Cyber Crime Centre warns of digital skimming

Digital skimming attacks are rising with significant risks to e-commerce businesses and their customers

In the run-up to the festive season, many organisations across Northern Ireland will be preparing for a seasonal increase in online sales to customers based both at home and abroad. As part of this preparation, the Police Service of Northern Ireland's Cyber Crime Centre would encourage all online retailers to consider the risks posed by digital skimming.

What is digital skimming?

Digital skimming is the action of stealing credit card information or payment card data from customers of an online store. The transaction data is intercepted during the online purchase checkout process, without customers noticing anything unusual.

Whether through vulnerabilities, configuration errors or brute force, as experienced recently by a number of organisations in Northern Ireland, criminals can gain access to online stores with the aim of using malware to capture customer data.

Affected customers are often unaware that their card was copied (skimmed) and such attacks can go undetected for a long time. They pose significant risks to the business, not least reputational damage with customers questioning the safety of the service.

How can you protect against digital skimming?

Don't make it easy for cyber criminals to exploit your systems. You can:

• use malware monitors with web skimming capabilities
• set strong password policies and training for staff
• carry out regular vulnerability audits of your e-commerce website
• limit access to your store's control panel
• regularly patch and update your security software

If you experience an attack, the PSNI recommends the following steps:

• in case of malware infection, change all admin and database passwords immediately
• use a malware scanner to find any backdoors the attackers may have installed
• collect all available evidence and report the attack to Action Fraud
• in case of a personal data breach, comply with the applicable data protection legislation

For more information, read the Europol's advisory on digital skimming.

First published 17 November 2023