Systems and methods for utilizing a browser extension to encrypt online payment information
The disclosed computer-implemented method for utilizing a browser extension to encrypt online payment information may include (i) detecting, utilizing the browser extension, a payment form provided by an online merchant during a customer transaction session, (ii) determining a record in a payment service provider database that identifies the online merchant, (iii) receiving, by the one or more computing devices, payment information for completing the payment form, and (iv) performing a security action that protects against a potential malware attack by encrypting the payment information in the payment form for validation by a payment gateway provider and completing the customer transaction session. Various other methods, systems, and computer-readable media are also disclosed.
1 . A computer-implemented method for utilizing a browser extension to encrypt online payment information, at least a portion of the method being performed by one or more computing devices comprising at least one processor, the method comprising:
detecting, by the one or more computing devices and utilizing the browser extension, a payment form provided by an online merchant during a customer transaction session;
determining, by the one or more computing devices, a record in a payment service provider database that identifies the online merchant;
modifying, by the one or more computing devices, a document object model (DOM) in hypertext markup language (HTML) representing the payment form provided by the online merchant to disable entry of information into the payment form;
displaying, by the one or more computing devices utilizing the browser extension, a user interface to receive the payment information from the customer offline, outside of the payment form;
receiving, by the one or more computing devices, the payment information in the user interface;
encrypting, by the one or more computing devices, the payment information received in the user interface;
identifying, by the one or more computing devices, one or more hidden input fields within the HTML representing the payment form;
inserting, by the one or more computing devices and utilizing the browser extension, the encrypted payment information into the one or more hidden input fields of the payment form, thereby hiding the encrypted payment information; and
performing, by the one or more computing devices, a security action that protects against a potential malware attack by sending, to a payment gateway provider associated with the online merchant that supports the payment form, the encrypted payment information using the one or more hidden input fields.
2 . The computer-implemented method of claim 1 , wherein determining the record in the payment service provider database that identifies the online merchant comprises:
receiving an application programming interface (API) from the payment gateway provider to query the payment service provider database; and
querying, utilizing the API, the payment service provider database for merchant data comprising at least one of:
payment gateway data;
merchant domain data; or
electronic commerce implementation type.
3 . The computer-implemented method of claim 1 , wherein performing the security action that protects against the potential malware attack comprises:
receiving an API comprising data for encrypting the payment information from the payment gateway provider; and
encrypting the payment information utilizing the API.
4 . The computer-implemented method of claim 1 , wherein performing the security action that protects against the potential malware attack comprises:
detecting an error when encrypting the payment information in the payment form; and
identifying the payment form as a fraudulent form based on the error.
5 . The computer-implemented method of claim 1 , wherein performing the security action that protects against the potential malware attack comprises validating the payment form against an electronic commerce implementation type.
6 . The computer-implemented method of claim 5 , wherein the electronic commerce implementation type comprises an inline frame (iframe) implementation.
7 . The computer-implemented method of claim 5 , wherein the electronic commerce implementation type comprises a scripting language implementation.
8 . The computer-implemented method of claim 1 , wherein the potential malware attack comprises at least one of a web skimming attack and a formjacking attack.
9 . A system for utilizing a browser extension to encrypt online payment information, the system comprising:
at least one physical processor;
physical memory comprising computer-executable instructions and one or more modules that, when executed by the physical processor, cause the physical processor to:
detect, by a detection module and utilizing the browser extension, a payment form provided by an online merchant during a customer transaction session;
determine, by a determining module, a record in a payment service provider database that identifies the online merchant;
modify, by a payment module, a document object model (DOM) in hypertext markup language (HTML) representing the payment form provided by the online merchant to disable entry of information into the payment form;
display, by the payment module, a user interface to receive the payment information from the customer offline, outside of the payment form;
receive, by the payment module, the payment information in the user interface;
encrypt, by a security module, the payment information received in the user interface;
identify, by the payment module, one or more hidden input fields within the HTML representing the payment form;
inserting, by the security module, the encrypted payment information into the one or more hidden input fields of the payment form, thereby hiding the encrypted payment information; and
perform, by the security module, a security action that protects against a potential malware attack by sending, to a payment gateway provider associated with the online merchant that supports the payment form, the encrypted payment information using the one or more hidden input fields.
10 . The system of claim 9 , wherein the determining module determines the record in the payment service provider database that identifies the online merchant by:
receiving an application programming interface (API) from the payment gateway provider to query the payment service provider database; and
querying, utilizing the API, the payment service provider database for merchant data comprising at least one of:
payment gateway data;
merchant domain data; or
electronic commerce implementation type.
11 . The system of claim 9 , wherein the security module performs the security action that protects against the potential malware attack by:
receiving an API comprising data for encrypting the payment information from the payment gateway provider; and
encrypting the payment information utilizing the API.
12 . The system of claim 9 , wherein the security module performs the security action that protects against the potential malware attack by:
detecting an error when encrypting the payment information in the payment form; and
identifying the payment form as a fraudulent form based on the error.
13 . The system of claim 9 , wherein the security module performs the security action that protects against the potential malware attack by validating the payment form against an electronic commerce implementation type.
14 . The system of claim 13 , wherein the electronic commerce implementation type comprises an inline frame (iframe) implementation.
15 . The system of claim 13 , wherein the electronic commerce implementation type comprises a scripting language implementation.
16 . A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:
detect, utilizing a browser extension, a payment form provided by an online merchant during a customer transaction session;
determine a record in a payment service provider database that identifies the online merchant;
modify a document object model (DOM) in hypertext markup language (HTML) representing the payment form provided by the online merchant to disable entry of information into the payment form;
display a user interface to receive payment information from the customer offline, outside of the payment form;
receive the payment information in the user interface;
encrypt the payment information received in the user interface;
identify one or more hidden input fields within the HTML representing the payment form;
insert the encrypted payment information into the one or more hidden input fields of the payment form, thereby hiding the encrypted payment information; and
perform a security action that protects against a potential malware attack by sending, to a payment gateway provider associated with the online merchant that supports the payment form, the encrypted payment information using the one or more hidden input fields.
17 . The non-transitory computer-readable medium of claim 16 , wherein the one or more computer-executable instructions cause the computing device to determine the record in the payment service provider database that identifies the online merchant by:
receiving an application programming interface (API) from the payment gateway provider to query the payment service provider database; and
querying, utilizing the API, the payment service provider database for merchant data comprising at least one of:
payment gateway data;
merchant domain data; or
electronic commerce implementation type.
18 . The non-transitory computer-readable medium of claim 16 , wherein the one or more computer-executable instructions cause the computing device to perform the security action that protects against the potential malware attack by:
receiving an API comprising data for encrypting the payment information from the payment gateway provider; and
encrypting the payment information utilizing the API.
19 . The non-transitory computer-readable medium of claim 16 , wherein the one or more computer-executable instructions cause the computing device to perform the security action that protects against the potential malware attack by:
detecting an error when encrypting the payment information in the payment form; and
identifying the payment form as a fraudulent form based on the error.
20 . The non-transitory computer-readable medium of claim 16 , wherein the one or more computer-executable instructions cause the computing device to perform the security action that protects against the potential malware attack by validating the payment form against an electronic commerce implementation type.