The Payment Page That Passed Your Last Audit Isn’t the One Running Now
Beyond PCI DSS compliance: what an expert panel had to say about the accountability gap no framework alone can close, and why passing your assessment doesn’t mean your checkout page is safe.
Watch the full experts panel discussion here.
A successful PCI audit doesn’t mean your checkout is safe. A company can pass its assessment and still find that customer card data is being skimmed off the checkout page by a third-party script that changed after the review.
This isn’t a problem with the version 4 update fixed. In January 2026, researchers at Silent Push documented a skimming campaign that had been running since early 2022, meaning it was active before and after the March 31, 2025 deadline, when the new payment-page requirements became mandatory.
It was harvesting card data across six major networks, including Mastercard, American Express, and Discover. Its cleverest trick: the malicious script checks for a logged-in WordPress administrator and self-destructs if it sees one, so anyone auditing the page sees nothing wrong.
According to Recorded Future, the number of e-commerce sites hit by skimmers roughly tripled in 2024, to around 11,000. So there is a real chance you could pass your assessment and still be bleeding card data right now.
This gap was the subject of a recent Reflectiz panel, Beyond PCI DSS Compliance: Who Owns Payment Risk in 2026, a lineup built to argue with itself. Úna Dillon, Regional Director for Europe at the PCI Security Standards Council, represented the body that writes the requirements. Deepak Kumar, CISO of APEXX Global, brought the payments-industry view. Mark Barry, Senior Security Operations Manager at Domino’s Pizza UK and Ireland, and Pete Chenery, Global Head of Cyber Security at Naked Wines, brought the daily reality of defending high-traffic checkout pages. Host Leor Eliashiv, Reflectiz’s UK and Ireland country manager, kept the pressure on a single question: when compliance and security stop being the same thing, who is actually holding the risk?
Compliance is a snapshot. Your checkout is a film.
That is the reality merchants face, because attackers have shifted their focus. For years, the instinct was to fortify the server. But modern payment pages pull in dozens of external scripts: analytics, A/B tests, marketing pixels, tag managers. Each one is a doorway into the browser itself, where attackers intercept card data before encryption ever becomes relevant. PCI DSS 4.0.1 responded with two requirements: 6.4.3 (keep an inventory of every script on your payment pages) and 11.6.1 (monitor those scripts for unauthorized change on an ongoing basis).
But even the body that writes the standard was candid about its limits:
"PCI DSS was never intended to be viewed as the ceiling for security. It's a strong baseline."
You can complete an assessment and still carry blind spots: unmanaged scripts, unauthorized browser changes, weak monitoring. You can be compliant today and not compliant tomorrow, Dillon noted, because of the speed at which these scripts are attacked. Deepak Kumar made the stakes concrete:
"If a script is changed today, millions of transactions can happen before it's identified as malicious. By then, the damage is done."
A point-in-time assessment cannot see that. Continuous visibility can.
Dillon also named the misconception underneath all of this: the assumption that if the payment provider is secure, the payment page itself is secure. Attackers increasingly target the layer around the transaction rather than the processor itself.
"The modern payment page is effectively part of the security perimeter now, and it should be governed accordingly."
Click here to watch the full experts panel discussion >>
The number that reframes the threat
One of the most arresting moments came from Reflectiz’s own research across 4,700 websites, which found that 64% of third-party applications had access to sensitive data they did not need, up from 51% the year before. These were not sophisticated attacks, just over-permissioned scripts sitting on data they had no business touching, and nobody noticed. The headline fear is the exotic skimmer. The everyday exposure is the legitimate script with too much reach.
And that reach is not only a security problem. A script quietly collecting more than it needs is a data-protection problem too, and regulators have begun treating a stated claim of compliance as a promise they will hold you to, not a box you once ticked.
So, who owns the risk?
This is the accountability gap the panel set out to name: the space between where formal compliance ends and where real accountability must begin. In most companies, marketing owns the pixels, digital owns the experience, and security owns the risk. So when a script drives revenue and creates exposure, who gets the final say?
The panelists admitted the answer can be messy, and offered some of their sharpest practical thinking on closing the gap. The simplest move came from Mark Barry at Domino’s, who treats third-party script access exactly like a user access review:
"This script's got access to this data. Do you still need that access, and can you justify why you need to have it?"
Scripts that cannot answer get scoped down or removed, on a monthly or quarterly cycle rather than once a year. On who holds the authority to actually stop a risky script, Deepak Kumar pointed to the standard itself:
"The standard has a requirement, 12.1.4, of executive management-level authority to stop the risk when it exceeds your appetite."
The panel also dug into why treating the assessment as a finish line is a regulatory risk in its own right.
For Mark, the stakes were never really about the audit. Asked how the gap between compliance and day-to-day reality looks on the ground, he reframed it around customer confidence and reputational risk:
"If people lose confidence in what we're doing, then there are other pizza brands available."
The point applies to any business.
And then there’s AI
The panel also split on how much AI changes the picture. Pete Chenery of Naked Wines was blunt about the uncertainty:
"I don't think we know yet, and we may not even know in another five years."
The optimistic read is that AI sharpens defenders’ tools. The worry is that it lowers the bar for entry, so attackers no longer need deep skill:
"People are tinkering and probing a lot more, and that's down to the fact that they can use an AI platform and generate something off the bat."
