Accept payments online securely

The risks

Putting your business online is like opening a new store that can be visited by anyone around the world. This enables you to reach more customers, but it also creates more opportunities for online criminals.

E-commerce websites are often targeted by attackers because they want to get customers' personal and payment data to commit fraud.

How to protect your business

This guide will help you understand what you need to do to:

get your business accepting payments online
keep your e-commerce website safe and secure, and
protect your customers' information.

1. Understand what you need

Here are some things you'll need to put in place to allow you to collect payments from customers online.

An online store or e-commerce system

If you're adding a shopping cart to your website, it needs to be well-built and secure as it will make your site a prime target for online attackers.

You'll need to choose either:

an off-the-shelf online shopping cart (for example, Shopify, Squarespace or Wix) – these dedicated e-commerce companies continually update their software to respond to evolving risks
have an e-commerce system custom-made for your website – make sure you understand the security features your IT service provider will include.

If you plan to use an IT service provider to create or recommend your e-commerce system, our guide on choosing an IT service provider will help you ask the relevant questions. Although they'll be the ones doing the technical work, you'll be responsible for keeping your customers' information safe.

Choosing an IT service provider

A payment gateway

A payment gateway allows you to accept online payments. Each payment type (credit card, debit card, bank transfer) has important security and compliance factors that you need to consider. We recommend that you get in touch with your bank to discuss payment gateway options.

Off-the-shelf e-commerce systems are often limited to certain payment gateways. Talk to your IT service provider about which payment gateway your e-commerce system can integrate with.

Security standards for handling credit cards

The Payment Card Industry has a security standard for businesses who accept credit cards that covers how to handle the data. It's called the Payment Card Industry Data Security Standard (PCI DSS) and it sets the minimum standard for website payment security.

By using a PCI-compliant service provider and by implementing the measures in your business, you significantly reduce your risk of suffering an online attack.

GOALS	PCI DSS REQUIREMENTS
Build and maintain a secure network	Install and maintain a firewall configuration to protect cardholder data. Do not use vendor-supplied defaults for system passwords and other security parameters.
Protect cardholder data	Protect stored cardholder data. Encrypt transmission of cardholder data across open, public networks.
Maintain a vulnerability management program	Use and regularly update anti-virus software or programs. Develop and maintain secure systems and applications.
Implement strong access control measures	Restrict access to cardholder data by business need-to-know. Assign a unique ID to each person with computer access. Restrict physical access to network resources and cardholder data.
Regularly test and monitor networks	Track and monitor all access to network resources and cardholder data. Regularly test security systems and processes.
Maintain an information security policy	Maintain a policy that addresses information security for employees and contractors.

CERT NZ's Critical Controls show how these principles can apply to other areas of your business, too.

Top Critical Controls – CERT NZ

PCI security standards – PCI Security Standards Council

2. Create or update your incident response plan

Moving to an online store introduces new risks to your business. Just like other emergency response plans (such as what to do in the event of a fire or earthquake), this plan should detail contact points, response timelines and procedures in the event of an online attack.

Creating an incident response plan

3. Train your team

Bring your team along with you on the cyber security journey. If they're clear on your business' policies and procedures, and how to follow them, there's less chance a cyber attack will be successful.

Educating your staff about online security

4. Secure your online store

We have a checklist that covers the best practice measures to protect your website. Following this practical advice is particularly important when you're using a website for things like accepting online payments or collecting customers' data.

If you're using an IT service provider, share this checklist with them to ensure that the software you're using meets the recommendations.

Protect your website

You might think that online criminals would be less likely to target your small business in New Zealand than an international corporation, but attackers care more about how easy it is to deploy their attacks than about the size or location of a business.

Get help

Talk to your bank for advice

After you've taken inventory of what you have and what you need, contact your bank. Banks regularly work with businesses to help them establish their e-commerce systems.

They often have guides explaining how they can help. They can also refer you to the relevant people for more information on: