Every checkout is a target.
Retailers take card data across stores, websites, apps and contact centers. We shrink scope, protect payment pages and keep peak season safe.
What is at stake.
- 01
Payment-page integrity
Client-side skimming captures card data inside the shopper’s browser.
- 02
Omnichannel scope
Stores, web, apps and call centers each carry different obligations.
- 03
Peak resilience
Outages during peak trading have an outsized commercial impact.
Where the exposure actually sits.
- R1
Magecart-style skimming
Compromised third-party scripts on checkout pages.
- R2
Account takeover
Credential stuffing against accounts and stored-value balances.
- R3
Store network exposure
Flat networks joining POS, Wi-Fi and IoT.
- R4
Third-party sprawl
Providers with access to payment data or systems.
The rules that shape the work.
The instruments that set the bar in this sector, and what each one demands.
PCI DSS v4.0.1
Global (card brands)6.4.3 (script authorization) and 11.6.1 (tamper detection) have applied in full since 31 March 2025.
PCI P2PE
Global (card brands)Validated solutions can significantly reduce in-store scope when implemented as listed.
PSD2 strong customer authentication
EU / UKSCA and exemption management for online card payments.
GDPR and US state privacy laws
EU / US statesConsent, profiling and loyalty data across marketing platforms.
How we respond.
Each engagement is scoped to your regulator, your deadline and the evidence your assessor will ask for.
A multi-brand retailer with more than forty scripts on checkout.
Marketing, analytics and testing tools had piled onto payment pages with no owner and no inventory. We built a justified script inventory, added Content Security Policy and integrity controls, and set up tamper detection that alerts the right team.
Questions clients ask us.
If we use our provider’s iframe, are we out of scope?
It reduces scope considerably, but the hosting page can still be targeted. Eligibility for SAQ A depends on how the integration is built.
Is P2PE always worth it?
Listed solutions reduce in-store scope substantially but constrain your choice of terminal and processor. We weigh the trade-offs against your estate.
Do marketplaces change our PCI obligations?
They can. It depends on who captures, processes and stores card data, and your responsibility matrix should state it explicitly.
Talk to a practitioner who knows your sector.
Tell us what you are preparing for. A senior practitioner who has done this work will reply within one business day.