The Scripts on Your Checkout Page Are Now a PCI DSS Problem

Summary: PCI DSS v4.0.1 now fully enforces requirements 6.4.3 and 11.6.1, which require merchants to inventory and authorize every payment-page script, prove its integrity, and detect tampering with page content and HTTP headers as the browser receives them. Sansec has counted more than 100,000 sites hit by web skimming and supply-chain attacks, and the 2018 British Airways breach exposed 380,000 transactions with a fine that started at £183 million.
What you should know: Reflectiz data shows roughly 30% of payment-page scripts change within any two-week window, and since January 2025 merchants can drop 6.4.3 and 11.6.1 from SAQ A only if they confirm their site is not susceptible to script attacks - which an embedded payment iframe does not automatically satisfy.

Read the original at The Hacker News ↗