Retail runs on inboxes. Supplier confirmations, delivery notes, refund requests, rota changes and the endless back-and-forth between head office and store all land in the same place. Most of it’s routine, which is exactly why nobody looks at it very hard. A buying team can work through several hundred messages in a week without once stopping to ask whether a particular one is genuine.
That’s the gap criminals work in. They don’t need to break anything technical when a convincing message to a buyer or a store manager will do the job for them. Which means the everyday mail habits of ordinary staff matter far more than most retail boards have been treating them.
Why store teams get approached first
Store and depot staff work quickly, under pressure, with a queue of people asking them for things. A message claiming to be a supplier chasing a delivery slot doesn’t look strange. Neither does a password reset request landing in the middle of a heavy trading week.
Attackers know that head office security policy often stops at the office door, and that the people handling the most inbound messages are frequently the ones given the least guidance on spotting a bad one.
The email habits worth changing this quarter
Separating accounts by job does a surprising amount of work. Supplier correspondence sitting in a different place to recruitment enquiries and marketing signups makes an odd message stand out instead of blending in. Two-step verification on every account beats any number of awareness posters.
It’s also worth looking at where your mail actually lives, because providers differ enormously in what they encrypt by default and how much they make you pay for basic account protection.
What head office needs to get right
After the 2025 incidents, the National Cyber Security Centre published recommendations for retailers that were noticeably unglamorous. Turn on multi-factor authentication. Check how your IT helpdesk verifies someone before resetting a password. Watch for logins from unusual sources.
None of that requires new software, and all of it assumes attackers will sometimes get through, so detection and recovery matter as much as prevention.
Training that survives contact with a trading week
The problem with annual security training is that it competes with everything else for attention and loses. Shorter, more frequent prompts work better, especially when they use examples the team actually recognises.
A fake supplier invoice from a name they deal with weekly lands harder than a generic phishing example. As this look at the cybersecurity challenges facing retail businesses points out, staff training and customer education tend to be the cheapest controls available and the first ones cut.
Retail has spent a decade getting very good at protecting the shop floor. Cameras, tags, guards, loss prevention teams, all of it well understood and well funded. The inbox has never had that attention, despite being the door most criminals now choose. Fixing it isn’t a technology project. It’s a habit problem, and habits are something retail already knows how to change.
Terry Clark is the Publisher and Content Director of 365 Retail, with more than a decade of experience covering retail design, technology innovations, store openings and the wider retail industry. He also works closely with leading retailers, suppliers, agencies, events and industry awards across the UK.
