E-commerce Security: how to harden checkout, payments, and customer data against skimming, fraud, and DDoS

Why e-commerce is a permanent, not seasonal, target

An online store is, by definition, an application exposed to the public internet 24 hours a day, receiving payment data and personal data in continuous volume. Unlike an internal system, it cannot hide behind a VPN or a corporate network: the attacker and the legitimate customer arrive through the same door. This structural exposure makes digital retail one of the most targeted sectors, and the attack is not an isolated opportunistic act — it is industrialized, automated, and driven by direct financial return. Stolen cards have immediate liquidity in underground markets; customer accounts are worth their data and their loyalty points; and the store's own unavailability can be monetized through extortion.

What makes e-commerce particularly hard to defend is its architecture. The modern store is not a monolithic block controlled by the company: it is a composition of platform (Magento, Shopify, VTEX, WooCommerce, headless platforms), themes, plugins, payment gateways, analytics tools, marketing pixels, chats, recommenders, and dozens of third-party scripts that load in the customer's browser. Each of these components is a vendor, and each vendor is a door. The attack surface of digital retail, therefore, does not end at the company's server — it extends across the entire software supply chain that runs in the front-end.

The practical consequence is that the defense cannot be piecemeal. Protecting only the server leaves the client-side checkout open to skimming; protecting only the application leaves the edge open to DDoS; and protecting everything technically, but without compliance, leaves the company legally exposed when the incident happens. Decripte treats e-commerce as a complete system — from the edge to the data, from prevention to response.

Web skimming and Magecart: the attack that steals cards without touching your database

Web skimming, also known by the name of the group that popularized it, Magecart, is the most insidious attack in e-commerce because it defies the security intuition of most companies. It does not break into the database, does not leak a table dump, does not trigger the traditional exfiltration alerts on the server. Instead, the attacker injects a small snippet of malicious JavaScript into the checkout page. This code runs in the customer's own browser and, as the person types the card number, expiration date, and CVV into the form fields, it silently copies that data and sends it to a server controlled by the criminal — in parallel with the legitimate processing of the payment. To the customer, the purchase happens normally. To the store, nothing seems wrong. The card, however, has already been cloned.

What makes Magecart especially dangerous is the entry vector. The attacker rarely compromises the store's server directly. Instead, they compromise a component of the front-end software supply chain: an outdated plugin, a theme with a known vulnerability, a JavaScript library hosted by a third party, or the server of an analytics or widget vendor. When that component is loaded by the checkout page, the malicious code comes along with it. A single compromised vendor can simultaneously contaminate the checkout of hundreds of stores that trust that script — it is a supply chain attack with a multiplier effect.

The detection window is what separates a controlled incident from a catastrophe. Public Magecart cases show that the code can remain active for weeks or months before being noticed, usually because the discovery comes from outside — an acquirer flags mass fraud associated with the store, or a researcher finds the exfiltration domain. The longer the skimmer stays active, the more cards are stolen, the greater the number of harmed customers, and the more severe the company's exposure before the card brand, the acquirer, and the ANPD.

Payment fraud, chargeback, and bots: the silent loss of the operation

Not every attack on e-commerce seeks to break into the company — a good part seeks to abuse the store working exactly as it should. Payment fraud uses stolen cards (often obtained via skimming at other stores) to make purchases that are legitimate from a technical standpoint. When the real cardholder disputes the charge, the chargeback comes: the store loses the merchandise, loses the amount, pays fees, and also accumulates dispute rates that, if high, lead to penalties and even termination by the acquirer. Payment fraud, therefore, is not just a unit loss — it is an operational risk that threatens the very ability to process cards.

Bots are the engine of much of this abuse and of several others. Credential stuffing bots test, en masse, combinations of email and password leaked on other sites to hijack customer accounts (with their saved cards and loyalty points). Card testing bots validate lists of stolen cards by making micro-transactions at the store, generating noise and fees. Scraping bots copy the entire catalog, prices, and stock for competitors or aggregators. And inventory hoarding bots add high-demand products to the cart en masse to exhaust stock and resell them — a chronic problem in launches and peak dates.

Combating this abuse is a specific discipline: bot management at the edge, which distinguishes legitimate human traffic from malicious automation through behavioral signals, source reputation, adaptive challenges, and pattern analysis — without harming the real customer's experience or legitimate bot traffic (such as search crawlers). Decripte implements this layer in Edge Security and correlates the events in the SOC, so that a spike in login attempts or declined transactions becomes an investigable alert, not just a line in a log.

DDoS and downtime on peak dates: when every minute offline is lost revenue

For e-commerce, availability is direct revenue. Every minute the store is offline during a campaign is a lost sale that does not come back — the customer goes to the competitor and, often, does not return. That is why digital retail is a recurring target of distributed denial-of-service (DDoS) attacks, and the timing is not random: attackers choose exactly the moments of greatest value — Black Friday, Mother's Day, Christmas, launches, and sales — because that is when downtime hurts most and when the pressure to 'make the problem go away' is greatest, opening space for extortion (ransom DDoS).

