In short: Security awareness training for retail and hospitality gives store, restaurant and hotel teams the habits that stop fraud and data loss: handling card data safely, spotting 'head office' gift-card scams, verifying help desk and engineer requests, using shared tills properly and reporting fast. Automatic enrolment keeps it working despite high staff turnover.
What makes retail and hospitality different
Customer-facing businesses have a particular mix of risks:
- High staff turnover and seasonal peaks, so new people join constantly and often start during the busiest weeks
- Shared tills, tablets and back-office PCs used by many people, sometimes with shared logins
- Card payments at the counter, over the phone and online, which bring card data handling obligations
- Public-facing staff who are trained to be helpful, which is exactly what social engineers exploit
- Many sites and a head office, which makes 'this is head office' or 'this is the area manager' an easy pretext
- Booking and delivery platforms whose messages are easy to imitate
Retail and hospitality teams rarely have time for long modules, so the content must be short, practical and specific to the job.
Training that keeps up with staff turnover
With a constant flow of starters and leavers, a programme that relies on someone remembering to enrol people will fall behind. Look for automation:
- Directory sync with Microsoft 365 or Google Workspace, so new accounts are enrolled automatically; usecure's Auto Enrol does this, and HacWare includes new-employee training workflows
- An essentials-only path for seasonal and part-time staff: phishing, card handling, scams and how to report, in a few short lessons
- Short formats that fit a break or a quiet moment; HacWare's videos are up to three minutes long with a one-question quiz
- Manager reports by site, so store and venue managers can chase completion
- A clean leaver process, removing the account and the training enrolment together
Our security induction training page has a first-week checklist you can hand to every store or venue manager.
Card data and PCI DSS
Any business that takes card payments must protect card data under the Payment Card Industry Data Security Standard (PCI DSS). The current versions are known collectively as PCI DSS v4.x; version 3.2.1 was retired on 31 March 2024, and the requirements that were future-dated in v4.x took effect on 31 March 2025. PCI DSS has long included a requirement for a formal security awareness programme for staff, so training is part of compliance as well as good practice.
Habits to train for counter, phone and reservations staff:
- Never write card numbers down or ask customers to send card details by email, chat or social media
- Follow the approved process for taking payments over the phone, and never improvise a workaround
- Check card terminals for signs of tampering, and never let an unexpected 'engineer' take or swap one without verification
- Keep receipts and any paperwork with card data secure, and dispose of it properly; see physical security awareness
- Report anything unusual, such as a terminal behaving oddly or a request to bypass the normal process
Which PCI DSS requirements apply depends on how you take payments, so confirm your obligations with your acquirer or assessor. This page is general information, not compliance advice.
Scams aimed at stores, restaurants and hotels
These scams target front-line staff specifically. Build them into training and simulations:
| Scam | What it looks like | What staff should do |
|---|---|---|
| Gift card scam | A 'manager' or 'head office' contact tells staff to buy or activate gift cards and read out the codes | Never share gift card codes on request; check with a manager on a known number |
| Fake engineer or auditor | Someone arrives to 'service' the tills or card terminal, or asks for remote access to the till system | Check the visit was booked; never hand over equipment or allow remote access unverified |
| Help desk impersonation | A caller claims to be from IT and needs a password or a code sent to the staff member's phone | Never share passwords or codes; report it; see help desk social engineering training |
| Guest complaint with a link | An email or booking-platform message from a 'guest' with a link or attachment about a complaint or a lost item | Open messages through the platform itself and report suspicious links |
| Supplier bank-detail change | A supplier asks to update bank details for future payments | Verify on a known number before changing anything; see business email compromise training |
| Scam texts to staff | Texts about pay, rotas or deliveries with a sign-in link | Do not sign in from a text link; forward scam texts to 7726 |
Our social engineering training page covers the techniques behind these scams, and how to report a phishing email explains the UK reporting routes.
Shared tills, tablets and devices
Shared devices make it hard to know who did what, and easy for one mistake to affect everyone. Training should set clear rules:
- Use your own login on every till and back-office system, never a colleague's
- Lock or sign out of a device when you step away, even for a moment
- Never write passwords on the till, the terminal or a note under the keyboard
- Keep staff devices off the guest Wi-Fi and do not plug personal phones into tills to charge
- Do not install apps or browse personal sites on shared work devices
Training works best alongside controls such as individual accounts, MFA for head office and admin users and mobile device management for shared tablets. See password and MFA training for the account habits behind these rules.
Choosing a platform
For multi-site retailers and hospitality groups, automation and simple reporting by site matter most:
- Smaller groups wanting one security platform run for them: Guardz, which we provide as a managed service, includes training and phishing simulation, including QR code scenarios
- Automated enrolment and training: usecure or HacWare
- Training with policies and a staff portal: Breach Secure Now
- Microsoft 365 E5 or Defender for Office 365 Plan 2: Attack Simulation Training is already included
Compare all the options on the platforms compared page.
How we help retail and hospitality businesses
We set up automatic enrolment, build a short essentials path for seasonal and part-time staff, theme simulations on the scams your teams really see, and send managers simple completion reports by site. Our managed security awareness training service runs it all year round, with extra pushes before peak trading periods.
Contact us to discuss training for your stores or venues.
How Forever Systems runs your awareness programme
We are vendor-independent. We compare the security awareness and phishing simulation platforms that suit your size, sector, Microsoft 365 licensing and existing security tools, recommend one, then run it for you so training and phishing tests actually happen month after month.
- Baseline phishing simulation to see where you start
- Platform selection and set-up, with single sign-on and automatic user sync from Microsoft Entra ID or Google Workspace where the platform supports it
- A year-round plan of short training modules, simulated phishing campaigns and policy sign-off, including new-starter induction
- Sector and role content for schools, charities, healthcare, legal, finance, public sector and high-risk roles such as finance teams and help desks
- Reporting for the board, auditors, insurers and Cyber Essentials, showing completion, reporting and click trends
- Joined-up defences: email security, MFA, endpoint protection and dark web monitoring so training is backed by technology
Forever Systems Ltd provides IT and cyber security services to UK organisations. Pricing depends on user numbers and platform, so ask us for a quote.
Want help choosing and running security awareness training?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Do seasonal and part-time staff need security awareness training?
Yes. They take payments, use shared devices and are often targeted because they are new. A short essentials path covering phishing, card handling, common store scams and how to report can be completed in their first week.
Does PCI DSS require security awareness training?
PCI DSS has long included a requirement for a formal security awareness programme for staff, and it remains part of PCI DSS v4.x. Which requirements apply to you depends on how you take payments, so confirm your obligations with your acquirer or assessor.
What is a gift card scam?
A criminal contacts a store pretending to be a manager, head office or a supplier and persuades staff to buy or activate gift cards and read out the codes. Once the codes are shared the money is gone. Staff should never share gift card codes on request and should check with a manager on a known number.
How long should cyber training take for till staff?
Short is better. Lessons of a few minutes each fit around shifts and are more likely to be completed than a long annual course. Regular short simulations and reminders keep the habits fresh.
How do we stop staff sharing till logins?
Combine training with controls: give everyone their own login, make locking or signing out a routine, and explain why shared accounts make fraud harder to investigate. Managers should treat shared logins as a process problem to fix, not just a training topic.