This session has passed.

Your payment provider is secure. Is your payment page?

Handing card payments to Stripe or another provider cuts your PCI scope, but it doesn't protect the checkout page around it. Integrity360 and Reflectiz show how web skimming works now, and what PCI DSS v4.0.1 expects you to do about it.

23 September 2026

11:00 – 12:00 BST · 1 hour

Online · Registration closed

WebinarCybersecurityGovernance, Risk & ComplianceFree

Coming up instead

Cybersecurity
Police Guidance: Public Resources for SMB Security and Compliance
26 November 202610:00 GMT
INDIGO IT
Cybersecurity
Cyber Risk, Fraud & Regulation: Building Resilient Retail Banks in an Era of Escalating Threats
19 November 202615:00 GMT
Softcat
Cybersecurity
Incident Response: Rehearsing the First Hour
18 November 202614:00 GMT
Secarma

About this session

A lot of businesses assume that once payments are hosted by a provider, card security is someone else's problem. Martin Petrov (CTO – PCI, Integrity360) and Leor Eliashiv (UK&I Country Manager, Reflectiz) explain why that isn't true.

They use recent Magecart campaigns that abused trusted services like Stripe's APIs and Google Tag Manager to skim card details in the customer's browser, without the payment provider ever being breached. The session walks through a checkout attack from start to finish, and explains why server-side controls and traditional scanning often miss what's actually running in the browser.

It finishes with where responsibility sits for hosted and embedded payment forms, and what the newer PCI DSS script-integrity requirements and SAQ A guidance ask of merchants. Reflectiz sells browser-side monitoring, so expect their platform to come up