Denial-of-service attacks have distinct layers and require distinct defenses. Volumetric attacks (layers 3 and 4) try to saturate the bandwidth and infrastructure with raw traffic, and are mitigated at the edge, before they reach the origin, by an absorption network with capacity far greater than that of the attack. Layer 7 (application) attacks, on the other hand, are more sophisticated: they simulate legitimate requests — searches, cart additions, logins — to exhaust expensive back-end resources with relatively low volume, easily confused with a genuine Black Friday peak. Distinguishing one from the other in real time, under pressure, is precisely the SOC's job.

Defense against downtime goes beyond DDoS. It involves infrastructure hardening, capacity planning, well-configured cache and CDN, DNS resilience, and a response plan that includes adaptive rate limiting and waiting rooms to degrade gracefully instead of going down completely. Decripte structures this layer in Edge Security and validates it in the simulations that precede the major dates.

Customer data breach: the LGPD dimension of the incident

Every online store is, in the language of LGPD, the controller of a large base of personal data: name, CPF, address, phone, purchase history, and frequently payment data. A leak of this base — whether through an application breach, exploitation of a poorly protected API, compromise of a plugin, or a misconfiguration that exposes a bucket or a database — is not just a technical and reputational problem: it is a regulatory incident that triggers concrete legal duties.

The General Data Protection Law (Law 13.709/2018) determines that, in a security incident that may entail relevant risk or harm to the data subjects, the controller must notify the National Data Protection Authority (ANPD) and the affected data subjects within a reasonable time, in accordance with the ANPD's current regulations on incident communication. The company must demonstrate that it adopted adequate security measures, that it detected the incident, that it contained it, and that it is mitigating the harm. Without detection capability and without preserved forensic evidence, the store cannot even gauge the size of the leak — and answering 'we don't know what was exposed' to the ANPD and to the customer is the worst possible scenario.

There is also the interface with PCI-DSS when card data is involved. The Payment Card Industry Data Security Standard, maintained by the PCI Security Standards Council, defines technical and procedural requirements for any organization that processes, stores, or transmits card data. In an incident affecting card data, the contractual obligations with the card brand and the acquirer are added to the LGPD duties, which may include forensic investigation by a qualified firm, fines, and a review of accreditation. Decripte structures the operation to reduce the PCI scope (for example, by keeping card data outside the store's environment via fields hosted by the gateway) and to respond methodically when the worst happens.

How Decripte structures e-commerce defense: from the edge to the data

Defense in depth, from the client to the back-end

Decripte does not sell isolated boxes; it structures a layered defense in which each control covers the blind spot of the previous one. At the edge, Edge Security absorbs DDoS, filters malicious requests with a WAF, and manages bots before the traffic reaches the application. At the application and checkout layer, script integrity monitoring and SOC surveillance detect skimming and tampering. At the discovery layer, Pentesting finds the gaps in plugins, APIs, and payment integrations before the attacker does. And, cross-functionally, Compliance ensures that all of this withstands an audit and an incident.

The operational differentiator is correlation. A spike in declined logins (a sign of credential stuffing), a transaction that appears on a new exfiltration domain (a sign of skimming), and a sudden increase in heavy search requests (possible layer 7 DDoS) are, in isolation, noise. Seen together by the SOC, with sector context, they become an investigable and actionable picture. It is this integrated view that makes it possible to act in minutes — and not discover the problem weeks later, through the acquirer.

Pentesting and vulnerability management: finding the gap before the criminal

Most e-commerce compromises begin in a known and avoidable gap: an outdated plugin with a public vulnerability, a cart API that exposes other customers' data when an identifier is manipulated, an admin panel accessible without MFA, a payment configuration that allows amounts to be manipulated in the front-end. Decripte's Pentesting simulates the real attacker against these points, focusing on what matters for digital retail: the chain of plugins and themes, the payment integrations, the catalog/cart/checkout APIs, and the authentication and account recovery flows.

The test is guided by recognized methodologies — among them the OWASP Top 10 for web application risks and the OWASP API Security Top 10 for the specific risks of APIs, which are today the heart of any modern and headless e-commerce. Vulnerabilities such as object-level access control flaws (accessing another customer's order by swapping an ID), injections, exposure of sensitive data, and insecure configurations are exactly what Pentesting looks for before they are exploited in production.

Pentesting is not a one-off event: vulnerability management turns the findings into a continuous cycle of identification, prioritization by real risk, and verified remediation. In an environment that changes every week — new plugins, new campaigns, new integrations — testing once a year leaves eleven months of exposure. Decripte structures the cadence appropriate to the pace of the operation, with retesting to confirm that the fix really closed the gap.

