How formjacking steals your card data without you noticing

Thu, 20 Aug 2026 08:00:00 -0300

In September 2018, British Airways discovered that 380,000 customers had card data stolen while booking on the airline's website and app. The culprit: 22 lines of malicious JavaScript quietly inserted into the checkout page's code. No virus, no suspicious pop-up — just a payment form that sent a copy of everything typed into it to a criminal server. The transaction went through normally. You noticed nothing.

The attack has a name: formjacking.

E-Commerce on Locodigital

How formjacking steals your card data without you noticing