Email security for retail stores: protect your shops, staff and payments

A retail store runs on more email than most owners realize. Supplier orders and invoices, card processor alerts, gift card and loyalty programs, messages from head office and customer complaints all land in a handful of inboxes, often shared between managers and shifts. This guide covers the email scams that target physical stores and small retail chains, the card data rules that apply, and a checklist you can work through before your next busy season.

If you also sell online, read email security for ecommerce stores for order notification and platform issues. This page focuses on the shop floor and the back office.

Why do retail stores need email security?

Retail stores need email security because their inboxes control payments to suppliers, access to card processing and point-of-sale (POS) accounts, and the authority to buy gift cards, all handled by busy staff who switch between the counter and the back office. A point-of-sale system is the register software and card terminal you use to take payments, usually managed through an online account that's reached by email sign-in and password reset.

Three things make retail different from an office business:

• Many people, few accounts. Stores often share one mailbox per location, so a password ends up on a sticky note and nobody knows who signed in.
• High staff turnover and seasonal hiring. New staff don't know what normal looks like, and old staff keep access after they leave.
• Managers can spend money immediately. A manager can buy gift cards from the register or pay a supplier from the store account without waiting for anyone.

The losses that follow are real. The FBI's 2025 IC3 Annual Report recorded 24,768 business email compromise complaints and $3,046,598,558 in reported losses in 2025 across all industries. Business email compromise (BEC) is fraud where a criminal impersonates or takes over a trusted email account to get money sent to them.

What email scams target retail stores?

Retail stores face seven common email scams. The table shows who gets the email and the habit that stops each one.

Fake supplier invoices and bank detail changes

The scam with the biggest price tag is a supplier "changing banks." The email may come from a lookalike of the supplier's domain or from the supplier's own hacked mailbox, so it can arrive inside a real thread. The FTC's Cybersecurity for Small Business guidance gives the fix: "require your employees to call and confirm wire transfer requests that they receive through email." Use a number from an old invoice or contract. Our guides to vendor invoice fraud and fake invoice and payment emails cover the full procedure.

Gift card requests sent to store managers

Retail is a natural target for the boss gift card scam, because managers can buy cards at their own registers. The email looks like it's from the owner or a district manager and asks for cards "for a customer" or "for staff awards," with the codes sent back by email. Here's an example of the kind of message to treat as fraud:

Example: "Hi Sam, are you on shift? I need you to grab 6 x $200 gift cards from the register for a client gift. Scratch the backs and email me photos of the codes. I'm in meetings all day so don't call. Thanks, Laura (Regional Manager)."

The FTC's gift card guidance is direct: "No real business or government agency will ever tell you to buy a gift card to pay them." If codes have already been sent, the FTC says to report the scam to the gift card company right away, keep the cards and receipts, and report it at ReportFraud.ftc.gov.

Fake card processor and POS alerts

Criminals copy the emails your payment processor sends: payouts on hold, accounts suspended, a new device signed in. The link goes to a fake sign-in page that steals the password to the account that controls your payouts. Square's phishing help page is a good model of what real processors say: it will never ask for "sensitive information" such as full bank account details or card numbers by email, phone or text; you should check that the browser shows https://squareup.com/login before signing in; and suspicious mail can be forwarded to spoof@squareup.com. Whatever processor you use, find its equivalent page and pin it in the back office.

Fake customer complaints, receipts and deliveries

A store inbox accepts mail from anyone, which makes "customer complaint" emails an easy lure. They carry an attachment or link said to show a receipt, a photo of a faulty product or a refund form. The FTC notes that "Most ransomware attacks start with phishing or scam emails." Staff should never enable macros or open archives from strangers; read dangerous email attachment types and fake delivery notification emails for the common forms.

Can a retail store take card payments by email?

No. Don't ask customers to email card numbers, and don't send card numbers by email yourself. The PCI Security Standards Council's FAQ 1085 says "PCI DSS Requirement 4.2.2. prohibits the sending of unprotected primary account numbers (PANs)" via "end-user messaging technologies, whether sent internally or over public networks." A PAN (primary account number) is the long number on a payment card, and PCI DSS is the card industry's data security standard that merchants agree to follow.

For phone or special orders, send a payment link from your processor or take the card through your terminal. If a customer emails a card number anyway, don't reply with it or forward it. Follow your processor's guidance on deleting it, and tell the customer how to pay safely.

How should store staff handle a payment or gift card request by email?

