Five Warning Signs Your Checkout Has Been Compromised

Most checkout compromises aren't discovered by the retailer. They're discovered by a bank, weeks or months later, flagging a pattern of fraud on cards recently used at one site.

By the time that call comes in, the damage window has already closed. The compromise happened, ran quietly for however long it took someone else to notice, and only then became visible.

That's the uncomfortable truth about client-side attacks: your checkout can look, feel, and perform exactly as it should while something is actively skimming card data in the background. There's rarely a dramatic failure. There's just silence, right up until there isn't.

Here are five signs worth taking seriously, and why most of them are easy to miss without something actively watching for them.

1. Scripts you don't recognise, running on your payment page

Every checkout accumulates third-party scripts over time. Analytics, chat widgets, personalisation tools, ad pixels. It's normal for that list to grow.

What's not normal is a script appearing that nobody on your team added, or an existing script suddenly loading additional code from a domain you don't recognise.

Attackers rarely inject something entirely new and obvious. More often, they compromise a vendor you already trust and use that trust to slip in unnoticed.

If you don’t have a solution for inventorying and checking your script list regularly, you have no way of knowing whether this has already happened.

‍

2. A script's behaviour changes, even if the script itself looks the same

This is the one most retailers don't think to check at all.

A script can pass every visual and functional check, load correctly, run the widget it's supposed to run, and still have been quietly altered to also capture what a customer types into your card fields.

The vendor's script tag hasn't changed. The vendor's domain hasn't changed. What the code actually does, has.

Spotting this requires watching behaviour, not just presence, which is precisely the gap between a one-time script inventory and continuous monitoring.

3. Unusual outbound connections from the checkout page

A compromised script needs to send the data it captures somewhere. That means a request leaving the customer's browser to a destination that has nothing to do with your checkout functioning.

These requests are built to blend in. They often mimic the pattern of legitimate analytics or tracking calls, and they don't touch your servers at all, so your own infrastructure logs show nothing unusual. The only place this is visible is at the browser layer, on the page itself, as the request happens.

4. A rise in card-not-present fraud reports tied to your site

If your payment processor or bank starts flagging a cluster of fraudulent transactions linked to cards recently used at checkout, that's not a billing anomaly.

That's usually the first external signal of a skimming compromise that's already been running for some time.

The frustrating part is the timing. This signal typically arrives well after the compromise began, and by definition, it comes from someone else's systems, not yours.

Waiting for this to be your detection method means accepting a window of active compromise before you find out about it at all.

5. Nothing looks wrong at all

This is the sign that matters most, because it's the default state of a well-executed compromise.

No performance drop. No customer complaints. No visible errors. Orders complete normally, checkout works exactly as expected, and every dashboard you're already watching stays green.

A skimming script is designed to be invisible to the retailer while it works, and in most cases, it succeeds.

If your only checks are periodic, an assessment once a year or a script review every few months, then "nothing looks wrong" isn't reassurance. It's simply the absence of looking at all.

Detection can't wait for a symptom

Every sign above shares the same problem: by the time most of them become visible without dedicated monitoring, real damage has usually already happened.

A fraud report is a lagging indicator. A customer complaint is a lagging indicator. Even a script that starts behaving strangely may have been doing so for weeks before anyone happened to notice.

Continuous monitoring exists to close that gap, watching scripts, connections, and behaviour on your checkout as they happen, rather than waiting for a symptom to surface somewhere downstream.

Want to know what's actually running on your checkout right now? Book a 20-min walkthrough and find out.