Retail Shop IT Security: POS, Wi-Fi, CCTV and Staff Accounts

What a typical shop's IT setup looks like, and where it is weak

Most shop break-ins on the IT side are not clever. They exploit settings nobody changed after installation.

The rest of this guide takes each one in turn.

Separate your POS network from guest Wi-Fi

If customers and staff phones join the same Wi-Fi as your POS, card terminal and CCTV recorder, any infected phone or curious customer is on the same network as your payment devices.

• Guest network: for customers only, with client isolation turned on so devices cannot see each other. No access to the shop's own devices.
• Shop network: for the POS, card terminal, receipt printer and CCTV recorder. Hidden or with a password only the owner or manager knows.
• Staff phones: ideally on the guest network, not the POS network. Staff do not need to reach the recorder or POS from their own phones.
• Wired where possible: a cable to the POS and recorder is more reliable and harder to interfere with than Wi-Fi.

Most business routers, and many consumer ones, support a guest network out of the box. Our guide to setting up a guest Wi-Fi network walks through it, including what to do when the password has been shared too widely.

Default passwords on routers, cameras and recorders

Routers, CCTV recorders and IP cameras often ship with a known default password, and attackers scan the internet for them. CSA's Cyber Essentials standard is direct: change all default passwords and replace them with a strong passphrase of at least twelve characters.

CSA's strong password guidance suggests building a long passphrase from several random words, and turning on two-factor authentication wherever the service offers it.

Staff accounts on the POS and online systems

One login shared by the whole shop is convenient and makes every refund, void and discount anonymous. When cash or stock goes missing, you cannot tell who did what.

Most current POS systems support staff PINs and roles; on some plans it is an add-on. For the shop's Instagram, email, supplier portals and marketplace accounts, use a password manager rather than a shared notebook; see our password manager guide for small businesses.

Card terminal tampering and skimming checks

Card skimmers are small devices fitted over or inside a terminal to copy card data. The PCI Security Standards Council's skimming prevention overview lists the usual targets: unattended or temporarily unmanned terminals, terminals with heavy use, and merchants during busy periods.

1. 1

   Keep a list of your terminals

   Record the make, model and serial number of each card terminal, and where it lives.

2. 2

   Look it over at opening

   Check for anything stuck on, loose parts, extra cables, damaged seals or a card slot that feels different.

3. 3

   Compare the serial number

   A swapped terminal looks identical. A quick check of the serial against your list catches it.

4. 4

   Verify any technician visit

   Call your payment provider on the number you already have before letting anyone service or replace a terminal.

5. 5

   Never leave terminals unattended

   Lock terminals away after closing, and keep them in sight during the day.

Your card acquirer may have its own requirements; follow those as well.

CCTV: access, retention and the PDPA

CCTV footage of identifiable people is personal data. The PDPC's advisory guidelines expect notices where cameras operate, reasonable retention, protection against unauthorised access, and a way to handle requests from people for their own footage. Our CCTV and PDPA guide covers these rules in detail.

For security, the practical points are:

• Only the owner and one or two managers can log in to the recorder or app, each with their own account.
• Remote viewing goes through the vendor's app with MFA, not an open port on the router.
• Exports of clips are logged and shared only through a controlled channel, never forwarded around WhatsApp groups.
• Retention is set to a fixed period, so old footage is overwritten automatically.

A weekly 10-minute shop security checklist

Print this and give it to the manager. Ten minutes a week catches most problems early.

If you want a recognised standard to work towards, CSA's Cyber Essentials covers these basics and more; see our Cyber Essentials mark checklist.

Do it yourself or get help?

A shop owner can do most of this in an afternoon: change passwords, turn on a guest network, set up staff PINs and print the weekly checklist. Start with the router and recorder passwords.

Get help if you are not sure how your network is wired, the CCTV installer set things up and left, or you have several outlets. Our Security Health Check (S$290) reviews your router, Wi-Fi, POS, CCTV recorder and accounts and gives you a prioritised fix list. Password Manager Rollout (S$290) moves shared logins into a proper vault with individual access.