How formjacking steals your card data without you noticing

In September 2018, British Airways discovered that 380,000 customers had card data stolen while booking on the airline's website and app. The culprit: 22 lines of malicious JavaScript quietly inserted into the checkout page's code. No virus, no suspicious pop-up — just a payment form that sent a copy of everything typed into it to a criminal server. The transaction went through normally. You noticed nothing.

The attack has a name: formjacking.

What formjacking is

Formjacking is an attack in which criminals inject malicious JavaScript into the payment pages of online stores. When you fill in your card details at checkout — number, expiry date, CVV — the script captures that information in real time and sends it to a server controlled by the attackers, before the form is even submitted to the legitimate site.

The purchase proceeds as normal. The store receives the order. The card is charged. You notice nothing until an unrecognized charge shows up on your statement days or weeks later.

The best-known group associated with the technique is Magecart — a collective name for dozens of criminal groups that have been running this kind of attack since at least 2015. The name comes from "Magento cart", the e-commerce platform that was the most frequent target in the early campaigns. According to DataDome, Magecart attacks grew 103% in just six months during 2024-2025.

How the attack works in practice

Formjacking can happen through two main routes:

• Direct compromise of the site: the attacker exploits a vulnerability in the store's CMS — WordPress, Magento, OpenCart — and inserts the malicious script directly into the checkout page's code.
• Third-party attack (supply chain): the store loads a legitimate external script — a chatbot, an analytics tool, a marketing widget — that has been compromised. When the store loads that script, it loads the attacker's code along with it.

The script stays active silently. It doesn't change the page's appearance or interrupt the purchase. It simply listens to keystroke events on the form fields and copies the data as soon as it's entered — sometimes even before the user clicks "Place order".

In 2024, a critical vulnerability in Adobe Commerce and Magento (CVE-2024-34102, dubbed CosmicSting) was exploited at scale to install Magecart skimmers. Researchers recorded that 75% of the affected stores were still unpatched a week after the fix was disclosed — more than enough of a window for the groups to operate freely.

The most famous cases

British Airways (2018)

The malicious code stayed active for 15 days on the British airline's website and app. That meant 380,000 customers with personal and financial data compromised. The investigation found the script was a slightly modified version of a legitimate JavaScript library used by the site — altered with just 22 extra lines of code. British Airways was fined £20 million by the ICO, the UK's privacy regulator.

Ticketmaster (2018)

Here the vector was a support chatbot supplied by a third-party company called Inbenta. Inbenta's script was compromised and, because Ticketmaster loaded it on its checkout pages, the data of 40,000 customers was captured. It's a clear example of a software supply chain attack: the direct target wasn't Ticketmaster, but a supplier with access to its production environment.

Is formjacking the same thing as phishing?

No. Phishing tricks the user into handing data over on a fake site; formjacking compromises a legitimate site to capture data the user provides without knowing they're being watched. With phishing, you're on the wrong domain. With formjacking, you're on the right domain — the page's code has simply been tampered with.

That difference makes formjacking harder to detect: checking the URL doesn't help. Neither does the HTTPS padlock — it guarantees the connection between you and the server is encrypted, not that the page's code is intact.

Why it's so hard to detect

• No visual change: the page looks identical to the legitimate version — layout, logo, form, everything the same.
• HTTPS is no guarantee of clean code: the malicious script is already inside the page served by the legitimate server. Encryption protects the communication channel, not the integrity of the code.
• Third-party scripts are invisible to the user: an ordinary store may load dozens of external scripts. The visitor has no visibility into which ones they are or where they come from.
• Capture happens before the submit: even if the transaction fails afterwards for any reason, the data you typed has already been sent to the attackers' server.

It's worth noting that a VPN doesn't protect against formjacking: it encrypts the traffic between you and the site, but it doesn't interfere with what the JavaScript inside the page does with the data you type locally in the browser.

How to protect yourself when shopping online

No single measure eliminates the risk completely, but a few practices reduce your exposure substantially:

• Use a disposable virtual card: most digital banks and card issuers now offer virtual cards with a unique number per purchase or a short validity period. Even if the skimmer captures it, the data becomes useless quickly.
• Prefer checkout through an intermediary: paying via PayPal, Apple Pay or Google Pay doesn't expose your real card number to the store's site. The intermediary processes the payment and the merchant never sees the card details.
• Turn on real-time notifications: instant alerts in your banking app let you spot unrecognized charges while they're still easy to dispute.
• Avoid saving your card on niche stores: large marketplaces have dedicated security teams and regular audits. Smaller stores are easier targets and have fewer resources for incident response.
• Block third-party scripts: the uBlock Origin extension, in advanced mode, blocks third-party scripts by default — which directly reduces the attack surface for supply-chain formjacking.

Beyond checkout skimmers, it's worth watching for other payment scams that operate outside the traditional e-commerce environment, such as fake instant-payment QR codes pasted over the originals — the goal is the same, intercepting the payment before it reaches the right destination.

Conclusion

Formjacking is silent by design. There's no alert pop-up, no suspicious email to ignore, no strange URL to spot. The attack happens inside a legitimate site while you do something completely ordinary — buying a plane ticket or a concert ticket. The most practical defense for a consumer is to remove the real card number from the equation: a disposable virtual card or payment via an intermediary eliminates the very data the skimmer wants to capture.

For anyone running an online store, script integrity monitoring and immediate patching are the main lines of defense. Attackers exploit vulnerability windows measured in days — leaving a CMS unpatched for weeks is accepting that risk. If you want to understand how this third-party vector became one of the most exploited, read about the Jscrambler attack and the NPM package supply chain.