CyberSource

Overview

CyberSource, a Visa subsidiary, is one of the world's largest payment management platforms, processing transactions for businesses of every size across virtually every payment method and geography. When CyberSource's scripts appear on merchant websites, they serve two critical functions: rendering secure payment forms that keep card data off the merchant's servers, and running device fingerprinting for fraud detection.

The dual nature of CyberSource's scripts — essential payment processing combined with sophisticated fraud screening — makes it a foundational component of enterprise e-commerce infrastructure.

What This Script Does

CyberSource's scripts handle payment processing and fraud prevention on checkout pages:

• Hosted payment form components: Renders card input fields (card number, expiry, CVV) within PCI-compliant iframes, ensuring sensitive payment data is captured directly by CyberSource's servers and never touches the merchant's infrastructure
• Card tokenization: Converts entered payment credentials into secure tokens that merchants can use for processing without handling raw card data
• Device fingerprinting: Collects browser characteristics, device attributes, and behavioral signals — including screen resolution, installed plugins, timezone, language settings, and mouse/keyboard interaction patterns — to build a device profile for fraud risk assessment
• 3D Secure authentication: Manages Strong Customer Authentication flows (3DS2) required by PSD2 for European transactions, presenting bank verification screens within the checkout experience
• Transaction risk scoring: Feeds collected device and behavioral data into CyberSource's Decision Manager fraud screening engine, which returns risk scores and recommended actions
• Session management: Sets cookies to maintain payment session state and link fraud screening data to the active transaction

Consent & Compliance

CyberSource operates within a well-defined compliance framework:

• GDPR: Payment processing falls under "performance of a contract" (Article 6(1)(b)). Fraud prevention has additional lawful bases including legitimate interest and legal obligation. CyberSource/Visa acts as both a data processor and, for fraud prevention, a data controller.
• ePrivacy Directive: Payment session cookies and fraud detection mechanisms are strictly necessary for the service the customer requested (completing a purchase) and for preventing fraud, exempting them from consent requirements.
• PCI DSS: CyberSource is PCI DSS Level 1 certified. The hosted payment fields are specifically engineered to keep merchants out of PCI scope.
• PSD2/SCA: CyberSource handles Strong Customer Authentication requirements and manages transaction risk analysis for exemption processing.

Should You Block This Without Consent?

CyberSource's scripts are essential payment infrastructure. The hosted payment forms process transactions that customers explicitly initiated, and the fraud screening protects both the merchant and the customer from fraudulent activity. Both functions fall under the strictly necessary exemption — blocking these scripts would prevent customers from completing purchases and remove fraud protection from the checkout process.

No.