double-entry attack. It has one big advantage for the criminal: it works even when the real form belongs to the payment provider and the page's own code cannot read what is typed into it. The fake form never has to touch the real one; it only has to appear first.

Two cases from 2026

In February 2026, the research firm Sansec reported the case of a supermarket chain with an international presence. The code planted in its store showed a fake card form in the customer's language and, after submission, displayed the payment provider's real form. Before acting, it checked whether the visitor was a logged-in store administrator and, if so, did nothing: anyone testing their own checkout would never see the fraud. Sansec said it alerted the company six times without a reply, and noted that AI tools now let criminals produce fake forms in any language and style within minutes.

In April 2026, Sansec described a campaign on 99 stores. When customers clicked the checkout button, they saw a full-screen window titled “Secure Checkout” with a padlock, which validated the card number in real time and asked for a billing address. After submission, it sent the customer on to the real checkout and marked the browser so it would not ask the same person twice.

How to recognize the signs

The PCI SSC notes that double-entry attacks tend to be discovered faster than silent copying, because customers find them odd or because the store notices while testing. The February case shows the second route can fail. Watch for:

  • customers saying they had to type their card twice, or saw an error and then managed to pay;
  • comments about a payment window that looked different, was in another language or had extra fields;
  • fraud alerts from banks or your acquirer on cards used in your store;
  • card fields on the page that are neither yours nor your provider's;
  • data sent from the page to addresses you do not recognize.

When you test, behave like an ordinary customer: logged out, in a private window, from another device and another network.

How to block it: checklist

  • Slim down the page. Keep only essential scripts on payment pages and on pages that display the provider's form.
  • Close the doors. Update platform, theme and plugins, remove what you don't use and require two-step verification on admin access.
  • Limit sources and destinations. Configure the page to load code from, and send data to, authorized addresses only.
  • Monitor continuously. PCI DSS requirement 11.6.1 asks for change checks at least weekly, but the PCI SSC itself recommends frequent or real-time monitoring where feasible. A fake form left live for a week reaches every customer that week.
  • Check the form on the shopper's screen. The most direct protection verifies, in the browser, that the only card form is the legitimate one and blocks any overlay before the customer types.
  • Brief your support team. “I had to enter my card twice” is a security alert, not a usability quirk; decide who that report goes to.

Proteside protects exactly this moment: it checks, in the shopper's browser, the payment forms shown on the page and stops the overlaid form before the customer hands over their details. Explore card payment protection and try it free for 14 days.

Back to blog

Read next