Nobody disputed the pace, with Chenery expecting more change over the next twelve months than in the last several years combined. Where the panel landed on how defenders should respond is one of the threads worth hearing in full.
Watch the full conversation
The panel goes further than any summary can on the AI threat, vendor accountability, and what security and compliance leaders should be doing now to close the gap.
Watch Beyond PCI DSS Compliance: Who Owns Payment Risk in 2026 on demand →
And if you want to see what is actually executing on your own payment pages right now, you can start a free Reflectiz trial.
FAQs
Does passing a PCI DSS assessment mean my checkout page is secure?
No. A PCI DSS assessment is a point-in-time snapshot, while a live checkout page changes constantly as third-party scripts are added, updated, or compromised. A company can pass its assessment and still have card data skimmed off the page by a script that was altered after the review. As more than one panelist on Reflectiz’s Beyond PCI DSS Compliance panel put it, you can be compliant today and not compliant tomorrow.
How can companies manage third-party script risk on payment pages?
A practical approach raised on the panel by Mark Barry of Domino’s is to treat third-party script access exactly like a user access review. For each script you ask three questions: what data can this script see, do you still need that access, and can you justify it. Scripts that cannot justify their reach are removed or scoped down, and the review is repeated regularly rather than once a year.
How do skimming scripts avoid detection during an audit?
Modern skimmers are built to hide from the people most likely to find them. In a campaign documented by Silent Push in January 2026 and active since early 2022, the malicious script checked the page for a logged-in WordPress administrator and triggered a self-destruct routine when it detected one. Anyone auditing the page sees a clean checkout, while ordinary shoppers continue to be skimmed.
How is AI changing payment page security threats?
AI cuts both ways. It sharpens the tools available to defenders, but it also lowers the barrier to entry for attackers, since standing up a convincing skimmer no longer requires deep technical skill. The likely result is more probing attempts more often, and panelists agreed the next twelve months may bring more change than the last several years combined.
What is a web skimming or Magecart attack?
A web skimming attack, often called Magecart, is when an attacker injects malicious JavaScript into a checkout page to steal payment card data as the shopper enters it. Because the code runs inside the browser, it captures card numbers before they are encrypted and sent to the payment processor. These attacks frequently enter through a compromised third-party script rather than through the merchant’s own server.
What is PCI DSS requirement 11.6.1?
Requirement 11.6.1 of PCI DSS 4.0.1 requires merchants to deploy a change- and tamper-detection mechanism that monitors the payment page on an ongoing basis. It alerts security teams when payment page content or HTTP headers are modified without authorization. Together with 6.4.3, it moves payment page security away from a one-time check and toward continuous monitoring.
What is PCI DSS requirement 6.4.3?
Requirement 6.4.3 of PCI DSS 4.0.1 requires merchants to manage every script that loads on a payment page. Each script must be authorized, its integrity must be assured, and the full set of scripts must be kept in an inventory with a written justification for why each one is present. The goal is to eliminate unknown or unmanaged scripts running in the payment environment.
What is the difference between PCI DSS compliance and payment page security?
Compliance is proof that you met a defined set of requirements at a specific moment, while security is the ongoing state of your live payment page. The two overlap but are not the same, because you can be fully compliant on assessment day and still be exposed the next day if a script changes. PCI DSS 4.0.1 narrows the gap with its continuous monitoring requirements, but the standard was never intended to be the ceiling for payment page security.
What is unjustified access by third-party scripts?
Unjustified access is when a third-party script or application can reach sensitive data it does not need to do its job. Reflectiz research across 4,700 websites found that 64% of third-party applications had access to sensitive data without business justification, up from 51% the year before. Common examples include a chatbot that can read payment fields, or a marketing pixel using full DOM access to scrape an entire page rather than the limited elements it actually requires.
When did the new PCI DSS payment-page requirements become mandatory?
The payment-page script requirements, 6.4.3 and 11.6.1, became mandatory on March 31, 2025. Before that date they were treated as best practice under PCI DSS 4.0. Skimming campaigns documented by researchers were active both before and after this deadline, which underlines that meeting the requirement on assessment day does not guarantee ongoing protection.
Who owns payment page risk inside an organization?
Payment page risk usually has no single clear owner, which the Reflectiz panel called the accountability gap. In most companies marketing owns the pixels, digital owns the experience, and security owns the risk, so when a revenue-driving script also creates exposure, no one team has the final say. Closing the gap means assigning explicit accountability rather than treating a passed assessment as the finish line.
Why isn’t point-in-time PCI compliance enough to stop skimming?
A point-in-time assessment can only confirm what the payment page looked like on the day it was reviewed. Payment pages change continuously, and a script can be tampered with at any moment after the assessment, allowing millions of transactions to flow through before anyone notices. According to Recorded Future, the number of e-commerce sites hit by skimmers roughly tripled in 2024 to around 11,000, which shows how fast the risk moves. Continuous visibility into what actually executes on the page is what closes that gap.
Subscribe to our newsletter
Stay updated with the latest news, articles, and insights from Reflectiz.
Your Website looks great!
But what’s happening behind the scenes?
Discover your website blind spots and vulnerabilities before it’s too late!
