Top 10 Ecommerce Security Threats: What Hits Online Stores and How to Stop It

Online stores are attacked where the money and the data meet: the checkout page, the customer login, the admin panel and the people and suppliers who can change them. This list ranks the ten threats that most often cost ecommerce businesses card data, stock, revenue or trading days, with how each one works, what to monitor and how to fix it. The ranking is an editorial judgement based on PCI DSS v4.0.1, OWASP guidance, the CISA Known Exploited Vulnerabilities catalog and incidents in the NHI Mgmt Group breach database. It is written for ecommerce engineering leads, fraud and payments teams and the executives who own online trading. For the full sector picture, read Cybersecurity for Retail and Ecommerce Guide; for a store-by-store worksheet, use the Ecommerce Store Security Checklist.

Key takeaways

• The payment page is the top target. PCI DSS v4.0.1 Requirements 6.4.3 and 11.6.1, mandatory since 31 March 2025, exist because skimming code added to checkout pages steals card data in the shopper's browser.
• Platform patching is a race. CISA lists several Adobe Commerce and Magento flaws as known exploited, including CVE-2024-34102, CVE-2025-54236 and two added in September 2026.
• Bots attack business logic, not code. Credential stuffing, card testing and scalping use the store exactly as designed, at machine speed, which OWASP describes as unrestricted access to sensitive business flows.
• People and suppliers are part of the attack surface. Help desk impersonation and third-party access caused the most damaging retail incidents of 2025.
• Fraud and security need one view. Account takeover, refund abuse and gift card theft cross the line between the fraud team and the security team, and fall through it when they do not share data.

The Top 10 at a glance

1. Payment page skimming

Skimming code injected into checkout JavaScript, directly or through a compromised third-party script, copies card details as the shopper types and sends them to an attacker's server. The shop's servers may never see anything unusual because the theft happens in the browser. PCI DSS v4.0.1 Requirement 6.4.3 requires that all payment page scripts loaded and executed in the consumer's browser are authorised, have their integrity assured and are listed in an inventory with a written justification. Requirement 11.6.1 requires a change and tamper detection mechanism that alerts on unauthorised changes to security-impacting HTTP headers and script contents of payment pages as received by the browser, at least weekly or at a frequency set by a targeted risk analysis. Both were best practice until 31 March 2025 and are now required. See the PCI DSS for E-commerce Payment Page Scripts Guide and the Client-Side Security Guide.

• Detect: new or changed scripts on checkout pages, new outbound destinations in Content Security Policy reports, and unexplained hash changes to first-party bundles.
• Fix: keep a script inventory with owners, mirror third-party scripts in-house or use subresource integrity, set a strict Content Security Policy on payment pages, and consider hosted payment fields or redirects that remove card entry from your pages. OWASP's Third Party JavaScript Management Cheat Sheet lists in-house mirroring, subresource integrity and secure transmission as the typical defences.

2. Exploited platform, plugin and extension flaws

Commerce platforms and their extensions are scanned for new flaws within hours of disclosure. The CISA Known Exploited Vulnerabilities catalog includes, among others, CVE-2022-24086 (Adobe Commerce and Magento Open Source improper input validation, added February 2022), CVE-2024-34102 (XML external entity reference, added July 2024), CVE-2025-54236 (improper input validation, added October 2025) and CVE-2026-75650 and CVE-2026-71362 (added September 2026). A single unpatched extension can give an attacker the access needed to plant a skimmer (threat 1) or steal the customer database. See the Vulnerability Management Guide.

• Detect: subscribe to vendor security bulletins and the KEV feed, alert on new admin users or modified core files, and run external vulnerability scans as PCI DSS 11.3.2 requires.
• Fix: keep an inventory of every extension and theme with version and owner, remove unused ones, patch KEV-listed flaws as emergencies, and run a web application firewall in front of public-facing applications as PCI DSS 6.4.2 requires.

3. Credential stuffing and customer account takeover

Attackers replay username and password pairs leaked from other sites against your login and account recovery endpoints (ATT&CK T1110.004 Credential Stuffing). Successful logins are used for saved cards, stored balances, loyalty points and personal data. OWASP's Credential Stuffing Prevention Cheat Sheet calls multi-factor authentication by far the best defence, notes that passkeys now make it practical for most consumer audiences, and recommends layered alternatives where MFA is not enforced: risk-based step-up, CAPTCHA only on suspicious logins, IP reputation including hosting and proxy ranges, device and connection fingerprinting, and breached-password checks. See the Password Spraying and Credential Stuffing Defence Guide and the Account Takeover Prevention Guide.

