December 2022 Summaries

Formjacking, also called web skimming or a Magecart attack, involves inserting malicious code into legitimate payment pages to silently capture customers’ sensitive information, particularly credit card details, while allowing transactions to proceed normally. Attackers commonly gain access through vulnerabilities such as cross-site scripting or remote code execution, compromised servers or development environments, or third-party supply chain breaches, as illustrated by the 2018 British Airways incident affecting about 380,000 customers. PCI DSS 4.0 introduces requirements intended to address these threats by requiring controls that protect payment-page integrity and detect unauthorized changes, with validation expected during annual assessments beginning in March 2024. Recommended defenses include using independently hosted payment iframes, monitoring code and network traffic for anomalous changes or data transfers, scanning systems and payment pages for vulnerabilities and malicious scripts, rapidly applying patches, and maintaining response processes. The discussion also presents specialized third-party payment service providers as a way for organizations to reduce compliance and security-management effort while using PCI Level 1 infrastructure and adapting to emerging threats.

PCI DSS 4, released in March 2022, updates the payment-card security standard with roughly 60 new requirements addressing evolving threats, including stronger authentication and password policies, malware protections, web application defenses, encryption, and account reviews. Organizations could assess against either PCI DSS 3.2.1 or version 4 until March 2024, after which PCI DSS 4 became the required standard for non-future-dated requirements, while certain future-dated controls, such as web application firewalls and removable-media malware scanning, had a March 2025 implementation deadline. Transition timelines vary according to an organization’s PCI level and transaction volume, whether it stores, processes, or transmits cardholder data directly, the complexity and age of its systems, available budget, use of prescribed versus customized controls, and reliance on payment service providers or tokenization vendors. Businesses that outsource card-data handling can reduce their compliance scope by relying on a provider’s certified environment, whereas companies with in-house cardholder-data systems may need more extensive technical changes, testing, documentation, and assessment work.

Pseudonymization is a reversible de-identification method that replaces personally identifiable information with aliases, masks, random values, hashes, or format-preserving substitutes while retaining a protected mapping that can restore an individual’s identity when necessary. Unlike anonymization, which aims to make re-identification impossible by eliminating both direct identifiers and potentially identifying combinations such as gender, birth date, and ZIP code, pseudonymization preserves data utility but requires strict protection of lookup tables and related access controls. Organizations use it to reduce hiring bias, secure sensitive systems, limit risks when sharing data with third parties, support GDPR compliance, and create realistic but non-identifiable testing data. In payment environments, it can protect card and bank details, enable safer processing, and support authorized analytics and fraud detection. Tokenization, which substitutes sensitive raw values such as Social Security numbers with newly generated tokens, is presented as a practical way to implement pseudonymization alongside controls for securely processing and sharing data.

The update introduces Android and iOS SDKs for collecting text data in mobile applications while allowing developers to format and transform it for interface or database needs without bringing apps into compliance scope. Web Elements for React and JavaScript now enable card issuers to reveal tokenized card data in front-end applications while remaining outside PCI scope, supporting more customizable digital card experiences. Proxy Transforms have also been added to let developers modify request and response payloads during HTTP interactions with third-party APIs that use encrypted or detokenized data. Additional improvements include better web-element line-height support, a fix for special-character handling, clearer documentation, case-insensitive container access rules, and clarified tenant member-deletion instructions.