E-commerce platforms process vast amounts of sensitive customer data. A single order involves login credentials, contact details, delivery addresses, payment information and purchase history, often shared with payment gateways, logistics partners and marketing platforms. Each of these touchpoints is an opportunity for attackers.
This article looks at the threats facing online retailers and marketplaces at each stage of the customer journey, the regulations that apply in the UAE, and comprehensive approaches to securing the journey from browsing to fulfillment.
Why e-commerce businesses are targeted
Direct access to money. Stolen card data, gift cards and loyalty points can be converted into cash quickly.
Large volumes of personal data. Customer databases are valuable for fraud and phishing.
Many third parties. Plugins, analytics tags, payment providers and marketplaces all touch customer data.
Constant change. Frequent releases and marketing campaigns introduce new code and new risks.
Fraud is rising. In the WEF Global Cybersecurity Outlook 2026, 73% of respondents said they or someone in their network had been affected by cyber-enabled fraud in the past year.
Threats across the customer journey
| Stage | Typical threats | Key defenses |
|---|---|---|
| Browsing | Scraping bots, fake stores imitating your brand, malicious ads | Bot management, brand monitoring, takedown processes |
| Account creation and login | Credential stuffing, account takeover, fake account creation | MFA or passkeys, bot detection, breached password checks |
| Basket and checkout | Card skimming scripts, payment fraud, promotion abuse | Hosted or tokenized payments, script control, fraud scoring |
| Payment | Card testing, stolen cards, interception | PCI DSS controls, 3-D Secure, tokenization |
| Fulfillment and delivery | Fake delivery messages, address change fraud, insider data theft | Customer warnings, change verification, least-privilege access for partners |
| Customer service and returns | Social engineering of support staff, refund fraud | Identity checks for account changes, refund controls, staff training |
Regulations that apply to e-commerce in the UAE
| Requirement | What it covers |
|---|---|
| PCI DSS v4.0.1 | Security of cardholder data. Requirements effective from 31 March 2025 include managing all scripts on payment pages (6.4.3) and detecting unauthorized changes to them (11.6.1). See our PCI DSS compliance services. |
| Federal Decree-Law No. 14 of 2023 on modern technology-based trade | The UAE e-commerce law, in force since September 2023, covering online trading, consumer protection and data security for platforms serving UAE customers |
| UAE Consumer Protection Law | Fair dealing, accurate information and complaint handling for consumers, including online purchases |
| UAE PDPL | Consent, data subject rights, security and breach notification for personal data |
| GDPR | Applies to UAE businesses that sell to or track customers in the EU |
Protecting customer data through the digital journey
1. Build security into the platform
Follow secure development practices and test against common web vulnerabilities such as those in the OWASP Top 10. Regular web application penetration testing and source code review catch flaws before attackers do, especially before major sales events.
2. Lock down payment pages
Use hosted payment pages or tokenized payment fields so card data never touches your servers. Keep an inventory of every script on payment pages, justify each one, and monitor for unauthorized changes, as PCI DSS 4.0.1 now requires. Card-skimming attacks typically inject a few lines of malicious JavaScript through a compromised plugin or third-party script.
3. Protect customer accounts
Offer MFA or passkeys, check passwords against known breach lists, and use bot management to stop credential stuffing. Require extra verification for sensitive changes such as email, phone number or delivery address updates.
4. Detect fraud in real time
Combine device fingerprinting, behavioral signals and transaction scoring to stop fraudulent orders without blocking genuine customers. Machine learning helps, as explained in our article on reducing false positives with machine learning.
5. Collect less and protect what you keep
Only collect the data you need, set retention periods, encrypt personal data at rest and in transit, and use data loss prevention to stop customer data leaving through unapproved channels.
6. Control third-party apps and tags
Review plugins, marketplace apps, analytics and advertising tags regularly. Each one can read customer data or inject code into your pages, so remove what you do not use and limit what the rest can access.
7. Secure APIs, cloud and integrations
Modern stores depend on APIs for payments, inventory, delivery and mobile apps. Apply strong authentication, authorization and monitoring to each one, and secure the cloud platforms behind them. See our article on cloud security posture management.
8. Prepare for incidents
Have an incident response plan that covers card data compromise, account takeover waves and data breaches, including notifying payment partners, regulators and customers.
9. Protect customers from impersonation
Fake delivery messages and lookalike websites target your customers directly. Set up email authentication, monitor for brand abuse and tell customers how you will and will not contact them. Strong email security also protects your own staff from phishing.
E-commerce security checklist
Use hosted or tokenized payments and keep card data off your servers.
Maintain an inventory of payment page scripts and monitor them for changes.
Enable MFA or passkeys and deploy bot protection on login and checkout.
Test the platform, APIs and mobile apps at least annually and before peak seasons.
Review third-party plugins, apps and tags every quarter.
Encrypt customer data and enforce retention periods.
Monitor for fraud, account takeover and brand impersonation.
Rehearse your incident response and customer notification process.
How Intello helps secure e-commerce businesses
Intello helps online retailers, marketplaces and direct-to-consumer brands across the UAE protect customer data and meet regulatory requirements. Our services include PCI DSS compliance, web, API and mobile app penetration testing, fraud and bot defense reviews and privacy compliance, built around the needs of e-commerce and D2C businesses. For digital payments more broadly, see our article on digital banking security.
Talk to our e-commerce security team or book a free security assessment.
Frequently asked questions
What are the biggest security threats to e-commerce sites?
The main threats are bots and credential stuffing, account takeover, card-skimming scripts on checkout pages, payment fraud, vulnerable plugins and third-party scripts, and phishing that impersonates the brand.
What changed for e-commerce in PCI DSS 4.0.1?
Requirements that took effect on 31 March 2025 include keeping an inventory of scripts on payment pages, confirming each is authorized (6.4.3), and detecting unauthorized changes to payment pages (11.6.1), to counter card-skimming attacks.
Which laws apply to e-commerce businesses in the UAE?
Online businesses in the UAE must comply with Federal Decree-Law No. 14 of 2023 on modern technology-based trade, the UAE Consumer Protection Law and the UAE PDPL, plus PCI DSS if they handle card payments and the GDPR if they sell to EU customers.
How can online stores prevent account takeover?
Offer MFA or passkeys, check passwords against breach lists, deploy bot protection on login pages and require extra verification before changes to email, phone number or delivery address.
What is a card-skimming attack?
A card-skimming or Magecart attack injects malicious JavaScript into a checkout page, usually through a compromised plugin or third-party script, to copy card details as customers type them.
How often should an e-commerce site be penetration tested?
At least once a year, after significant changes and before peak sales periods. APIs and mobile apps should be included alongside the website.