A focused checklist for merchants who accept card payments but don’t process card data at large scale.
The checklist
- Use a PCI-compliant, hosted payment processor rather than handling raw card numbers directly
- Complete the appropriate Self-Assessment Questionnaire (SAQ) for your specific setup, confirmed with your payment processor
- Never store card verification codes (CVV) after transaction authorization
- Keep all systems (even those only indirectly touching payment flows) on a routine patch cadence
- Enforce MFA for any account with access to payment processor dashboards or reporting
- Use HTTPS site-wide, particularly on any page in the checkout flow
- Review third-party scripts/plugins on checkout pages — a compromised third-party script is a common indirect path to card-skimming attacks (e.g. Magecart-style attacks)
FAQ
What is a Magecart-style attack?
A class of attack where malicious code is injected into a checkout page (often via a compromised third-party script) to silently capture card details as customers type them, without ever touching the actual payment processor.