Sameer runs a small store selling mobile accessories, cases, chargers, and earphones, from a single room in Surat. His business lives mostly on Instagram and WhatsApp, with a basic website he set up to take orders during festive season rush. One Tuesday morning, he got a message that looked exactly like it came from Instagram, warning that his account had "unusual login activity" and asking him to verify his password through a link. He was busy packing orders, clicked without thinking twice, and typed in his login details on what turned out to be a fake page. Within twenty minutes, his business page, with over eleven thousand followers built up over two years, was locked out from under him.
He got it back, eventually, after a stressful week of appeals and a lot of help from a friend who worked in IT. But the orders he missed, the customers who messaged and got no reply, and the panic of losing years of work in a single click, none of that comes back easily. Sameer's story is common enough that it deserves more attention than it usually gets. Most small business owners in India think of cyber security as something only big companies need to worry about. In reality, small sellers are often easier targets precisely because they are not expecting to be one.
Why small sellers are an easy target
Large companies have IT teams, firewalls, and security training. A home based seller or a small shop owner usually has none of that, just a phone, a laptop, and whatever time is left after running the actual business. Scammers know this. India's Computer Emergency Response Team (CERT-In) has repeatedly pointed to phishing and simple social engineering tricks, not sophisticated hacking, as the most common way small accounts and websites get compromised. The good news is that the fixes are mostly habits, not technology you need to buy or learn to code.
Start with passwords and two factor authentication
If you are still using the same password across your email, Instagram, website admin panel, and payment app, that is the single biggest risk sitting in your business right now. One leaked password on an unrelated site can give someone a way into everything else.
A few habits make a real difference here. Use a different password for your email, your social media accounts, and your website or hosting login. A password manager, even a free one, makes this painless since you only need to remember one master password. Turn on two factor authentication wherever it is offered, especially on your email and Instagram or Facebook business account, so a stolen password alone is not enough to get in. If you run your own website through neweb, check what login protections your hosting or site builder dashboard offers and switch them on.
The "I sent extra by mistake" and fake payment scams
A very specific scam has become common with Indian online sellers who accept UPI payments directly. A buyer messages saying they accidentally transferred extra money and asks you to refund the difference to a different UPI ID or by scanning a QR code they send. Scanning that QR code or entering your UPI PIN to "receive" a refund can actually authorise a payment out of your account, not into it. The National Payments Corporation of India and most major banks have repeatedly warned that no one ever needs your UPI PIN to receive money, only to send it. If a message asks you to scan something or enter a PIN to get a refund, treat it as a scam and verify the original payment directly in your bank or payment app before doing anything else.
This is one reason many sellers eventually move away from only taking payments person to person and set up a proper payment gateway on their website instead, where transactions are logged, traceable, and harder to manipulate with social engineering.
Phishing emails that look exactly like the real thing
Fake emails claiming to be from courier companies about a failed delivery, from the GST portal about a pending notice, or from a marketplace about a policy violation are extremely common, and they have gotten harder to spot. They often use real logos, similar looking domain names, and urgent language designed to make you click fast without checking.
Before clicking any link in such an email, check the sender's actual email address rather than just the display name, and never enter login details or OTPs on a page you reached by clicking an email link. If in doubt, open the courier or GST website directly by typing the address yourself and check your account from there. Having a proper business email on your own domain rather than a free email ID also makes it easier to tell your real business communication apart from spoofed messages, and makes your own emails to customers look more trustworthy too.
Why your website still needs SSL even if it is "just" a landing page
Some business owners assume that a simple one page website with no payment processing does not need the padlock icon, the little lock next to the address bar that shows a site has SSL encryption. That is not quite right. SSL encrypts the connection between your visitor's browser and your server, so even a contact form or an enquiry page is safer with it. Beyond security, browsers actively warn visitors when a site does not have SSL, which quietly pushes potential customers away before they even see what you sell. Most website builders, including neweb, include SSL by default now, but it is worth checking rather than assuming, especially if your site was set up a few years ago. For a broader checklist, our earlier piece on website security basics covers the technical side of this in more detail.
Protecting customer data is now a legal responsibility too
Security is not only about protecting your own account anymore. If your website or WhatsApp catalog collects customer names, phone numbers, addresses, or payment details, you are handling personal data, and India's Digital Personal Data Protection framework places real obligations on how that data is stored and used. Our guide on the DPDP Act and what it means for small business websites walks through this in plain language, but the short version is that a clear privacy policy and sensible data handling are no longer optional extras, they are part of running a legitimate business online. If you do not have one yet, a privacy policy generator is a quick way to get a reasonable starting draft for your site.
A simple weekly habit that covers most of this
None of the above requires technical skill, just a bit of routine. Once a week, spend ten minutes checking your account activity on Instagram, Facebook, and email for any logins you do not recognise, confirming your website's SSL padlock is showing, and reviewing any payment or refund requests that felt slightly off during the week. That small habit catches most problems before they become a Sameer style crisis.
A proper website, with your own domain, SSL built in, and a payment gateway instead of only person to person UPI transfers, removes a large share of these risks by default, simply because it is built with security as a baseline rather than an afterthought. If your business is still running entirely on social media and personal UPI, moving even a simple storefront onto a proper website is one of the most practical security upgrades you can make this year, on top of everything it does for how customers find and trust you.