• Detect: login failure rate by IP, ASN and device fingerprint; many accounts tried from one source; successful logins followed within minutes by address, email or payment changes.
• Fix: offer passkeys, require step-up for changes to email, password, address and payment methods, notify customers of new device logins, and track each defence's detected and mitigated volume as OWASP suggests.

4. Card testing and carding

Fraudsters use checkout or donation forms to check which stolen card numbers are live, usually through many small authorisations from rotating IPs. Each attempt costs authorisation fees, and high decline rates can attract scrutiny from the acquirer. Validated cards are then used for larger purchases elsewhere or on your own store. See the Card Testing and Carding Attacks Defence Guide.

• Detect: spikes in declined authorisations, many cards from one device or session, many sessions sharing a BIN range, and low-value orders on guest checkout.
• Fix: velocity limits per device, IP, email and card, CAPTCHA or proof of work when decline rates rise, 3-D Secure for risky transactions, and closer monitoring of any public form that triggers an authorisation.

5. Scalping and abuse of sensitive business flows

OWASP's API Security Top 10 2023 lists API6:2023 Unrestricted Access to Sensitive Business Flows, with buying all the stock of a high-demand item for resale as its first example. The attack uses legitimate endpoints in the intended order, just faster and from many addresses, so traditional input validation does not help. Promotion abuse, fake account creation and reservation hoarding work the same way. See the Bot Management Guide and the OWASP API6 Guide.

• Detect: add-to-basket and checkout rates per account and device at launch time, accounts created in bursts with similar attributes, and checkouts with no browsing history.
• Fix: identify which flows are sensitive, apply per-flow limits (one per customer for limited items), use device fingerprinting and behaviour signals, and consider queues or draws for high-demand launches.

6. Admin and staff account compromise

A stolen store admin password gives an attacker the ability to edit checkout templates, add payment scripts, export customers and create new admins. PCI DSS v4.0.1 Requirement 8.4.2 requires MFA for all non-console access into the cardholder data environment, and Requirement 8.3.4 requires locking a user ID after no more than 10 invalid attempts for at least 30 minutes or until identity is confirmed. Shared admin logins and agency accounts that never expire are common in smaller stores.

• Detect: admin logins from new countries or devices, new admin users, changes to checkout templates or payment settings, and API key creation.
• Fix: individual named admin accounts with phishing-resistant MFA, admin panel restricted by IP or behind an identity-aware proxy, least-privilege roles for agencies and contractors, and time-limited access for external developers. See the Retail and E-Commerce Identity Security Guide.

7. Help desk and third-party social engineering

The most damaging retail incidents of 2025 did not start with code. The Marks and Spencer cyberattack began with impersonation of a third-party user and cost the retailer around 300 million pounds, and the Co-op cyber attack used help desk social engineering to reach member data. Attackers call the service desk posing as an employee or supplier, get a password or MFA reset, then move through the network. See the Vishing and Help Desk Social Engineering Awareness Guide.

• Detect: MFA method resets followed by sign-ins from new devices, resets for privileged or supplier accounts, and unusual volumes of reset requests.
• Fix: require strong identity verification for resets (video with ID, manager approval or in-person for privileged users), separate procedures for supplier accounts, and least-privilege, monitored access for outsourced staff.

8. Third-party apps, tags and integration keys

Marketing tags, analytics, reviews widgets, payment and shipping integrations all run with some access to customer data or the storefront. OWASP's cheat sheet warns that tag manager containers can run custom JavaScript and HTML, so whoever can publish in the tag manager can change the page, and recommends restricting publishing access and reviewing changes as application code. Integration API keys stored in apps and pipelines are machine credentials with real access to orders and customers. See the Third-Party Risk Management Guide and the Secrets Management Guide.

• Detect: new tags published in the tag manager, new installed apps and granted scopes, and API key use from unfamiliar IPs.
• Fix: keep tags off payment pages, use a host-defined data layer that limits what tags can read, review app permissions at install and quarterly, and scope, vault and rotate integration keys.

9. Refund, returns, loyalty and gift card fraud

Stored value is cash to a fraudster. Compromised accounts are drained of loyalty points and gift card balances, gift card numbers are guessed or enumerated, and refund policies are abused with empty-box claims or refunds to different payment methods. These losses often sit with the fraud or customer service team and are invisible to security monitoring. See the Refund and Returns Fraud Guide and the Loyalty Points and Gift Card Fraud Guide.

