Debit cardWorldwide

Protection against debit card scams at checkout

With debit, the money leaves the account instantly. A tampered form captures the card number, security code and the PIN or one-time code as the customer types, and the charge lands before anyone is alerted. Proteside watches the form at the exact moment of payment.

See pricing

The customer types their debit card details and PIN at checkout.

Illustrative animation

Debit card · Worldwide

When paying by debit card, the customer types the card details and often confirms the purchase with a PIN, a one-time code or the bank app. The amount is debited from the account right away, and disputing a wrongful charge is slower and harder than with credit. That is why everything running on the payment page has to be trustworthy while the customer types.

How the attack happens without anyone noticing

PIN and card details captured
Malicious code injected into the page reads the card number, expiry date, security code and the PIN or code typed into the form, and sends it all elsewhere. With that set, the criminal spends from the account as if they were the customer.
Instant charge, no easy dispute
With debit, the money leaves the account on the spot. By the time the customer notices, it has already reached the criminal, and the dispute depends on the bank, with longer deadlines and fewer guarantees than a credit chargeback.
A fake screen asking for the PIN
The scam lays a screen identical to your checkout over the real one and asks for the card PIN to confirm the purchase. The customer hands the PIN to someone who should never have it, and is then sent on to the real flow.

How it works

Four layers between the scam and your payment

1
Record what’s legitimate
Proteside records the legitimate fields of the debit form, the authorized scripts and the allowed destinations for data.
2
On-screen check
While the customer types the card details and the PIN, it checks who is reading the fields and where the data is going.
3
Block before confirmation
Unauthorized reading, an overlaid screen asking for the PIN or data sent to an unknown destination are stopped before the debit.
4
Alert and evidence
Every attempt becomes an alert and a record, feeding the evidence for PCI DSS requirements 6.4.3 and 11.6.1.

The technical details of detection and blocking are Proteside’s proprietary technology and are shown in a demo, using your real scenario. How it works

Protection scope

What’s covered

Debit card forms on your page, including custom checkouts
PIN and authentication fields shown at checkout
Fake screens overlaid on the original form
Typed data sent to unauthorized destinations

Out of scope

Data stolen outside your page (phishing, fake apps, breaches at other companies)
Authentication done inside the customer’s banking app
Card fields fully hosted by your payment provider, which live in their environment (in that case, we protect the page around them)

Also protected by the same installation

One installation, every payment method in your checkout.

Frequently asked questions

How is this different from the credit card page?

With debit, the money leaves the account instantly and the PIN or code is often typed at checkout. A scam that captures card and PIN gives direct access to the customer’s money, and disputes are slower. Protection watches the same fields, with special attention to the PIN.

Isn’t this what fraud prevention is for?

No. Fraud prevention assesses whether the buyer can be trusted. It can’t see malicious code copying data inside the page. They’re different, complementary layers.

What about PCI DSS for debit payment pages?

Debit card data is also in scope for PCI DSS. Proteside automatically produces evidence for requirements 6.4.3 and 11.6.1, ready for your QSA and acquirer.