Web Skimming and the Payment Integration Risk Every SMB Owner Needs to Ask About in 2025

Web skimming — also called formjacking — became one of the most quietly damaging attack patterns hitting small and mid-sized businesses in 2025. The mechanism is simple and, for most business owners, completely invisible: attackers compromise a third-party JavaScript file that your website or point-of-sale system loads automatically. That compromised code silently copies payment card data and sends it to an attacker-controlled server — while your checkout page looks and functions perfectly. Several widely-used small business payment processing and point-of-sale integrations were confirmed to have carried this type of compromised code in 2025, in some cases for months before anyone noticed. This post is meant to help you ask the questions your vendors have never volunteered to answer.

1. What Actually Happened in These 2025 Cases
2. Why SMBs Are Disproportionately Exposed to Web Skimming
3. The Supply Chain Nobody Talks About
4. What a Well-Run IT Environment Has in Place
5. The Questions You Should Be Asking Your Vendors Right Now
6. What This Means for Your Business

What Actually Happened in These 2025 Cases

The pattern across the 2025 web skimming disclosures was consistent. A small business — a retailer, a professional services firm, a nonprofit taking online donations — was using an off-the-shelf payment integration from a recognized vendor. That vendor, or a vendor that vendor relied on, had a JavaScript library compromised somewhere upstream. The tampered script was distributed automatically to every business that loaded it — as part of a routine software update or content delivery network pull.

The business owner saw nothing. The checkout page worked. Customers completed their purchases. Revenue came in. In the background, a copy of every payment card entered on that page was being forwarded to a server in another country.

Detection typically came not from the business itself but from a card network fraud alert, a security researcher scanning for known skimming signatures, or a bank noticing an unusual cluster of compromised cards all sharing the same merchant. By that point, weeks or months of transaction data had already moved.

The Cybersecurity and Infrastructure Security Agency (CISA) has published guidance on securing web-based applications and specifically flags client-side script integrity as a persistent gap in small business environments. The guidance exists. The awareness, for most small business owners, does not.

Why SMBs Are Disproportionately Exposed to Web Skimming

Large enterprises have dedicated application security teams whose entire job is to monitor what code runs in their web environments. They run Subresource Integrity checks. They enforce Content Security Policies. They have formal processes to review and approve third-party script changes before anything goes live. None of this is exotic — it is standard practice at organizations that have invested in it.

Small businesses do not have those teams. They have a website built by a developer three years ago, a payment integration set up using the vendor’s default instructions, and a script tag that loads whatever the payment vendor’s content delivery network serves — automatically, on every page load, with no human review in between.

That gap is exactly what web skimming attackers are looking for. It is not a vulnerability specific to your business. It is a structural gap in how off-the-shelf integrations work, compounded by the fact that most small business owners have never been told to think about it.

The businesses most exposed to web skimming share a few common traits:

• They rely on a single web developer or small agency that built the site and moved on
• They accepted the payment vendor’s default integration without asking about script integrity controls
• They have no ongoing monitoring of what JavaScript their site actually loads at runtime
• They have never reviewed their vendor’s security posture or sub-processor relationships
• They assumed that using a name-brand payment processor meant security was handled for them

The Supply Chain Nobody Talks About

When business owners hear “supply chain risk,” they usually think of physical goods — a parts shortage, a shipping delay, a supplier going under. The digital supply chain is different, and in many ways more dangerous, because it is invisible.

Your website or point-of-sale system likely loads code from multiple external sources: a payment processor, an analytics platform, a chat widget, a cookie consent manager, a marketing tag. Each is a separate vendor. Each of those vendors may rely on additional sub-vendors or shared infrastructure. You agreed to the terms of service of the primary vendor. You almost certainly have no visibility into what their sub-vendors do or how their infrastructure is secured.

A web skimming script does not need to break anything to be dangerous. It just needs to add a few lines of code that copy form field values — card numbers, expiration dates, security codes — and send them somewhere. The page still works. The payment still processes. You get your revenue. The attacker gets a copy of every card.

This is why formjacking is sometimes called a “silent exfiltration” attack. No ransomware notice. No encrypted files. No visible disruption. The only signal is often a pattern of card fraud noticed weeks later by a bank or card network — and by then, the liability conversation has already started.