Store staff should never buy gift cards, change supplier bank details or send money because of an email alone, and should confirm any such request by calling the person on a number they already have. Write this down as a store policy and post it in the back office.

1. Stop. Urgency, secrecy and "don't call me" are the signs of a scam, not of a busy boss. CISA lists "urgent or emotionally appealing language" first among its phishing signs.
2. Check the full sender address, not just the display name. On a phone, tap the name to see it. See display name spoofing.
3. Call the person on a number from the staff list or the supplier's file. Don't use any number in the email.
4. Get a second approval for any supplier bank change or any purchase of gift cards for business use.
5. Report the email using your mail app's report button, then tell the owner or IT contact so other stores can be warned. Our guide to reporting phishing emails shows where the buttons are.
6. If money or codes have gone, call the bank or gift card company at once and file at ic3.gov and ReportFraud.ftc.gov.

How should a store with several locations set up email?

Give every manager and staff member who needs email their own account with multi-factor authentication (MFA), and use shared mailboxes for each location rather than shared passwords. MFA means a sign-in needs a second factor, such as an authenticator app, as well as the password. A shared mailbox is an inbox that several named users can open with their own logins, so access can be granted and removed per person.

• Personal accounts with MFA. Turn on MFA everywhere; start with Microsoft 365 Security Defaults or Google Workspace 2-Step Verification.
• Shared location mailboxes, such as store12@, opened by named users. See shared mailbox spam protection.
• Limit company-wide lists. Stop outsiders from mailing allstores@; see restricting who can email distribution lists.
• A start and finish routine for seasonal staff. Follow our new employee onboarding and offboarding checklists, and switch access off on the last day.
• Separate POS and processor logins from everyday email where your provider allows it, with MFA on the processor account itself.

How do you stop criminals sending email as your store?

Publish SPF, DKIM and DMARC for your domain and move DMARC to enforcement, so mail faking your exact domain is rejected by your customers' mail providers. SPF lists the servers allowed to send your mail, DKIM signs each message, and DMARC tells receivers what to do when both checks fail. Include every service that emails customers in your name: your POS system's digital receipts, loyalty program, email marketing tool and booking system. A record at enforcement looks like this example:

_dmarc.example-store.com  TXT  "v=DMARC1; p=reject; rua=mailto:dmarc-reports@example-store.com"

Start at p=none, check the reports, then tighten. The DMARC from none to reject guide has the steps, and the FTC's small business guidance says the same thing in plain terms: with email authentication, "Emails from imposters are either blocked or sent to a quarantine folder for further review." DMARC can't stop lookalike domains, so check yours with the Lookalike Domain Generator.

Is Microsoft 365 or Google Workspace protection enough for a retailer?

For a single shop, Microsoft 365 or Google Workspace configured properly is a reasonable start. Both filter spam and malware, support MFA and can tag external senders. Review the settings in Microsoft 365 preset security policies or Gmail spam settings in Google Workspace.

An MX-level filter adds a checkpoint before mail reaches your stores. MX-level filtering means your domain's MX records point to a filtering service that checks mail before your platform delivers it. It helps when phishing keeps reaching store inboxes, when managers need to release a held supplier email from a quarantine digest themselves, and when you run several store or brand domains. iBlockSpam prices per domain with unlimited mailboxes, so adding seasonal staff doesn't change the bill; see email security for small businesses.

Retail store email security checklist

1. Give every staff member who needs email their own login, with MFA on.
2. Replace shared store passwords with shared mailboxes opened by named users.
3. Put MFA on your card processor, POS, bank and supplier portal accounts.
4. Post a written rule: no gift card purchases or supplier bank changes on an email request.
5. Call suppliers on a known number before any bank change, with a second approver.
6. Never request or send card numbers by email; use processor payment links.
7. Publish SPF, DKIM and DMARC, including POS receipt and marketing senders.
8. Keep POS computers and office PCs updated, and keep offline backups.
9. Train every new and seasonal hire on phishing in their first week.
10. Remove email and POS access on each leaver's last day.

Next steps

• Run the free Email Health Check on your store's domain to see your MX, SPF and DMARC setup.
• Print the gift card rule and the supplier call-back rule for every back office before the holiday season.
• Read business email compromise prevention for the wider set of payment controls.
• If you want inbound filtering that each manager can handle from a digest email, see email security for small businesses. Pricing is per domain, not per mailbox.

More threat guides are in our phishing and threats topic.