Payment security basics for small businesses

• Phishing — emails, messages or calls that trick someone into sharing a password or one-time code.
• Fake payment requests — a message that appears to come from a director or supplier, asking for an urgent transfer.
• Changed bank details — a "supplier" asking you to pay a new account.
• Account takeover — a reused or weak password giving someone access to your dashboard.
• Leaked keys — API keys committed to code, shared in chat or embedded in an app.
• Fake payment confirmations — a customer showing a doctored screenshot instead of paying.

1. Unique, strong passwords for every payment, banking and email account, kept in a password manager.
2. Multi-factor authentication everywhere it is offered — especially email, because email resets everything else.
3. Individual logins. Never share one account between staff; you lose the ability to see who did what.
4. Least privilege. Give each person only the access their role needs, and remove access the day someone leaves.

• require a second person to approve payouts, and to approve adding or changing a beneficiary;
• set limits on amounts that can be sent without extra approval;
• confirm any request to change bank details, or any unusual payment request, by calling a number you already have on file — never one given in the request;
• be most careful with urgency: "pay this now, and keep it quiet" is a classic warning sign.

More detail in Paying vendors at scale.

• confirm payments in your payment dashboard or bank account — never on the strength of a customer's screenshot or message;
• be wary of overpayments followed by a request to refund the difference to a different account;
• refund only to the original payment method.

• Do not collect card details yourself by phone, email or form if a hosted payment page or payment link can collect them instead.
• Never ask customers for their card PIN, CVV, OTP, UPI PIN or banking passwords.
• Keep only what you need, for as long as you need it, and restrict who can see it.
• Keep API keys and webhook secrets on your server, never in website code, mobile apps, spreadsheets or chat messages.

Short, regular reminders work better than a single long training session. Share real examples of phishing messages, agree on one simple rule — "any request involving money or bank details is verified by phone" — and make it easy and blame-free for staff to report something suspicious.

1. Act fast. Contact your bank and payment provider immediately — speed improves the chance of stopping or recovering a payment.
2. Secure accounts. Change passwords, revoke sessions and rotate any exposed API keys.
3. Preserve evidence — messages, emails, transaction references and times.
4. Report it through the appropriate official channels, and take professional advice where needed.
5. Learn from it. Identify which control would have stopped it, and put it in place.