Before you worry about sophisticated fraud tools, get the fundamentals right. PCI-DSS compliance, a properly configured SSL certificate, and two-factor authentication across your admin accounts form the baseline every UK e-commerce business is expected to meet.
What PCI-DSS actually requires of you
The Payment Card Industry Data Security Standard (PCI-DSS), maintained by the PCI Security Standards Council, is a set of technical and operational requirements for any business that stores, processes or transmits card data. Most small and mid-sized UK retailers using a hosted checkout (Shopify Payments, Stripe Checkout, PayPal) qualify for the simplest compliance level, known as SAQ A, because the card data never actually touches your own servers.
If you take payments over the phone, use a payment gateway embedded directly in your own site (rather than redirecting to a hosted page), or store any card details yourself, your compliance obligations increase substantially, often requiring a more detailed self-assessment questionnaire or even an external Qualified Security Assessor audit. Compliance isn't optional — most UK acquiring banks require it contractually, and non-compliance can result in fines or the withdrawal of card processing facilities entirely.
Completing your annual self-assessment
Most payment gateways and acquirers require an annual PCI-DSS self-assessment questionnaire (SAQ), completed online through your acquirer's portal or a third-party compliance service. This typically takes under an hour for a straightforward hosted-checkout setup and confirms basics like: your checkout redirects to a PCI-compliant processor, your website uses HTTPS throughout, you don't store card numbers or CVV codes anywhere in your own systems, and your staff who can access payment settings use unique logins rather than a shared password.
SSL and TLS: more than just the padlock icon
An SSL/TLS certificate encrypts data travelling between your customer's browser and your server, which is why every page of your site — not just the checkout — should load over HTTPS. Browsers actively flag non-HTTPS sites as 'Not Secure', which damages trust and conversion rates even on pages that don't collect payment data.
Most hosting providers and platforms (Shopify, WooCommerce hosts, BigCommerce) now provision a free SSL certificate automatically via Let's Encrypt, so there's rarely a good reason not to have one properly configured. Check your certificate renews automatically well before expiry, since an expired certificate throws a security warning that will stop most customers from proceeding through checkout entirely.
Two-factor authentication as a non-negotiable
Two-factor authentication (2FA) requires a second proof of identity — typically a code from an authenticator app or SMS — in addition to a password, and should be enabled on every account with access to your store's admin, payment gateway dashboard, domain registrar and email hosting. Compromised admin credentials are one of the most common routes into a retail data breach, because they often grant access to customer data, order history and sometimes payment settings in one step.
- Enable 2FA on your e-commerce platform admin account and every staff login.
- Enable 2FA on your payment gateway dashboard (Stripe, PayPal, SagePay, etc.).
- Enable 2FA on your domain registrar account — domain hijacking can take your entire site offline.
- Use an authenticator app rather than SMS where the option exists, since SMS codes can be intercepted via SIM-swap attacks.
Staff access and the principle of least privilege
Give staff the minimum level of platform access their role requires — a customer service assistant answering enquiries rarely needs access to your payment gateway settings or the ability to issue bulk refunds. Most e-commerce platforms support role-based permissions; use them, and review who has access at least quarterly, removing accounts for anyone who has left the business or changed role.
Shared logins are a particular liability: if three staff members use the same admin password, you lose the ability to trace which of them made a change or was the source of a compromise, and revoking access when someone leaves requires changing a password everyone else also relies on.
Building a simple security review habit
Set a recurring quarterly reminder to check for outdated plugins or apps (a leading cause of e-commerce breaches, particularly on WordPress/WooCommerce sites), confirm your SSL certificate is valid and auto-renewing, review staff access levels, and confirm your PCI-DSS self-assessment is current. This half-hour habit catches the majority of preventable security gaps before they become incidents.
Putting This Into Practice
It's rarely useful to treat PCI-DSS, SSL and two-Factor authentication: the security basics every UK online store needs as a standalone decision — the strongest results tend to come from lining it up with the rest of your operation. Many of the same principles come up again in Essential Plugins and Apps for Conversion Rate Optimisation and Store Security, which is worth bookmarking for later.
For related reading: Our companion guide, Building a Data Breach Incident Response Plan for UK Online Retailers, goes into this in more depth. This connects directly with UK GDPR and Data Protection Compliance: A Practical Guide for Online Retailers, which walks through the practical detail.