• Detect: balance checks at high rates, points redeemed soon after a new device login, and refunds clustered on accounts, addresses or devices.
• Fix: rate-limit balance checks, require step-up before redemption or transfer, link fraud signals across accounts, and refund only to the original payment method.

10. Ransomware and disruption of the order pipeline

For an ecommerce business, every hour without checkout, warehouse management or order routing is lost revenue. Ransomware and sabotage of the systems behind the store can stop online trading even when the storefront itself is untouched. Recovery depends on knowing which systems the order flow needs and having clean, tested backups of them, including identity systems. See the Ransomware Prevention Guide.

• Detect: disabled security tools, mass encryption alerts, new domain admin accounts, and unusual backup deletion.
• Fix: segment store and corporate networks from the payment and order environment, keep immutable backups, rehearse restoring order systems, and keep a documented manual fallback for orders and fulfilment.

Detection: what to monitor across the list

Measures that show it is working: days to patch KEV-listed platform flaws; percentage of payment page scripts with an owner and integrity control; account takeover rate per 10,000 logins; card testing attempts blocked versus authorised; percentage of admin and supplier accounts on phishing-resistant MFA; and tested time to restore the order pipeline.

Common failure patterns

• Assuming the payment provider covers the page: an embedded or redirected payment flow reduces scope, but scripts on the page that loads or redirects to it can still be tampered with.
• Extension sprawl: abandoned plugins from agencies stay installed and unpatched long after the campaign that needed them.
• CAPTCHA as the whole bot strategy: OWASP notes CAPTCHAs can be solved by tools and services, so they need to be one layer among several.
• Fraud and security in separate rooms: account takeover shows up first as fraud losses, and the security team never sees the login pattern.
• Service desk resets on a phone call: a convincing caller with public information gets an MFA reset for a privileged account.
• No manual fallback: when order systems go down, there is no way to keep trading safely while recovery runs.

Lessons from incidents

The Marks and Spencer cyberattack shows threats 7 and 10 together: impersonation of a third-party user led to a disruption that stopped online orders and cost hundreds of millions of pounds. The Co-op cyber attack shows help desk social engineering exposing member records. Both reward investment in identity verification and recovery over another perimeter tool.

Mapping to PCI DSS, OWASP and ATT&CK

Where to start

1. Week 1: inventory every script on payment pages with an owner and justification, and turn on tamper detection; test alerts by changing a script in staging.
2. Week 2: list every platform extension and theme, remove unused ones and check each against the CISA KEV catalog and vendor bulletins.
3. Week 3: enforce MFA on every admin, agency and supplier account and restrict the admin panel by network or proxy.
4. Month 2: pilot passkeys and risk-based step-up for customers, with bot and velocity rules on login, checkout and gift card endpoints; roll back by switching rules to log-only.
5. Month 3: tighten service desk reset verification and rehearse restoring the order pipeline with a manual fallback.

Practitioner checklist

• Payment page script inventory with owners, justification and integrity controls (PCI DSS 6.4.3).
• Tamper detection on payment page scripts and headers, at least weekly (PCI DSS 11.6.1).
• KEV-listed platform and extension flaws patched as emergencies.
• WAF in front of public-facing applications (PCI DSS 6.4.2).
• Named admin accounts with phishing-resistant MFA and restricted access paths.
• Passkeys or MFA offered to customers, with step-up for account changes.
• Velocity limits on login, checkout, card authorisation and gift card balance checks.
• Tag manager publishing restricted and tags kept off payment pages.
• Service desk reset procedure with strong identity verification.
• Tested recovery of order systems and a manual fallback.

Standards and references

• PCI Security Standards Council: PCI DSS v4.0.1
• CISA: Known Exploited Vulnerabilities Catalog
• OWASP: Third Party JavaScript Management Cheat Sheet
• OWASP: Credential Stuffing Prevention Cheat Sheet
• OWASP: API6:2023 Unrestricted Access to Sensitive Business Flows
• MITRE ATT&CK: T1110.004 Credential Stuffing
• MITRE ATT&CK: T1190 Exploit Public-Facing Application

Related NHI Mgmt Group resources: Cybersecurity for Retail and Ecommerce Guide, Ecommerce Store Security Checklist, PCI DSS 4.0 Guide, Ecommerce Fraud and Chargeback Protection.