Cybersecurity for retail and e-commerce

Retailers handle card payments and customer data at high volume every day. Criminals follow the money to the checkout page, the store terminal and the loyalty wallet. A breach costs you directly through fraud and chargebacks, and again when customers stop trusting your site.

The cost of getting it wrong

Stolen card data brings penalties and extra obligations from the card schemes and your acquiring bank. In serious cases it can lead to restrictions on accepting cards. Loyalty points and store credit are real money to customers, and when they are stolen the retailer usually pays them back. A major incident during a sales campaign can take the site offline at the most expensive moment of the year.

The Personal Data Protection Law (UU PDP) makes you accountable for the customer data you collect. That includes data held for you by marketing, payment and delivery partners.

How attacks on retailers work

Skimming scripts are the best known. Attackers plant a few lines of code in the checkout page, often through a third-party script such as analytics or live chat, and copy every card number typed in. This is known as a Magecart attack.

Logic abuse needs no advanced hacking. Coupons that can be stacked, refunds that can be issued twice and prices that can be changed in the request all come from an application that trusts the customer too much.

Account takeover starts with passwords leaked from other sites. Criminals try them against your login page, then spend saved cards and loyalty points.

API flaws affect mobile apps and marketplace integrations. If the server does not check that an order or account belongs to the person asking, anyone can read or change it.

Store systems are the last piece. POS terminals and mobile card readers must be kept apart from the rest of the store network, as PCI DSS requires.

What Snipeyes does

We test your storefront, mobile apps and APIs and review code where it helps. That includes the business logic that automated scanners miss. Findings are mapped to OWASP ASVS and PCI DSS, the card industry’s security standard. Your QSA (the assessor who certifies PCI DSS compliance) and your payment partners get the evidence they ask for. We deliver the report within 10 days and retest before your next big promotion.

Testing follows your trading calendar and avoids peak sales periods, so storefronts and stores stay open. All work is under NDA.

As an add-on, we monitor for leaked cards, stolen customer accounts and lookalike domains used for phishing and fake stores.

Background

Snipeyes is CREST-accredited and ISO/IEC 27001:2022 certified. Our testers use OWASP ASVS and the OWASP API Security Top 10. We work with retail chains, marketplaces, direct-to-consumer brands, FMCG companies and consumer electronics sellers.