E-commerce Security Monitoring for UK Online Stores: Skimmers, Data Theft, and Staying Ahead

The E-commerce Threat Landscape

E-commerce stores are the most directly monetisable targets on the web. Every checkout page is a collection point for card details. Every customer account holds an address, payment method, and order history. Every admin panel controls a revenue stream.

The attacks targeting UK online stores are not sophisticated in the way that nation-state infrastructure attacks are sophisticated. They are methodical, automated, and effective precisely because they target the gaps that busy store owners do not have time to watch.

Three categories account for the majority of successful e-commerce attacks:

**JavaScript skimmers (Magecart-style attacks)** — Malicious code injected into checkout pages that silently captures card details as the customer types them. The customer completes their purchase normally. The store owner has no idea. Card details are transmitted to an attacker-controlled server in the background.

**Credential stuffing against customer accounts** — Automated tools try millions of username/password combinations sourced from previous breaches across other sites. Customers who reuse passwords are vulnerable. An attacker who accesses a customer account finds stored payment methods, order history, and a delivery address — everything needed to make fraudulent orders for physical goods, or to sell the account access.

**Admin panel compromise** — The store's admin interface, accessed through a brute force attack, a phishing attack against a staff member, or a credential leak from a previous breach. Admin access allows order manipulation, refund fraud, data export, and in some cases the ability to inject code into the store's theme — which is how many JavaScript skimmers are installed in the first place.

JavaScript Skimmers: The Silent Threat

The Magecart attack group, first identified in 2016, pioneered the technique of injecting JavaScript into e-commerce checkout pages to steal card data. Since then, the technique has been copied and automated extensively. Skimmer code is now sold as a service on criminal marketplaces.

The attack works in three ways:

**Direct compromise of the store's own code** — An attacker who gains write access to the store's JavaScript files — through an admin panel compromise, a vulnerable plugin, or a compromised hosting account — can inject skimmer code directly into the checkout flow.

**Compromise of a third-party script** — Skimmer code is injected into a widely-used third-party script. Every store loading that script is then affected. The 2018 British Airways breach — which resulted in a £20 million ICO fine — was caused by a skimmer in a third-party script loaded on the BA payment page.

**Supply chain attack via a plugin or theme** — A popular WooCommerce plugin or Shopify app is compromised. Every store using that plugin loads the skimmer code. The store owner, who has no visibility into the plugin's code after installation, has no idea.

How skimmers avoid detection

Modern skimmer code is obfuscated — it does not look like card-stealing code if you read it casually. It often loads conditionally, only activating on pages that contain a card input field. Some variants only activate on specific domains, to make sandbox analysis harder.

Skimmers can persist for months without detection because the store owner's card processing appears to work normally. The evidence — a spike in card fraud complaints from customers — typically does not reach the store owner until card issuers begin raising chargebacks.

What detection actually looks like

Detecting a skimmer requires inventorying every script loading on your checkout page and verifying:

1. Every script URL matches an intentionally-loaded resource 2. Every script hash matches the expected content (Subresource Integrity) 3. No new network requests are initiated during card entry that should not be there 4. The Content Security Policy, if present, would block an injected script from phoning home

A Yrzo AI scan performs a script inventory on every page load as part of the checkout security assessment. The weekly monitoring plan repeats this inventory on every scan — so a skimmer injected after a deploy or a plugin update is detected at the next weekly scan rather than months later.

Credential Stuffing Against Customer Accounts

Credential stuffing is a volume game. Attackers use lists of email/password pairs from previous breaches at other sites and test them against your store's login page. On a site with no rate limiting, a single attacker can test hundreds of thousands of combinations in hours.

The success rate seems low — maybe 0.5% to 2% of tested credentials are valid. But against a store with 50,000 customer accounts, that means 250 to 1,000 accounts compromised. Each account may have a saved payment method or a store credit balance that can be spent immediately.

Mitigations include rate limiting on login endpoints, CAPTCHA after a small number of failed attempts, and monitoring for the behavioural signature of stuffing attacks — a sudden spike in login attempts from a geographically dispersed IP range, all failing, followed by a smaller number of successful logins.

A Yrzo AI scan specifically tests your login page for rate limiting, account lockout behaviour, and CAPTCHA bypass — the gaps that make credential stuffing viable.

What Continuous Monitoring Adds for E-commerce

For an e-commerce store, a one-off pentest is a starting point, not a programme. The risk profile changes with every:

- Plugin or app update - Theme update - New third-party script added by a marketing tool or live chat widget - Staff member with admin access - Platform version upgrade

Weekly automated scanning catches:

**New script loads** — Any new JavaScript file appearing on checkout pages since the last scan is flagged. This catches both intentional additions (a new analytics tool that needs a security review) and unintentional ones (a skimmer injected into a compromised plugin).

**Security header regression** — Content Security Policy, HSTS, X-Frame-Options, and other headers that were configured correctly can disappear after a platform update. Weekly scanning catches this before an attacker notices.

**SSL certificate changes** — Certificate expiry, unexpected reissuance, or a cipher suite downgrade are flagged immediately.

**Checkout flow changes** — Changes to the checkout page structure — new form fields, new scripts, new network destinations — are detected and flagged for review.

The Yrzo AI monitoring plan runs weekly on your store for £99/month. For stores doing significant monthly revenue, the cost of a single missed skimmer — chargebacks, ICO investigation, customer notification, reputational damage — far exceeds the annual monitoring cost.

[Start with a free scan](/free) to see your current exposure, or go straight to [continuous monitoring for £99/month](/checkout/monitoring).

Related reading: [E-commerce Checkout Security UK](/blog/ecommerce-checkout-security-uk) · [What Is XSS Attack?](/blog/what-is-xss-attack-website) · [What Is a Supply Chain Attack?](/blog/what-is-supply-chain-attack-website)