Stricter guidelines. Smarter security

Imagine your house has a safe where you store your most valuable possessions. Now, picture leaving one door to your house open. Even though the safe is locked, your valuables remain at risk because that open door compromises your home's overall security. This illustrates the importance of securing not just your payment form (the safe) but also the entire parent page that hosts it.

This is where e-skimming attacks come into play. Even if your card capture form is secure, a vulnerability on your website can allow attackers to intercept sensitive data before it reaches your secure payment form.

The Evolution of Payment Security: From Securing the Room to Securing the Entire House

In the past, merchants relied on iframes to collect card data, which isolated the secure payment form from the rest of the website. As long as the payment form (or "the room with the safe") was secure, vulnerabilities elsewhere on the site were less of a concern. But with the rise of sophisticated attacks like e-skimming — where malicious code is injected into the website, not the payment form — this approach is no longer sufficient.

To combat these modern threats, the Payment Card Industry (PCI) Security Standards Council introduced PCI DSS v4.0, which enforces stricter security measures for the entire website (more specifically the “parent page” hosting the card capture widget), not just the card capture widget. With these new standards, protecting your entire site is mandatory to prevent attacks like e-skimming and ensure secure payment processing.

What is PCI DSS v4.0?

PCI DSS 4.0 is designed to enhance the security of cardholder data by adopting a comprehensive approach to security measures and access controls. Merchants must now secure every part of the payment flow, ensuring not only the payment form but also the hosting web environment is protected. The deadline for full compliance with PCI DSS v4.0 is March 2025, when the future-dated requirements become mandatory.

What’s New in PCI DSS v4.0?

The Future-Dated Requirements:

• Requirement 6.4.3: Merchants must maintain a list of all scripts running on payment pages, with processes to detect and address unauthorized changes. This combats e-skimming by ensuring no rogue scripts sneak into the payment page.
• Requirement 11.6.1: Regular testing for unauthorized scripts on these pages is mandatory to prevent digital theft of sensitive payment data.

The Bottom Line: Protect the Entire House

PCI DSS v4.0 marks a shift from securing just the “safe” (payment form) to securing the entire house (your website). With new threats like e-skimming, every entry point must be fortified. The standard emphasizes a holistic approach—because if one window or door is left unsecured, everything is at risk.

The clock is ticking. March 2025 is closer than you think. Now’s the time to lock every door, window, and digital lock.

Coming Soon: Stay tuned for our next blog, where we'll explore merchant vs. Peach Payments’ responsibilities under PCI DSS v4.0 compliance.

To learn more about how we protect merchants today, check out our Security at Scale page