Most business owners don’t think of a quick online order as a security event. This is probably why so many of them place one on the same laptop that holds the payroll files and client records, in the gap between two meetings, with a card pulled from the top drawer.
Vet the retailer first
A lot of company orders, from staff uniforms to office décor, end up on big retail sites. There are new platforms arriving on the scene regularly and some are too attractive to skip. This is where an owner should stop and ask whether Temu, Alibaba, or Shein is safe to shop on because that’s the right thing. These are major Chinese ecommerce sites that help business owners get good deals. Moonlock’s guide calls Shein a legitimate retailer but doesn’t stop there as you need to check out many others.
There’s no reason to skip the legit sites, but right information is worth it before a card number goes. Reading about a retailer’s history is truly a big part of online shopping security.
Shop on a network the business controls
Coffee shop and airport Wi-Fi is shared with whoever else happens to be sitting there and logging in to a supplier account on it, which means the password travels over a network nobody at the business controls. Company orders are better placed from the office network, or from a phone hotspot when traveling and that’s basic business cybersecurity at no cost. A VPN covers the cases where public Wi-Fi really can’t be avoided.
Each shopping account with its own password
It’s a common practice that a store account that was made years ago shares a password with the owner’s many other online accounts, like a CRM tool, email account, etc. All it takes is one breach at the retailer end – it will open the inbox and the inbox can reset nearly everything else the business uses.
Cybersecurity for small businesses usually starts with this type of cleanup – a long, unique password for each account, stored in a password manager, plus multi-factor authentication wherever it works.
Pay with protected methods
Paying a brand-new seller with the main business debit card is a gamble, since a leaked number means the money leaves the account first and the dispute starts afterward. PayPal for secure online payments is a good option because the retailer never sees the card number and buyer protection applies.
Virtual or disposable cards from services like Wise, which can be capped at one merchant or one amount, are also good choices.
Spot phishing and fake sites
Right after an order goes in, a text shows up about a failed delivery and the link opens a page asking for a login and a card number. It looks exactly like the real thing except for one extra letter in the web address.
Be careful about lookalike domains of this kind, misspelled store names that get promoted through ads and social posts and are built to collect card details at checkout. Treating each of these messages as a trap until proven otherwise is a basic part of business information security and a few patterns come up again and again:
- Texts or emails about a suspended account usually aren’t from the retailer, so the owner should go to the site directly instead of tapping the link.
- Delivery messages that ask for a login are a warning sign, since a real tracking page rarely needs one.
- A web address with a spelling twist, like a doubled letter, is a reason to stop and check before typing anything in.
Limit what the retailer collects
When you install a shopping app, it’s normal for it to ask camera, storage, location, calendar and mic permissions. You should use the website in place of the app and deny every nonessential permission if the app stays.
Sharing less at checkout is part of data privacy for business owners in the same way. A name, a shipping address and an email are sufficient enough. But anything beyond that is worth questioning – for example, phone number or date of birth. Also, a separate email address for retail orders keeps the spam away from your main inbox.
Set clear rules for staff purchases
Employees buy things for the business too and it’s usually informal, with one manager ordering supplies on a personal phone while another saves the company card in a browser. A short written policy goes a long way toward company data protection here. It should clearly list the approved sites, the cards employees should use and mention who signs off on a new vendor.
Review purchases regularly
A monthly look at the card statement catches unfamiliar charges early and it’s also a good time to delete shopping accounts nobody uses anymore, since each one is another login to protect. Most of the steps above are one-time setups, so the statement check ends up being the only regular upkeep.
Conclusion
Most of these steps are one-time setups. After that, it’s quite simple as the monthly statement check is the main upkeep.