NIST’s guidance on cybersecurity risk management explicitly includes third-party and supply chain risk as a core component of any sound security program. For most small businesses, this dimension has never been applied to their web environment at all.

What a Well-Run IT Environment Has in Place

A well-run environment does not rely on hope that third-party vendors are doing the right thing. It has controls in place that create visibility and accountability regardless of what any single vendor does.

For web environments where payment data is involved, those controls typically include:

• A Content Security Policy that explicitly lists which external scripts are allowed to load — anything not on the list is blocked by the browser before it runs
• Subresource Integrity checks that verify the cryptographic fingerprint of any external script before the browser executes it — if the file has changed in any way, the browser refuses to run it
• Runtime application monitoring that alerts when new external connections are established from a web page — a direct indicator of web skimming activity
• Periodic third-party script audits to confirm what is actually loading in production versus what was approved at deployment
• A vendor security review process that asks payment and point-of-sale vendors directly about their sub-processor relationships and their own script integrity controls

None of these controls are exotic or reserved for large enterprises. They do require someone to configure them and someone to monitor them — and that is precisely where the gap lives for most small businesses. A well-run IT relationship closes that gap through ongoing security oversight, not a one-time setup.

At Xact IT, our clients have never experienced a breach in over 20 years of operation. That record does not happen by accident. It happens because the controls exist, they are monitored, and the environment is treated as a living system that requires ongoing attention — not a setup job someone did once and walked away from.

The Questions You Should Be Asking Your Vendors Right Now

You do not need to be a developer to ask the right questions. You need to be the person who treats vendor security as a business requirement, not a technical afterthought. Here are the questions that matter when it comes to web skimming risk:

• Does your payment integration load any JavaScript from third-party content delivery networks that you do not control directly?
• What sub-processors or third-party libraries does your integration depend on, and how do you monitor them for unauthorized changes?
• Do you have Subresource Integrity or equivalent controls in place to verify that scripts served to our customers have not been tampered with?
• What is your process for detecting a web skimming compromise in your JavaScript delivery infrastructure?
• What notification timeline do you have if you discover a compromise that may have exposed our customers’ payment data?

A vendor that cannot answer these questions clearly is not necessarily malicious. They may simply not have thought about it. But your customers’ card data is on the line, and “we haven’t thought about it” is not an acceptable answer when you are the merchant of record.

The liability in a payment data breach does not primarily land on your payment processor. It lands on you. Your customers come to you. Your bank comes to you. Your card network relationship is at risk. The fact that a compromised third-party script was the technical cause is not a defense that protects your business from the consequences.

What This Means for Your Business

The 2025 web skimming disclosures are a signal, not isolated incidents. Attackers have learned that targeting infrastructure used by thousands of small businesses — payment integrations, point-of-sale plugins, analytics scripts — is far more efficient than targeting individual businesses one at a time. Compromise one widely-used library and you have access to the transaction data of every business that loads it.

This is the nature of modern supply chain risk, and it is why “is our website secure?” no longer covers enough ground. The right question is: “Do we have visibility into every piece of code that runs in our environment, who controls it, and how we would know if it changed?” Web skimming thrives in the absence of that visibility.

Most small business owners have never been asked that question by their IT vendor, their web developer, or their payment processor. That gap is not a coincidence — it reflects how the industry has traditionally served the small business market.

A well-structured managed IT relationship treats this kind of oversight as a baseline expectation, not an add-on. The businesses that weather the next wave of web skimming and supply chain attacks are the ones that have already closed these gaps — not the ones scrambling after a card network calls them with a fraud pattern alert.

The question worth sitting with is not whether this could happen to your business. Given how widely off-the-shelf payment integrations are used — and the documented pattern of 2025 web skimming attacks — the exposure is structural for any business that has not actively addressed it. The question is whether the controls and visibility are in place to catch it before your customers do.

If you are not sure where your environment stands, Book a Free Cybersecurity Strategy Call. It is a 20-minute conversation with our team — no pressure, no obligation — and you will leave knowing exactly what questions to take back to your vendors.