Cart Injection
Adding unwanted items to a user's shopping cart without their explicit consent.
What Is Cart Injection?
Cart Injection takes Sneak into Basket a step further by injecting items right at the final payment confirmation step. This often involves high-margin attachments like 'Shipping Insurance' or 'Extended Warranties'.
Users who are operating on autopilot during familiar checkout flows frequently miss the injected item and end up paying more than they intended.
Real-World Examples
Review Your Order
How It Works — The Psychology
This pattern exploits several cognitive biases:
- Status Quo Bias — Users assume the cart contains only what they put there.
Severity Assessment
CRITICAL — Direct financial theft. Illegal in many jurisdictions including the EU.
Detection Checklist
Remediation
- Never add items to a cart automatically. Offer add-ons as optional opt-in choices.
Psychological Mechanisms
A basket is read as a record of one's own decisions, and records are verified rather than examined: the eye confirms that the things it remembers choosing are present, and has no routine for noticing an entry it never made. The final confirmation step compounds this, because by then checkout has become a motor sequence, with gaze settling on the total and the button beside it rather than the itemisation above. Two features make the addition stick. It is plausible in context — cover on a shipment, protection on an appliance, is the kind of thing one might have agreed to, so even when seen it is often assumed to be one's own doing. And the sum is small enough to sit under the threshold at which anyone reopens a settled decision, or afterwards pursues a refund.
Regulatory Landscape
Unlike patterns that merely shape a choice, this one bills for something never chosen, which puts it under rules about payment rather than presentation. Consumer contract law in the EU — the Consumer Rights Directive — addresses additional charges arising from default options and requires express consent to them, with reimbursement as the natural remedy; the FTC Act and negative-option rules cover the equivalent conduct in the United States, where charging without authorisation is the gravamen rather than any deficiency in the wording. Payment-scheme rules and chargeback frameworks give a parallel route, since the sum authorised is meant to be the sum agreed. A wrinkle specific to this pattern: the injected line is often an insurance or warranty product, and those are separately regulated as products, so adding one silently can breach the rules on how such cover may be sold.
Detection and Measurement
What makes it evasive is where it sits and how inconsistently it appears. Injection is placed at the step shoppers have learned to pass through quickly, and the line is genuinely disclosed within the itemisation, so a screenshot appears to show a fair summary. It frequently occurs on only some paths — one delivery option, the narrow layout, a session without an account — so a single walkthrough clears the flow. And it can be introduced after the review page rather than on it, meaning the total a reviewer reads and the total charged are not necessarily the same number. The item's own remove link is not evidence of consent.
Ethical Design Alternatives
The rule that removes this pattern is short: nothing enters a basket except by an action the customer took. Add-ons are offered as unticked options, at the point they are relevant rather than at the end, priced, with what the cover actually does stated beside the price, and declining available in the same gesture as accepting. The figure shown at the review step is the figure charged; if anything must change after it — a price correction, an item out of stock — the change is announced as a change and the journey returns for a fresh confirmation instead of quietly reflecting it in the total. Receipts itemise everything, including anything added by the merchant's own logic. Where a basket is repopulated from a previous session, that is said, so nobody is asked to recognise choices as their own.
Key Takeaways
- This pattern exploits cognitive biases including loss aversion, anchoring, and status quo bias
- Regulatory enforcement is accelerating globally — the EU, US, and India have all enacted relevant legislation
- Detection methods range from automated scanning to expert cognitive walkthroughs
- Ethical alternatives consistently outperform dark patterns on long-term customer metrics
- Organizations should conduct regular UX audits to identify and eliminate manipulative design
Think your product might use this pattern? Book a UX audit →