TL;DR: Formjacking is when attackers inject malicious code into a legitimate website's checkout or form page to secretly capture the data entered — often credit card details. Use a credit card rather than a debit card for online shopping (better fraud protection), monitor your statements regularly, and consider a virtual card number for online purchases where available.
👉 Check my digital footprint — free 30-second check →
Formjacking is when attackers inject malicious code into a legitimate website's checkout or form page to secretly capture the data entered — often credit card details.
How Formjacking Works
Attackers compromise a website's code (often through a vulnerable third-party script) to intercept form submissions in real time, sending the data to themselves while the transaction still appears to go through normally.
Warning Signs to Watch For
This is nearly invisible to shoppers — the checkout process looks completely normal. The main warning sign is unexplained fraudulent charges appearing after shopping on a particular site.
How to Protect Yourself
Use a credit card rather than a debit card for online shopping (better fraud protection), monitor your statements regularly, and consider a virtual card number for online purchases where available.
If this looks similar to something else you've seen, it's worth reading What Is Ghost Broking? How It Works and How to Protect Yourself.
This pattern shows up elsewhere too — see What Is Grandparent Scams? How It Works and How to Protect Yourself.
Frequently Asked Questions
What is Formjacking?
Formjacking is when attackers inject malicious code into a legitimate website's checkout or form page to secretly capture the data entered — often credit card details.
How does Formjacking typically work?
Attackers compromise a website's code (often through a vulnerable third-party script) to intercept form submissions in real time, sending the data to themselves while the transaction still appears to go through normally.
What are the warning signs of Formjacking?
This is nearly invisible to shoppers — the checkout process looks completely normal. The main warning sign is unexplained fraudulent charges appearing after shopping on a particular site.
How can I protect myself from Formjacking?
Use a credit card rather than a debit card for online shopping (better fraud protection), monitor your statements regularly, and consider a virtual card number for online purchases where available.
What should I do if I think I’ve encountered Formjacking?
Stop responding immediately, do not click any links or share information, and report it to the appropriate authority. If money or personal information was already shared, act quickly to secure your accounts and report the incident.