Online Payment Security Tips for Business Owners

• Choose a payment provider with appropriate encryption and fraud controls, and configure its checkout securely.
• Protect staff and customer accounts with passkeys or multi-factor authentication.
• Protect customer data by following PCI DSS requirements and using encrypted connections.
• Detect suspicious activities early and train staff to recognise potential security threats.
• Regularly update systems to address vulnerabilities and store only permitted, necessary cardholder data.
• Perform regular security checks and prepare for potential cyber threats to minimise damage.

In 2025, UK remote purchase card fraud caused £423.5 million in losses across 3.2 million cases, according to UK Finance’s 2026 report. For the 2025/26 financial year, Report Fraud (which replaced Action Fraud in England, Wales and Northern Ireland) received 3,657 reports of payment diversion fraud, with more than £101 million in reported losses.

The Payment Card Industry Data Security Standard (PCI DSS) v4.0.1 sets security requirements for businesses that accept payment cards. Requirements that took effect on 31 March 2025 include measures relevant to online checkout. PCI DSS includes requirements for:

• Encrypting sensitive payment data
• Implementing strong access controls
• Regularly testing security systems

PCI DSS v3.2.1 retired on 31 March 2024, and v4.0 retired on 31 December 2024, leaving v4.0.1 as the active version. PCI DSS applies to merchants of every size, but payment brands and acquirers set validation and reporting requirements. Eligible merchants use the self-assessment questionnaire that matches how they accept payments; confirm the correct route with your acquirer.

Non-compliance can have financial consequences under card-scheme arrangements and leave systems more exposed to attack. Using a third-party processor does not remove a merchant’s PCI DSS responsibilities: check that the provider is compliant for its services, maintain a written agreement, monitor its compliance at least annually, and confirm your validation requirements with your acquirer or payment brand. PCI SSC explains these merchant obligations. Our PCI DSS compliance article covers the 12 core requirements.

A reliable payment gateway can help protect transactions when it is integrated and configured securely.

When choosing a gateway, check:

• Whether its checkout method fits your site and limits your exposure to card data
• Which fraud controls and customer authentication options it supports
• Its PCI DSS status for the services you use and the responsibilities you retain

Features such as fraud detection and encryption vary by product and integration, so check what the provider handles and what remains your responsibility.

Protect staff and administrator accounts used to manage payments, as well as customer accounts. Passkeys offer a phishing-resistant way to sign in where supported. Where passwords remain in use, multi-factor authentication (MFA) adds a separate factor, such as:

• A FIDO2 security key
• An authenticator app prompt or one-time code
• A code sent by text message or email if stronger options are unavailable

MFA makes it harder for criminals to access accounts with a stolen password. Strong Customer Authentication (SCA) is required. Your provider may use EMV 3-D Secure to let the customer confirm their identity with their bank. Exemptions can apply, so customers will not always see an additional verification step.

HTTPS uses Transport Layer Security (TLS) to encrypt information between a customer’s browser and a website. Check that payment pages:

• Use “https” rather than “http”
• Show no browser warning about an insecure connection

All versions of SSL are deprecated. HTTPS helps protect data in transit, but it does not prove that a website is legitimate or secure for every part of a payment system. Follow the NCSC’s TLS guidance and your provider’s configuration instructions.

Fraud detection tools and real-time monitoring can help identify suspicious transactions. Look for patterns that may indicate fraud or card testing, such as:

• Multiple failed login attempts
• Orders inconsistent with a customer’s usual pattern
• Unusually large purchases
• Repeated failed payments or small-value transactions in quick succession

Use your provider’s fraud rules, alerts and review tools where appropriate, and check their effect on legitimate orders as well as suspicious ones.

Mistakes can expose payment systems and customer data. Make employees aware of the following, and share relevant advice with customers:

• Recognising phishing emails
• Avoiding untrusted public Wi-Fi when administering payment systems
• Using passkeys or strong, unique passwords
• Not sharing sensitive payment information

Regular training can help reduce the risk of security incidents caused by simple mistakes.

