You check out on a real online store, the address is correct, the page looks normal, and your order goes through. Yet your card details were copied as you typed them, skimmed by hidden code injected into the checkout. That is formjacking — digital card skimming on legitimate websites — and it can happen without a single sign you would notice. Our GetMyPassword team explains what it is and how to reduce the risk.
What formjacking is
Formjacking is the digital version of a card skimmer. Attackers compromise a website — often through a vulnerable plugin or a third-party script the site loads — and inject malicious code into its payment or login form. When you submit the form, the code quietly copies your card number, expiry, security code, and personal details and sends them to the attacker, while your purchase still completes normally. Because the site itself is genuine and the transaction succeeds, there is usually nothing visibly wrong, which is what makes formjacking so hard to spot.
Why it is hard to detect
- The site is real and the address is correct — no fake domain to catch.
- Your order goes through as expected, so nothing seems off.
- The malicious code is invisible, hidden in scripts behind the page.
- Even careful shoppers can be caught, because there is no obvious red flag.
- The theft surfaces later, as unfamiliar charges on your statement.
How to reduce your exposure
Since you cannot inspect a site’s code, the best defenses limit what a skimmer can steal and how easily it can be used. Pay with methods that shield your real card: a virtual or single-use card number, or a digital wallet that does not expose your card details to the merchant’s form. Keep your browser and security tools updated, and consider a reputable script or ad blocker. Above all, watch your statements closely and turn on transaction alerts, so a stolen card is caught fast. Strong, unique passwords from our password generator plus two-factor authentication keep a captured login from compounding the damage.
Formjacking hides on real sites where your usual checks all pass. You cannot see the code, so make the data worth less: virtual cards, transaction alerts, and statements you actually read.
What to do if your card is skimmed
If you spot a charge you do not recognize, contact your card issuer immediately to dispute it and have the card replaced. Review recent statements for other unfamiliar transactions, and update the password on any account tied to that card if you reused it elsewhere. Reporting quickly limits your liability and helps shut the fraud down. A virtual card you can switch off makes this even simpler, cutting the thief’s access with a single tap.
Frequently asked questions
What is formjacking?
Formjacking is digital card skimming, where attackers inject malicious code into a legitimate website’s payment or login form. When you submit it, the code copies your card and personal details while your purchase still completes normally.
How can I tell if a site has been formjacked?
Usually you cannot, because the site is genuine and your order goes through normally. The theft typically surfaces later as unfamiliar charges, which is why watching your statements and using transaction alerts is essential.
How do I protect myself from formjacking?
Pay with a virtual or single-use card or a digital wallet, keep your browser updated, consider a reputable script blocker, watch your statements with transaction alerts, and use unique passwords with two-factor authentication to limit any further damage.