What are the most common ways you see cybercriminals targeting small retail businesses today?

Today's criminals often target small businesses by pretending to be someone the business already knows or trusts. They may pose as a vendor and send a fake invoice or contact an employee claiming there is an urgent issue requiring immediate action, impersonating tech support to gain access to company systems. Even seemingly routine activities, like connecting a business device to an unsecured public USB charging station, could create risk.

Criminals are increasingly combining technology with social engineering techniques. Rather than relying solely on technical attacks, they may impersonate a trusted vendor, financial institution, delivery provider or tech support representative to convince someone to share sensitive information or send money.

While scams can take many forms, the warning signs are often the same: unexpected requests, pressure to act quickly and attempts to create a sense of urgency, so it's important to pause and verify the request through a trusted channel before taking action.

Business owners don't need to know every scam that exists. Recognizing common red flags and encouraging employees to slow down and verify unusual requests can help reduce the risk of becoming a victim.

Are small business owners and small retailers more or less vulnerable to attack than large companies?

While businesses of every size can be targeted by cybercriminals, small businesses and retailers may face additional challenges if they don’t have resources or cybersecurity expertise. The good news is that many effective security measures are relatively simple and affordable to implement.

Using passkeys and multifactor authentication where available, keeping software up to date, creating strong passwords and regularly training employees to recognize suspicious activity can all help reduce risk. Passkeys, in particular, can provide an additional layer of protection by reducing reliance on traditional passwords, which are often targeted by criminals.

No single tool can prevent every attack, but combining strong account security with employee awareness and good security practices can go a long way toward helping businesses protect themselves as they grow.

What is a red flag that an independent retailer should watch for when it comes to cybercrime?

One of the biggest red flags is any unexpected communication that creates pressure to act immediately. Whether it's a message about an unpaid invoice, suspicious account activity, a technology issue or an urgent request from someone claiming to be a trusted partner, criminals often rely on urgency to get people to act before they have time to think. They may ask someone to transfer money or share a verification code to grant access to a system or device. 

When faced with an unexpected request, I encourage business owners and employees to remember three words: Stop. Verify. Protect.

Taking a few minutes to confirm a request, or getting a second opinion from a trusted colleague, can often be the difference between stopping a scam and becoming a victim of one.

For retail owners with limited budgets or tight margins, how can they secure their systems without spending a ton of money?

Retail owners don't need a large technology budget to strengthen their security. In fact, good security doesn't have to be expensive. Often, it's about making the most of the tools and safeguards you already have.

Improving security starts with good security hygiene. Businesses can begin with simple steps such as enabling automatic software updates and using passkeys or multifactor authentication, then limiting administrative access and activating fraud and security alerts to reduce risk without adding significant cost.

Business owners should also take advantage of the resources and guidance offered by trusted providers and industry partners. Many organizations offer security education and awareness resources or outreach programs designed to help businesses strengthen their defenses. Building good security habits and helping employees recognize potential scams can be cost-effective ways to reduce risk and help protect the business over time.

How would you advise a small business retailer to strengthen their defenses?

Create a culture where employees feel comfortable slowing down and verifying unexpected requests. Many scams rely on convincing someone to act quickly before they have time to think through the situation or follow established procedures.

Technology plays an important role in security, but people remain one of the strongest defenses. Encouraging employees to speak up about suspicious activity and ask questions to verify unusual requests can help reduce risk and strengthen a business's overall security.

What's one step a retail owner could take tomorrow that would help prevent fraud?

Schedule a fraud prevention and cybersecurity checkup. A small investment of time today can help prevent much larger disruptions tomorrow.

Use that time to review basic safeguards, such as enabling account alerts and confirming that contact information on file with financial institutions is current. Also, be sure to review who has access to business systems and accounts.

The key is not to wait until there's a problem. Regularly reviewing these fundamentals can help business owners stay ahead of potential issues and remain focused on running and growing their business.