7 Security Mistakes Small Businesses in Kenya Make (and the Cheap Fixes)

When people hear “cyber attack” they picture a hacker in a hoodie. That’s rarely what hits a shop in Eastleigh or a restaurant in Westlands. What hits them is a fake payment screenshot, a supplier email that isn’t really from the supplier, or a former employee who still knows the till password.

These are the small business security mistakes we run into most often. None of them needs a security budget to fix. Most need one afternoon.

1. Everyone shares one password

One login for the till, one for the email, one for the supplier portal, and the whole team knows them. It feels convenient until money goes missing and you can’t tell who did what. Worse, the cashier who left in March can still log in.

Fix: give each person their own account, even on free tools. When someone leaves, remove their access the same day.

2. Business email without two-step verification

Your business email is the master key. Password resets for your bank, your website, your Facebook page and your suppliers all land there. If someone gets into it, they get into everything.

Fix: turn on 2-Step Verification in Gmail (or your provider’s version). An authenticator app or a passkey is better than SMS codes.

3. Accepting payment screenshots

A customer shows a confirmation on their phone and walks out. The message was edited. This one is so common it gets its own guide: how to spot an M-Pesa scam SMS.

Fix: only hand over goods when the payment shows in your own statement, business app or POS.

4. Paying “new” bank details from an email

You get an email from a supplier: “Please note our bank details have changed, use this account for the next invoice.” Sometimes it’s from a lookalike address. Sometimes it’s from the real supplier, whose email was hacked. Either way, the money goes to a criminal and it’s usually gone for good.

Fix: never change payment details based on an email or WhatsApp message alone. Call the supplier on a number you already had, and confirm.

5. Devices that never update

The office PC is still on a Windows version that stopped getting security fixes years ago. The cashier’s phone says “update available” and has said so since 2023.

Fix: turn on automatic updates on every computer and phone you use for business. When a device stops getting updates, plan to replace it.

6. No backups, or backups nobody tested

Ransomware, a stolen laptop, or a hard drive that just dies can wipe out years of records. Many businesses think they have a backup until they need it.

Fix: keep important files in a cloud service with version history (Google Drive or OneDrive both work), and keep a second copy on an external drive you update monthly. Once a quarter, try restoring a file to make sure it actually works.

7. Customers on the same Wi-Fi as your till

If customers use the same Wi-Fi as your POS and office computer, they’re on the same network as your business devices. That’s an open door you don’t need.

Fix: almost every router can create a guest network. Put customers there, keep business devices on the main network, and change the router’s default admin password.

Your 30-minute checklist

1. Turn on two-step verification for your business email and WhatsApp Business.
2. Create separate logins for each staff member.
3. Write a rule on the wall: no change of payment details without a phone call.
4. Switch on automatic updates on every device.
5. Set up a guest Wi-Fi network.
6. Restore one file from your backup to prove it works.

If you want to go further, the Communications Authority of Kenya’s KE-CIRT/CC publishes advisories and takes incident reports. But start with the list above. It closes the doors that get used most.