Compliance as armor: PCI-DSS and LGPD in retail practice

Compliance, in e-commerce, is not bureaucracy — it is the difference between a manageable incident and an existential crisis. PCI-DSS organizes the protection of card data into concrete requirements: segmentation and scope reduction, protection of data at rest and in transit, access control, monitoring and regular testing, and vulnerability management. Meeting PCI-DSS not only satisfies the acquirer's requirement: it forces the store to adopt the controls that, in practice, prevent skimming and leaks. And keeping card data outside the store's environment (via tokenization and fields hosted by the gateway) drastically reduces the standard's scope and the attack surface.

LGPD complements this, covering all the rest of the customer data. Compliance with LGPD requires a legal basis for processing, adequate technical and administrative security (art. 46), documented governance, the ability to serve data subjects' rights, and, crucially, readiness to detect, contain, and communicate incidents to the ANPD and the data subjects when there is relevant risk. Decripte connects the two worlds: the technical controls it implements at the edge, in the checkout, and in the application are exactly the evidence that supports compliance — and the incident response plan is what makes it possible to meet the legal deadlines under pressure.

Important: Decripte structures the security and the compliance readiness. Formal PCI-DSS certification is issued according to the process of the PCI Security Standards Council itself and its qualified assessors; what Decripte delivers is the security engineering that makes the operation approvable and resilient, plus technical support throughout the process. The same applies to LGPD: Decripte covers the information security dimension the law requires, in coordination with the company's legal and governance structure.

Anatomy of a Black Friday skimming (real de-identified example)

How Decripte responds to an e-commerce incident

Decripte's incident response follows a strong and repeatable method, with a containment SLA of up to 1 hour. In digital retail, where every minute offline or every hour of exfiltration is a direct loss, the speed and rigor of the response determine the size of the damage. The flow below describes how Decripte operates when the worst happens.

1. Detection and triage: the 24x7 SOC identifies the anomaly — a new exfiltration destination at checkout, a spike in fraudulent transactions, a surge of declined logins, or availability degradation — and classifies the severity in minutes, activating the Incident Response team.
2. Immediate containment (SLA up to 1h): isolation of the vector without taking down the operation — blocking the exfiltration domain and the malicious script at the edge, suspending the compromised component, mitigating the DDoS or rate-limiting the abuse, as the case may be.
3. Evidence preservation: forensic collection and custody of logs, script versions, checkout captures, and network artifacts, ensuring the chain of evidence needed to gauge the incident and support the regulatory response.
4. Root-cause eradication: identification of the origin (compromised plugin, vulnerable API, hijacked credential), complete removal of the malicious artifact, credential rotation, and remediation of the vulnerability that allowed the entry.
5. Secure recovery: restoration of the checkout and the operation with the component replaced and validated, reinforcement of CSP/SRI and edge rules, and continuous integrity monitoring to confirm that the environment is clean.
6. Scoping and regulatory support: technical assessment of the scope of exposed data and support to the store in the duties to notify the ANPD and the data subjects (LGPD) and in the interface with the acquirer and card brand (PCI-DSS), with a technical-forensic report.
7. Lessons learned and hardening: turning the incident into permanent improvements — third-party script governance, Pentesting cadence, standard checkout monitoring, and preparation for peak dates — to prevent recurrence.
8. Continuous follow-up: integration of the learning into the 24x7 SOC and vulnerability management, with periodic posture reviews and reinforced on-call coverage during the critical windows of the commercial calendar.

How Decripte structures e-commerce security

More than responding to incidents, Decripte structures the operation so that they are rare, detectable, and manageable. The defense of digital retail is built on pillars that cover the edge, the checkout, the application, monitoring, and compliance — in depth, so that the failure of one control is caught by another.

Recommended plans for E-commerce

Frequently asked questions

Sector terms

Web skimming / Magecart

An attack in which a malicious JavaScript is injected into the checkout page and copies the card data typed by the customer, sending it to an attacker's server. It runs in the customer's browser, without touching the store's database, which makes it hard to detect without checkout integrity monitoring. Magecart is the common name for the groups that carry out this type of attack.

Credential stuffing

Automated abuse in which bots test, en masse, combinations of email and password leaked on other sites to hijack customer accounts at the store — with their saved cards and loyalty points. It is countered with bot management, MFA, and monitoring of login surges.

Chargeback

A dispute of a charge by the cardholder. In e-commerce, it is the financial consequence of payment fraud: the store loses the merchandise and the amount, pays fees, and, with high dispute rates, may suffer penalties or termination by the acquirer.

PCI-DSS

Payment Card Industry Data Security Standard, a set of security requirements maintained by the PCI Security Standards Council for organizations that process, store, or transmit card data. It covers segmentation, data protection, access control, monitoring, and testing.

LGPD

General Data Protection Law (Law 13.709/2018), which governs the processing of personal data in Brazil. It requires a legal basis, adequate technical and administrative security, governance, and communication of relevant incidents to the ANPD (National Data Protection Authority) and to the affected data subjects.

Layer 7 DDoS

A denial-of-service attack that targets the application layer, simulating legitimate requests (searches, logins, cart additions) to exhaust back-end resources with relatively low volume. It is harder to distinguish from a real traffic peak than volumetric DDoS, requiring active SOC monitoring.