Skip to content
Credit cardWorldwide

Protection against card data theft at checkout

Card data theft at checkout is silent: the customer types their details, the purchase is approved, and a copy of the data goes to the criminal. Nobody notices until the statement arrives. Proteside watches the form while your customer types.

See pricing
Credit card: 1. Normal purchase: The customer types their card details at checkout. 2. Scam attempt: A hidden script tries to copy the card number and send it elsewhere. 3. Blocked: Proteside cuts off the transfer and blocks the copy. 4. Payment intact: Payment approved, with the data delivered only to your gateway.

The customer types their card details at checkout.

1/4 · Normal purchase

Illustrative animation

Credit card · Worldwide

When paying by credit card, the customer types the card number, expiry date and security code into a form on the page. Everything running on that page (your site, plugins or third parties) can, in principle, read what’s being typed.

How the attack happens without anyone noticing

  • Typed card details copied

    Malicious code injected into the page captures the card number as the customer types and sends a copy elsewhere. The purchase goes through normally. The theft is invisible.

  • A fake form on top of yours

    The scam draws a form identical to yours, layered over the original. The customer hands their details to the criminal and is then sent on to the real flow, none the wiser.

  • Compromised third-party script

    Chat, analytics, reviews: any partner script running on your checkout can be compromised and become a way in, even if your own site is untouched.

How it works

Four layers between the scam and your payment

  • 1

    Record what’s legitimate

    Proteside records the legitimate payment form fields, the authorized scripts and the allowed destinations for data.

  • 2

    On-screen check

    While the customer types, it checks who is reading the fields and where the data is going.

  • 3

    Block before confirmation

    Unauthorized reading, overlaid forms or data sent to an unknown destination are stopped on the spot.

  • 4

    Alert and evidence

    Every attempt becomes an alert and a record, feeding the evidence for PCI DSS requirements 6.4.3 and 11.6.1.

The technical details of detection and blocking are Proteside’s proprietary technology and are shown in a demo, using your real scenario. How it works

Protection scope

What’s covered

  • Card forms on your page, including custom checkouts
  • Third-party scripts loaded on the payment page
  • Fake forms overlaid on the original
  • Typed data sent to unauthorized destinations

Out of scope

  • Data stolen outside your page (phishing, breaches at other companies)
  • Buyer risk assessment, which is the job of fraud prevention
  • Card fields fully hosted by your payment provider, which live in their environment (in that case, we protect the page around them)

Also protected by the same installation

One installation, every payment method in your checkout.

Frequently asked questions

Isn’t this what fraud prevention is for?

No. Fraud prevention assesses whether the buyer can be trusted. It can’t see malicious code copying data inside the page. They’re different, complementary layers.

What about PCI DSS for card payment pages?

Proteside automatically produces evidence for requirements 6.4.3 (script management) and 11.6.1 (change detection), ready for your QSA and acquirer.

Does it also cover digital wallets?

Yes. Protection applies to any payment form on the page, including digital wallets shown at checkout. Debit cards have their own protection page.

Protection against card data theft at checkout

Choose the path that fits your business: start a free trial for your store or book a demo built on your real payment flow.

See pricing