Retail and E-commerce Cybersecurity: Securing Store and Site

It's the Monday after a busy December weekend at a clothing boutique in Montréal's Mile End. Sales were strong in store and online. Then three customers call: charges they don't recognize have appeared on their credit cards. The investigation finds that a script, slipped in through a poorly maintained plugin, had been showing shoppers a fake payment form for weeks. Orders went through normally. Nobody noticed a thing.

Retail combines two worlds that fraudsters love. There's the store, with payment terminals, a point-of-sale system and Wi-Fi. And there's the online shop, with its platform, apps and admin accounts. Add the customer list from your loyalty program, and you have exactly what criminals are after: money and data.

The good news: the most effective protections are often the cheapest. Choose the right way to take payments, lock down your accounts and keep your networks apart.

Where the risks hide in a retail business

Before you buy anything, map where you're exposed. Most stores share the same weak spots.

PCI DSS 4.0.1: what a merchant needs to know

PCI DSS is the security standard set by the major card brands. Version 4.0.1, published in June 2024, became the only active version when 4.0 was retired on December 31, 2024, and the "future-dated" requirements have applied since March 31, 2025.

It isn't a law; it's a contractual obligation. Your payment provider (the acquirer) or the card brand decides how you must validate compliance, and the PCI Security Standards Council tells merchants to check with them when in doubt.

For most small businesses, validation means a self-assessment questionnaire (SAQ). Which one applies depends on how you take cards:

One recent change matters for online stores: since March 31, 2025, the revised SAQ A requires merchants to confirm their site isn't susceptible to script attacks that could affect their e-commerce systems.

Shrinking your scope is still the best strategy. A hardware store in the Ottawa Valley used to jot down card numbers taken over the phone, then key them in at closing. Switching to a virtual terminal and emailed payment links meant it stopped keeping card numbers altogether, and its questionnaire got simpler. Our guide to PCI DSS 4.0.1 for small businesses covers the requirements in detail.

The store: terminals, POS and Wi-Fi

Terminals. Use the ones your payment provider supplies and keep an inventory: model, serial number, location. PCI DSS requires merchants to protect them from tampering and substitution. In practice, someone checks seals, cables and appearance every week, and nobody hands a terminal to a "technician" without an appointment confirmed with the provider.

Network. The Canadian Centre for Cyber Security recommends segmenting point-of-sale terminals and putting guest Wi-Fi on a separate access point. The Wi-Fi you offer shoppers should never be able to see the till. Our article on business Wi-Fi security explains how.

POS system. One login per employee, not a shared code taped under the cash drawer. Keep the POS software patched, and switch on the vendor's remote access only when needed, with multi-factor authentication.

The online store: accounts, plugins and scripts

Whether your store runs on a hosted platform or your own server, four habits matter.

1. Protect admin accounts. Require MFA for the owner, staff and your web agency. Everyone gets their own account, with only the permissions they need.
2. Clean up your apps and plugins. Every add-on is someone else's code running on your site. Remove what you no longer use and install updates promptly.
3. Watch your scripts. The Mile End attack relied on an unwanted script. Keep a list of the scripts allowed on your checkout pages and use a Content Security Policy (CSP). Our security headers checker shows in seconds whether your site has one.
4. Block card testing. Bots try stolen cards through bursts of small purchases. Turn on your payment provider's fraud filters, rate-limit attempts and add bot protection at checkout.

If your store is custom-built, a web application penetration test finds the holes before fraudsters do. Like any penetration test, it requires written authorization (Criminal Code, s. 342.1), including your host's where applicable.

Fraud: gift cards, refunds and fake suppliers

Not all retail fraud goes through IT. Three scenarios come up again and again:

• Gift cards. A fake "district manager" calls the store and asks staff to activate cards for a VIP customer. Simple rule: no activation without real payment, no matter who's calling.
• Refunds. Set a threshold above which a second employee must approve, and review the refunds and voids report every week.
• Fake suppliers. An email announces that a wholesaler's banking details have changed. Always confirm by phone, using the number you already had on file.

Customer data and privacy law

Loyalty programs, newsletters, customer accounts, deliveries: your business holds more personal information than you might think. In Quebec, Law 25 requires you to protect it, keep a register of every confidentiality incident and, if an incident presents a risk of serious injury, promptly notify the Commission d'accès à l'information and the people affected. Retailers in other provinces have comparable obligations under federal or provincial privacy law.

In practice: collect only what you use, limit who can export the customer list, and delete old exports sitting in shared folders. Run your approach past your legal counsel.

Your retail security checklist

• Know which PCI DSS questionnaire applies to you, and complete it every year.
• No card numbers kept on paper, in spreadsheets or in email.
• Terminal inventory and weekly inspection.
• Terminals and POS on a network separate from customer Wi-Fi.
• One login per employee on the POS and the online platform.
• MFA on every admin account and on email.
• A list of approved apps, plugins and scripts on the online store.
• Payment provider fraud filters switched on.
• Dual approval for large refunds and gift card activations.
• An up-to-date incident register.

Want to know where your real gaps are, from the till to the checkout page? Our team can test your online store through a well-scoped penetration test and hand you a prioritized action plan.