Cybercriminals exploit outdated software to gain access to payment systems. Ensure that:

• Website platforms and software you control are updated
• Payment integration software or plugins are running supported versions
• Any plugins or third-party tools are patched regularly

Enabling automatic updates where possible can minimise security vulnerabilities.

Both tokenisation and encryption help protect sensitive data.

Tokenisation replaces a card number with a token, reducing exposure of the original payment details. Tokens and the systems that use them still need appropriate protection.

Encryption makes data unreadable without the appropriate key. Check how your provider protects payment data when it is transmitted and, where storage is permitted, while it is stored.

Avoid storing unnecessary customer payment information. Limiting storage reduces the amount of data that could be exposed in a breach. If you must store permitted cardholder data, ensure it is:

• Encrypted
• Stored on a secure server
• Accessible only by authorised personnel

Card verification codes (CVV/CVC) must not be stored after authorisation, even if encrypted. The PCI SSC explains this restriction. For broader safeguards for personal information, see our data protection methods guide.

Perform regular audits to identify vulnerabilities in your payment system. Audits include:

• Penetration testing to simulate cyberattacks
• Reviewing access logs for unusual activity
• Updating security policies

Hiring a cybersecurity professional to conduct periodic audits can provide an added layer of protection.

A chargeback can occur when a cardholder disputes a transaction through their issuer, and it can be costly for businesses. Reduce the risk of chargebacks by:

• Using clear billing descriptors so customers recognise charges
• Providing excellent customer service to resolve disputes quickly
• Keeping detailed records of transactions and communication

Some payment processors offer chargeback protection services to help businesses mitigate risks.

Many businesses use third-party tools for e-commerce, invoicing or accounting. However, these integrations can introduce security risks. When selecting third-party services:

• Verify their security policies
• Ensure they comply with industry standards
• Limit the data they can access

Always review permissions before granting access to your payment system. If your checkout embeds a provider’s payment form, confirm how your page is protected from unauthorised scripts that could capture card data. PCI SSC guidance explains how this SAQ A criterion applies to embedded forms and differs from redirects or fully outsourced payment links. Check your own setup with the provider and acquirer.

Even with the best security measures, breaches can still happen. Have a data breach response plan in place, with clear processes for:

• Containing the incident and contacting your payment processor for guidance
• Assessing whether personal data is involved and recording the breach
• Reporting a notifiable personal data breach to the ICO without undue delay and, where feasible, within 72 hours of becoming aware
• Informing affected people without undue delay if the breach is likely to pose a high risk to them
• Implementing measures to reduce the risk of future incidents

The ICO’s breach guidance explains the notification thresholds and requires a record of all personal data breaches, including those that are not reportable. Being prepared can minimise damage and help rebuild customer trust.

E-skimming uses unauthorised scripts or changes to a checkout page to capture card details. Review payment-page scripts and monitor for tampering, especially with embedded payment forms; see the PCI SSC’s e-skimming guidance.

Account takeover fraud uses stolen or reused login details to enter customer or staff accounts and place orders or change settings. Look for unusual sign-ins and orders, and offer passkeys or MFA. Report Fraud warned online shoppers about this pattern in June 2026.

AI-assisted payment fraud can make impersonation more convincing through generated websites, images or cloned voices. Independently verify requests to change payment details using a known contact route. Report Fraud’s 2025/26 assessment describes these AI-enabled tactics.

Helping your team understand how to protect sensitive payment card data supports wider PCI DSS compliance efforts. Online training can help employees recognise threats and follow procedures for handling cardholder data.

Our online PCI DSS Training course explains responsibilities when processing payments, both in-person and remotely. The course covers safer handling of cardholder data, recognising potential threats and the role staff play in following organisational security procedures.

Training can support staff awareness and reduce risks caused by avoidable mistakes. Online awareness training cannot, by itself, establish PCI DSS compliance or replace the required technical and organisational controls.