While the internet has helped level the playing field for smaller firms, and enabled them to take on their larger competitors, some consumers are still wary of the dangers of using it, especially where money is involved.
For example, new government statistics show that six in 10 online shoppers prefer to buy from established companies, which they perceived to be safer and more secure.
The good news is that more than eight in 10 would happily shop online with an SME that could prove its security credentials. The opportunities are there, but the onus is on the small business to prove that the customer is protected from cybercrime.
This is a two-stage process. You need to show your site is safe, but before that you will need to ensure that it is.
Stephen Robinson, managing director of Xyone Cyber Security, explains: “As a very first step, it is advisable to carry out penetration testing or website monitoring to ensure that your site is essentially safe to use.”
“Pen” testing is a method of evaluating computer and network security by simulating attacks on computer systems or networks using external and internal methods of attack. Website monitoring services are less detailed but are cheaper and can be done on a monthly basis to keep a small business safe from new attack methods as they occur.
“Without any of this, businesses do not know whether their websites currently have any vulnerabilities which could be exploited by hackers and therefore are not safe for use to take details or payment,” says Robinson.
Once this is in place, you have to ensure that a customer’s payment details are secure. This is the headline-grabber, and the part that most consumers are most wary of.
Robinson says: “Any online retailer must be PCI compliant to take payments by card. There are different levels of compliance required depending on a series of criteria, but this is a requirement for all organisations receiving payment by card.”
Whilst PCI compliance isn’t law, penalties for breaking the code – set by the major credit card companies – can be hefty and the fines levied could cost you much more than your reputation.
PCI compliance affects how you and your staff handle card details within your organisation so that they can’t be accessed by outside organisations or used fraudulently.
Robinson adds: “To ensure card details reach you securely, companies should ensure their websites obtain and maintain an SSL certificate (secure socket layer) to demonstrate safe trading and also enhance customer trust”
While this may be starting to sound complex and even daunting, there are a number of platforms that businesses can install which handle payments on their behalf. This places the burden on their shoulders, for a fee, and not yours.
“Use a secure trading merchant such as PayPal, SagePay and Verified by Visa or Mastercard SecureCode as these are run via a secure server and encrypt any consumer data,” says Robinson.
But there is plenty more than just credit card data at risk. Names and addresses are valuable, and mailing lists can be stolen and sold to criminals on the black market.
Keep all customer data private, unless they give you permission otherwise. Keep it encrypted and password-secured on your own systems. If you’re moving into the cloud, the burden of keeping that data safe is still on you.
Robinson says: “If you use cloud or shared hosting services, you should be aware of where your data is stored and be satisfied that the hosting provider you use is ISO:27001 compliant, or at least can demonstrate that they have security measures in place.”
And once all your technical systems are set, ensure every single staff member understands them and behaves within the rules. Much of this is behind-the-scenes, however, and a large part of the problem is public perception. Many believe that smaller firms are inherently more at risk of cybercrime. So how do you combat this?
Nasir Kothia, business development director at eBusiness UK, says: “When you hear of a new company for the first time, you look them up on Google and read the reviews.”
Testimonials on your site are great, but using a third-party review site can really help a firm’s credibility. Sites such as TrustPilot and TrustedReviews ask for honest feedback about your business and its products. These show up on Google searches for your business name, and can be included on your own site, so don’t be shy about asking your customers to post reviews there.
Kothia has also used well-established offers sites to help build credibility for sites. “Putting a deal on Wowcher or MoneySuperMarket will give you a real credibility boost by the association with a household name. It’s a fantastic marketing tool, too.”
And don’t forget the simple touches. “Include all the relevant security logos on your site, and make it clear how customers can get in touch,” says Kothia. “People don’t want to send money to a business they can’t contact if something goes wrong.”
Make sure you rank well on Google and fully engage with social media, adds Kothia.
“Look at ao.com as a great example of how to use the social community to build a reputation,” says Kothia. “There is a very prominent box on the homepage which shows that the company has more than 1.4 million likes on Facebook. That makes it hard to doubt that they are a quality company to deal with.
“Despite the statistics, I don’t actually think there is a reluctance to buy from SMEs. I think it’s more a reluctance from sites that ‘don’t look right’,” says Kothia.
“Shoppers largely just want the best product at the best price. Online customers are there if an SME wants them. If this wasn’t the case then there would be no online success stories, but in reality there are many.”
Sign up to become a member of the Guardian Small Business Network here for more advice, insight and best practice direct to your inbox