Retail people tend to think about theft in physical terms: stock walking out of the door, a till that doesn't balance. Online theft is different, because you can have your best sales week of the year while it's happening.
Let me show you what I mean, then we'll talk about what cyber security for retail actually needs to look like in the UAE. It's a shorter list than most vendors would have you believe.
The shop that kept selling
Picture a growing UAE fashion retailer with a few stores and an online shop. Ramadan is approaching, so the marketing team adds a new tracking tag and a chat widget to the website. Sales are good. Then, some weeks later, customers start calling. Their cards are being used abroad. The bank eventually works out that the common link is your website.
Nothing looked broken. The checkout worked. The payment provider approved every order. Somewhere along the way, a small piece of code on the payment page began copying card details and sending them elsewhere. That is card skimming, often called Magecart, and it's the online version of a skimmer fitted to a card machine.
This story is a scenario, but the technique is very real. Recorded Future's research on the first half of 2026 describes attackers loading skimming code through Google Tag Manager and hiding it inside hidden SVG elements on Magento and Adobe Commerce sites. They use trusted services precisely because the traffic blends in with normal activity.
What actually threatens UAE retailers?
| Threat | What it looks like | What it costs you |
|---|---|---|
| Card skimming (Magecart) | Hidden code on checkout pages copies card details | Card brand and bank investigations, plus lost customer trust |
| Account takeover | Stolen passwords used to log in to customer accounts and spend loyalty points | Refunds, complaints and support time |
| Point-of-sale attacks | Malware on till systems or tampering with card terminals | Card data exposure across stores |
| Email fraud | A fake supplier email changes the bank details on a real invoice | Direct payment loss, often hard to recover |
| Ransomware | Stock, orders and tills stop working | Lost sales at the worst possible moment |
Notice that last one. Attackers know your calendar. A system outage during White Friday or Dubai Shopping Festival hurts far more than one in a quiet week, and the pressure to pay is at its highest.
PCI DSS in plain language
If you take cards, PCI DSS applies to you, whatever your size. Many retailers assume their payment provider "handles PCI". The provider handles part of it. Your website, your staff and your systems are still your responsibility.
Three things are worth knowing about the current version, 4.0.1:
Payment page scripts (requirement 6.4.3). You need an inventory of scripts on your payment pages, and a reason for each one. That chat widget needs to justify itself.
Tamper detection (requirement 11.6.1). You need a way to detect unauthorised changes to payment pages. This is aimed squarely at skimming.
Penetration testing (requirement 11.4). Internal and external tests at least every 12 months, and after significant changes.
Both of the first two became mandatory in March 2025, and I still find retailers who haven't heard of them. Check your obligations against the standard, or ask someone who does this work. Our PCI DSS team can help.
Marketing and security need to talk
Here's something that rarely appears in a security guide. On many retail websites, the marketing team adds more code than the developers do. Tag managers, pixels, chat tools, review widgets and A/B testing tools all run with access to the page.
I'm not saying stop using them. I'm saying someone should know what's on your checkout page. A simple rule goes a long way: keep tag managers and third-party widgets off payment pages unless there's a clear reason. It's free, and it removes a large part of the risk.
What should a UAE retailer do first?
Look at your checkout page. List every script on it. Remove anything without a clear reason.
Turn on multi-factor authentication for your e-commerce admin, email and payment dashboards.
Commission a penetration test of your website and customer accounts, ideally well before peak season.
Check your terminals. Train store staff to inspect card machines for tampering.
Agree a rule for bank detail changes. Always call the supplier back on a known number.
Protect customer data under the UAE PDPL, which applies to the personal data you hold.
Plan for an outage. Decide how stores keep trading if systems go down during a sale.
Is this worth it for a smaller retailer?
IBM's 2026 research puts the average Middle East data breach at about USD 8 million. You may not face that figure, but for a smaller retailer, the larger danger is simpler: customers who stop trusting your checkout page don't usually come back to tell you why.
You don't need a large security team. You need a short list, an owner, and a test every year. If you'd like help working out what applies to you, see how we support retail businesses, or read about e-commerce security in more depth.
Talk to our team or book a free security assessment.
Frequently asked questions
What is card skimming on a website?
It's when hidden code on a checkout page copies card details as customers type them and sends them to attackers. The shop keeps working normally, so it often goes unnoticed until banks or customers report fraud.
Does PCI DSS apply to small retailers in the UAE?
Yes. PCI DSS applies to any business that stores, processes or transmits card data, whatever its size. Your payment provider covers part of it, but your website, staff and systems remain your responsibility.
What did PCI DSS 4.0.1 change for online shops?
It added specific controls for payment pages: an inventory and justification of scripts (requirement 6.4.3) and a mechanism to detect unauthorised changes (requirement 11.6.1). Both became mandatory in March 2025.
How often should a retailer run a penetration test?
PCI DSS requires internal and external testing at least every 12 months and after significant changes. It makes sense to test well before peak trading periods.
What is the first thing a retailer should do?
List every script on your checkout page and remove anything without a clear reason, then turn on multi-factor authentication for your e-commerce admin, email and payment dashboards.