Following security best practices to protect your business online

Provided information is for general informational purposes only and should not be considered legal advice. You should consult with your own legal counsel for requirements governing your specific circumstances.

Most security breaches happen when a user unintentionally compromises the security of their information or access. Understanding common tactics scammers use can help protect you, your staff, and your customers from fraud.

Understanding security threats

A security threat is comprised of:

Scammers: A person or group of people looking to commit fraud. Typically profit-motivated.
Strategy: A strategy, like phishing or other social engineering tactics, that uses fear and urgency to override rational thinking.
Vulnerability: A security weakness, like a simple password or untrained staff.

The more security layers you have in place, the lower your chances of a security breach:

Strong passwords
Answers to security questions
Multi-factor authentication (MFA)
Biometric data, like a fingerprint

Lightspeed will never call, text, or email asking for your banking info, PIN, password, or verification codes. Keep this information confidential to ensure only authorized users can access your Retail POS account. Learn more about what to do if you suspect your account may be compromised.

Recognizing social engineering tactics

Social engineering is the strategy of tricking someone into compromising their own security by divulging sensitive information.

Social engineers use pressure tactics to make you act without thinking:

Authority

Claiming to represent an organization you work with, like Lightspeed, or someone of importance, like your IT department or bank.

Urgency

Implying or threatening consequences if you don't act immediately. Legitimate organizations won't pressure you to act urgently.

Emotion

Invoking emotions like fear, hope, or curiosity to override rational thinking.

Relevance

Exploiting current events, changes to policies, or specific times of the year, like tax season.

Scammers may try to contact you via email, text, instant message, or phone. Phishing emails are one of the most common social engineering strategies because they're low-cost and easy to automate, especially with AI. Scammers typically use impersonation to trick targets into:

Revealing sensitive information.
Downloading malware.
Transferring money.

Lightspeed will never ask you to:

Move funds or change your settlement account to an unfamiliar account.
Share passwords or multi-factor authentication (MFA) codes.
Act quickly, using urgency to limit your time to think or verify.
Keep a security matter confidential from family members or law enforcement.

If you ever receive a request like this, it is not from Lightspeed. Learn more about impersonation scams and keeping your Retail POS account secure.

Protecting yourself from social engineering attacks

Your strongest defense against social engineering attacks is your ability to slow down and think rationally. Scammers rely on panic-based decisions, so always take a moment to pause and consider before taking any action.

If a communication that appears to be from Lightspeed is pressuring you with urgency or other signs of social engineering:

Don't panic

Ask yourself or your staff if this communication was expected.
Verify the sender, especially if an action is involved.
Don't click any links or download attachments.
Manually navigate to the official source to investigate the situation in your account (notifications, activity logs, etc).

Don't share

Never share personal information during unsolicited contact.
Never share passwords or verification codes.

Don't engage

If contacted by email or text:
- Don't reply, click links, scan QR codes, or download attachments.
- Report the email or text as spam/phishing.
If contacted by phone:
- Hang up immediately (you don't need to give an explanation or worry about appearing rude).
- Don't follow any provided instructions.

If you're unsure about the legitimacy of a communication involving Lightspeed, reach out directly.

Cybersecurity awareness is important year round, but be extra vigilant around busy periods like tax season.

Identifying phishing emails

Common warning signs in phishing emails include:

Slight misspellings, hyphens, or unusual characters in sender addresses, particularly in website domain names. Be especially suspicious of generic email addresses (like @gmail.com) from unknown senders.
Generic greetings may be a sign of fraudulent messages sent in bulk, but scammers can also use information from social media and other platforms to create personalized messages.
Pressure tactics and unexpected financial requests or "verifications" rely on distraction and trust. Take time to verify and think through actions that could compromise the security of your account.
Links or QR codes may direct you to a fake version of a real site to steal your username and password or install malware. Always verify links in emails, texts, or external websites.

On a computer, hover over a link (without clicking it) to view the URL text at the bottom left corner of your browser.
Spelling errors in the body text, in combination with other warning signs, could indicate a phishing attempt.
Don't open attachments from unknown senders or files you weren't expecting, as they can contain malware.

Critical Billing Issue: Update Your Information Now

Lightspeed Billing Support <support@lightpseedhq ❶.com>

Lightspeed logo.

Critical Billing Issue:
Update Your Information Now

Dear Lightspeed Customer, ❷

Your most recent payment was declined, and your subscription is now at risk. Failure to act promptly ❸ will result in service interruption without further notice.

To prevent your store from going offline, update your payment method ❹. immediately.

Common causes of declined payments:

Insufficient funds
Bank or Pay pals ❺ issue
Incorrect card details

If you need assistance, reply to this email.

Lightspeed Support.

One attachment

📄 info.exe Download ❻

You can contact Retail Support to confirm if a Lightspeed email communication is legitimate. Always go to the official website or app to login.

Phishing emails may or may not include any number of warning signs, and tactics are getting more sophisticated every day. It's most important to stay vigilant and act cautiously when managing your business online. Learn more about keeping your Retail POS account secure.

Identifying fraudulent phone calls

Common warning signs of social engineering over the phone include:

Fear and urgency-based pressure tactics, which may be presented as helpful or advantageous.
Unexpected financial requests and/or “verification” of sensitive information. Never share passwords or security codes with anyone.
Bypassing procedures or requesting confidentiality.

Scammers can use technology to alter the number they appear to be calling from, so a legitimate business number shows up on your caller ID. They may even ask you to visit the official source to “verify” the number. Do not redial or call back any provided numbers.

Unless you're expecting a scheduled callback from Lightspeed:

Hang up.
Manually enter Lightspeed's official phone number on your phone to contact Retail Support.

Scammer

Hello, am I speaking to [name]?

Business owner

Yes, this is [name]. How may I help you?

Scammer

I'm calling from Lightspeed about a very important matter regarding your subscription. A billing error has led to your account being overcharged by $2000. I have opened up a Support ticket for you, but because of the upcoming bank holiday, I cannot process the refund unless we can confirm your banking information by the end of the day. Could you please confirm your bank branch and business account number?

Business owner

*hangs up and gets in touch with Retail Support*