{"id":6125,"date":"2025-03-11T09:45:50","date_gmt":"2025-03-11T08:45:50","guid":{"rendered":"https:\/\/pcihispano.com\/?p=6125"},"modified":"2026-05-06T19:14:36","modified_gmt":"2026-05-06T17:14:36","slug":"nuevo-suplemento-informativo-seguridad-en-paginas-de-pago-y-prevencion-de-e-skimming","status":"publish","type":"post","link":"https:\/\/www.pcihispano.com\/en\/nuevo-suplemento-informativo-seguridad-en-paginas-de-pago-y-prevencion-de-e-skimming\/","title":{"rendered":"New information supplement: Security on payment pages and prevention of e-skimming"},"content":{"rendered":"

The PCI SSC has published a new information supplement (Information Supplement<\/em>) oriented to security on payment pages and prevention of e-skimming attacks as a guide for the implementation of PCI DSS v4.0 controls 6.4.3 and 11.6.1.<\/span><\/p>\n

In March 2025 the PCI SSC published<\/a> the Document Information Supplement: Payment Page Security and Preventing E-Skimming \u2013 Guidance for PCI DSS Requirements 6.4.3 and 11.6.1<\/em><\/a> It explains in more detail the controls for protection against e-skimming attacks. This document is the result of the work of the E-Commerce task forces (E-Commerce Guidance Task Force<\/em>) and small and medium-sized businesses (Small Merchant Business<\/em> Task Force<\/em>), with the support of other equipment such as the Global Executive Assessor Roundtable<\/em> (GEAR). The need to have this information supplement arose from the number of doubts generated after the inclusion of controls 6.4.3 and 11.6.1 in the version of PCI DSS v4.0, whose entry into force will be on April 1, 2025.<\/p>\n

Content and organization of this information supplement<\/h4>\n

As we had already advanced in PCI Hispano in the article \u00abImplementation of controls against e-skimming (PCI DSS req. 6.4.3 and 11.6.1)<\/a>\u2018, protection against attacks by e-skimming<\/em>\u00a0 can be implemented using different strategies, but it is very important that all elements required by requirements 6.4.3 and 11.6.1 are covered:<\/p>\n

6.4.3 All payment page scripts that are loaded and solved in the consumer\u2019s browser are managed as follows:<\/em>
\n\u2022 A method is implemented to confirm that each script is authorized.<\/em>
\n\u2022 A method is implemented to assure the integrity of each script.<\/em>
\n\u2022 An inventory of all scripts is maintained with written business or technical justification as to why each is necessary.<\/em>
\n<\/div><\/div>\n
11.6.1 A change- and tamper-detection mechanism is controlled as follows:<\/em>
\n\u2022 To alert personnel to compromised modification (including indicators of compromise, changes, additions, and deletions) to the security-impacting HTTP headers and the script contents of payment pages as received by the consumer browser.<\/em>
\n\u2022 The mechanism is designed to evaluate the HTTP headers and payment pages.<\/em>
\n\u2022 The mechanism functions are usually as follows:<\/em>
\n\u2013 At least weekly<\/em>
\nOR<\/em>
\n\u2013 Periodically (at the frequency defined in the entity\u2019s targeted risk analysis, which is defined according to all elements specified in Requirement 12.3.1).<\/em>
\n<\/div><\/div>\n

Terminology<\/strong><\/p>\n

One of the values provided by this new document is the clarification of concepts and terminology. Finally, the differences between a page that is not paid<\/strong> (any page that embeds a checkout page and your form fields), a payment page<\/strong> (a page that may contain one or more elements of a form intended to capture account data or to send that captured data for processing or authorization of the transaction) and a payment form<\/strong> (form with the fields used to capture the cardholder's account details).\u00a0 Likewise, what is a script<\/em> of a payment page<\/strong> (Javascript, VB Script or WASM components interpreted by the client's browser that can be used for advertising, product selection or security), clarifying that HTML or CSS components cannot be classified as such (as they are not programming languages).<\/p>\n

\"\"

Graphical description of a payment page and its components. Source: John Elliot \u2013 https:\/\/pcirocks.substack.com\/p\/what-exactly-is-a-payment-page<\/p><\/div>\n

\"\"

Using iframes on a checkout page. Note the similarity of this graph of the information supplement with that published by John Elliot<\/p><\/div>\n

Also, here are some examples of HTTP headers that can impact the security of a payment page and that must be configured\/monitored:<\/p>\n