Find card skimmers before your customers' banks do
We load your store in a real browser, decode every script it runs and tell you if any of them is stealing card details. Detection is tested against newly found skimmers continuously.
- Magento
- WooCommerce
- Shopify
- Custom checkouts
Every finding names the script
A vague "malware detected" leaves you guessing. ScanTower tells you which script is responsible, what it does in plain language, and which other script put it there, so you know exactly what to remove.
- Inline, external and runtime-injected code, all checked
- Plain-language summary of what the script does
- The file, hash and loading script, so you can find it
Card skimming
CriticalScript built at runtime on yourstore.com
- Collects checkout form data and sends it to another site.
- Loads further code only on checkout pages, where it is least likely to be looked for.
- Hides itself in several layers, the way multi-stage skimmer loaders do.
- Kind
- Runtime-built script
- SHA-256
- 9c4e1f7b…d2a07b
- Size
- 3.2 KB
- Created by
- https://cdn.example.net/js/tracking.min.js
Why blocklists miss modern skimmers
Checking scripts against lists of known-bad files and domains only catches a skimmer after someone else has reported it. Skimmer kits move to new domains and new disguises within days. We look for what a skimmer has to do, which does not change when it moves.
| Case | Blocklist checks | ScanTower |
|---|---|---|
| Skimmer on a domain already reported as malicious | Caught | Caught |
| Skimmer on a domain registered yesterday | Missed | Caught |
| Known kit, renamed and moved to a new file | Missed | Caught |
| Payload hidden behind layers of encoding | Missed | Caught |
| Code injected at runtime by another script | Missed | Caught |
Detection that keeps up
A skimmer detector that is not updated falls behind quietly. Ours is tested against new skimmers continuously, and checked against real stores so legitimate checkouts are not flagged.
- 01
Hunt
Newly reported skimmers and their loaders are collected from threat-intelligence sources as they appear.
- 02
Test
Each one is run through the same detection the scanner uses. Anything not rated critical is studied and detection is improved.
- 03
Check for false alarms
Every change is tested against real websites and online stores. If it flags one legitimate site as critical, it does not ship.
- 04
Review
Hunting and testing are AI-assisted so they never stop. A person reviews every change before it reaches the scanner.
Card skimming questions
What is a card skimmer?
A card skimmer (also called Magecart or formjacking) is JavaScript injected into an online store that copies card details as shoppers type them and sends them to the attacker. The store keeps working normally, so owners usually find out from their payment provider or their customers.
How do I check my website for a card skimmer?
Enter your store URL above. We load the site in a real browser, collect every script it runs (including ones injected at runtime), decode obfuscated code and check it for skimmer behaviour, then tell you which script raised a finding and why.
Can a skimmer hide from a scanner?
Many try: they hide behind layers of encoding, load from brand-new domains, or wait until a shopper reaches the checkout. That is why we look for what a skimmer has to do rather than for known file names, and why our detection is tested against newly found skimmers continuously.
Does this work on Magento, WooCommerce and Shopify?
Yes. The scan works on any platform because it looks at what runs in the browser, not at your server. Magento and WooCommerce stores are the most common targets, and custom checkout pages on any platform are at risk.
Is the card skimming scanner free?
Yes, a one-off scan is free with no registration. A free account also rescans one site every week and emails you when a scan finds something, so a skimmer injected after today is not left running for months.
A scan shows today. Monitoring catches next week.
Skimmers usually arrive through a compromised plugin, admin login or third-party script, long after you last looked. A free account rescans your store every week and emails you when a scan finds something.
- Weekly automated scans
- Email alerts on new findings
- No credit card
More e-commerce security tools
Website Malware Scanner
Detect malicious, injected and obfuscated JavaScript on any site.
Subresource Integrity Checker
Find third-party scripts that could be swapped without you noticing.
CSP Checker
Check whether your CSP would stop an injected script.
Magento Version Checker
Detect a store’s Magento version and known vulnerabilities.
Is My Site Compromised?
Full-spectrum check for malware, skimmers and signs of intrusion.