It is the Tuesday before Thanksgiving and you are in the back office, staring at a list of seasonal hires. Two of them did not show up for orientation. Your homepage banner has to change at midnight Thursday. The card reader at register three has been rebooting itself for a week. The busiest five days of your year start in seventy two hours.
Here is the part nobody puts on the calendar. The people who want to steal from your business know that same calendar. They know your staff is new, your manager is running on four hours of sleep, and your willingness to slow down and verify something is at the lowest point it will hit all year. Black Friday is a sales event for you and an opportunity for them. The good news is that almost everything that goes wrong in the holiday rush is predictable, and predictable problems get handled in a couple of quiet afternoons if you start early in November.
Can Your Site Actually Take the Traffic?
Most small retail websites around Denton County run on shared hosting, which means your site lives on one server alongside a few hundred others, all splitting the same processing power. That works fine in March. It works less well when your email blast goes out at 6 a.m. and everybody clicks at once. The failure is rarely dramatic. The site just gets slow, the cart takes eleven seconds to update, and shoppers quietly leave without telling you they were there.
- Load test before the rush, not during it. Have your host or IT provider simulate several hundred visitors at once and watch page load times. Do it early enough to fix what you find, and ask what your host, processor, and IT provider actually cover on a holiday weekend.
- Put a CDN in front of the site. A content delivery network, or CDN, keeps copies of your images and pages on servers around the country so shoppers pull them from nearby instead of from your one server. It is cheap and it absorbs the spike.
- Actually buy something on your own site, from a phone. Run a real transaction end to end, including the confirmation email, then run a return. A plugin update quietly breaking that email in September is more common than you think.
Your Checkout Page Is the Target
The most damaging attack on a small online store is also the quietest. It is called digital skimming, or e-skimming: somebody slips a few lines of code onto your checkout page, and that code copies card numbers as customers type them. Your site keeps working. Orders keep coming. Nothing looks broken, which is the point. Most retailers find out when their processor calls, and by then the damage covers weeks. That is why the current card rules, PCI DSS version 4.0.1, require merchants to inventory every script on a payment page and watch for unauthorized changes. PCI DSS stands for Payment Card Industry Data Security Standard, the rulebook the card brands hold you to.
- Inventory every script on your checkout page, then freeze it. Analytics, chat widgets, review tools, ad pixels. Each is somebody else’s code running in your customer’s browser at the exact moment they type a card number. Remove what you cannot justify, then add no new apps or theme changes until January unless it is a security patch.
- Ask your processor which fraud tools you are not using. Address verification, card security code checks, and velocity limits that block the same card being tried twenty times a minute. Most processors include these and most small merchants never turn them on.
- Watch your decline rate like you watch sales. A burst of tiny transactions with a high decline rate usually means card testing, which is somebody running stolen card numbers through your checkout to see which still work.
- Treat gift cards like cash. The FBI lists gift card fraud among the common holiday scams it tracks. Cards are fast, hard to reverse, and easy to resell. Cap bulk orders and route them to a human.
The Staffing Scams That Ride Along With Seasonal Hiring
Seasonal hiring creates a window where your business is publicly saying yes to strangers, and criminals have noticed. Federal Trade Commission data published in 2024 put reported consumer losses to job scams at roughly $501 million. Some of that is people impersonating real employers, and a small retailer with a hiring post and a public logo is easy to impersonate. The other half points at you. A brand new employee has never heard your voice and badly wants to make a good impression, which makes them a perfect target for a text saying the owner needs a favor.
- Name one official place where you post jobs. Say it plainly on your website and in every listing so applicants can check. If you never interview over a chat app, say that too.
- Never collect Social Security numbers or bank details outside your payroll system. Not by text, not by email attachment, not through a form somebody built in an afternoon.
- Tell every new hire on day one what you will never do. You will never text them to buy gift cards. You will never ask them to move money. Saying it out loud defuses the scam before it arrives.
- Verify every direct deposit change by voice. Call the employee at the number already in your records, not a number in the request. This one rule stops most payroll diversion fraud by itself.
Set the Ground Rules Before the Doors Open
The most useful thing you can do this month costs nothing. Write down in plain language who is allowed to approve what, and hand it to your managers before the rush starts. Then turn on multi-factor authentication, a second proof of identity beyond a password, usually a code from an app on your phone. Turn it on for email, your store’s admin login, your payment processor, and your payroll system, because those four accounts are where the money lives. Then pull access for last season’s temps and put an end date on new seasonal accounts so they close themselves in January.
Assume Something Breaks, and Decide Now What You Do
Your internet will go down on the busiest Saturday. Plan for it. A second connection that does not share a path with your primary one is the whole trick, and satellite service like Starlink works well here because it skips local infrastructure entirely. If a backhoe finds the fiber down the street, the dish does not care. Pair it with battery backup, sometimes called a UPS or uninterruptible power supply, so a flicker in the power does not take your registers with it.
Then write a one page sheet, on paper, and put a copy at each register. What we do if the internet is out. What we do if card processing is down. Who calls whom. Ask your processor now whether your terminals support an offline mode, because nobody learns that at 11 a.m. on Black Friday. The Cybersecurity and Infrastructure Security Agency, better known as CISA, and the FBI have warned for years that attackers time ransomware for holidays and weekends when staff is thin. Confirm somebody has actually restored a file from your backups recently, because a backup you have never tested is a rumor, not a plan.
The Bottom Line
None of this is exotic. Test the site, clean up the checkout page, freeze changes, write down your money rules, verify direct deposit changes by voice, and have a second way to get online. All of it has to happen early in November, because none of it can be done mid rush. The retailers who sail through the holidays are not lucky. They did the boring work in the first week of the month.
We help small businesses across Lewisville, Flower Mound, Highland Village, and the rest of Denton County get ready for exactly this. Reach out at harrisonward.com/contact and we will walk the list with you.
Comments are closed