Quick answer: If your business collects customers’ names, logins or payment details, those records are exactly what identity thieves want. Online security services protect them in three main ways: encryption (an HTTPS/TLS certificate, now free from providers such as Let’s Encrypt), strong sign-in protection (passkeys or two-step verification) and monitoring with alerts, so that misuse is spotted early. Payment card data is best left to a compliant payment gateway, so that you never store it yourself. Individuals can use the same tools to protect their own identity.
What identity theft looks like
Imagine this. You start getting alerts for card charges you did not make, a new credit card you never applied for, or debits from your bank account. When you contact your bank, you find that someone else has been using your account in your name. That is identity theft: a criminal uses your personal details to borrow money, shop, open accounts or commit other offences, and you may be left to prove it was not you.
Most of us now lead two lives, a physical one and a digital one, and the digital one holds bank logins, shopping accounts, ID documents and contact details. A business that stores that information for thousands of customers is a much bigger target than any single person.
How big is the problem?
- The figure this article originally quoted: Javelin Strategy & Research’s 2017 Identity Fraud Study estimated that 15.4 million US consumers were victims of identity fraud in 2016, with about $16 billion stolen. Javelin later restated the 2016 losses as $16.2 billion.
- More recent US figures: the US Federal Trade Commission (FTC) received more than 1.1 million identity theft reports through IdentityTheft.gov in 2024. In 2025, consumers filed 3 million fraud reports with the FTC and reported losses of $15.9 billion, according to the FTC’s March 2026 testimony to Congress.
- In India: victims can report cyber fraud on the National Cyber Crime Reporting Portal (cybercrime.gov.in) or by calling the 1930 helpline. Report quickly, because fast reporting gives the best chance of stopping a transfer.
An earlier version of this article also told the story of a named private individual whose identity was stolen. We could not verify that account, so we have removed it.
How online security services help
They save time through monitoring and alerts
Without monitoring, the only way to catch misuse is to go through statements and login histories by hand, which is slow for one person and impossible for a business with thousands of customer records. Security services do this continuously. For individuals, that means bank SMS and email alerts, sign-in alerts on email and shopping accounts, and identity-monitoring services. For businesses, it means logging and alerting on unusual sign-ins, bulk data downloads and changes to admin accounts.
They encrypt data in transit
If you run an online shop, an encryption certificate is the minimum. The original article called it an “SSL certificate”. Today’s websites use its successor, TLS (Transport Layer Security), and the internet standards body IETF says the old SSL 3.0 protocol must not be used. A TLS certificate encrypts information passing between your server and the customer’s browser, so the site loads over HTTPS.
The original advised buying a certificate cheaply from a reseller. That is no longer necessary for most sites. Let’s Encrypt, a project of the nonprofit Internet Security Research Group, issues free TLS certificates, and many hosting plans now include one. Bluehost’s shared plans, for example, list a free Let’s Encrypt certificate, as our guide to Bluehost’s pricing notes. Paid certificates still exist for organisations that want extra validation of their company details.
They keep customer payment information secure
Card and bank details are the most valuable data a criminal can steal. Two rules matter most:
- Do not store card numbers yourself. In India, the Reserve Bank of India (RBI) has required since 1 October 2022 that no one in the card payment chain other than card issuers and card networks may store card-on-file data. Merchants use tokens instead, which work only for that merchant.
- Use a payment gateway that complies with PCI DSS. The Payment Card Industry Data Security Standard requires strong cryptography to protect cardholder data sent over open, public networks, along with many other controls. A reputable gateway handles most of this for you.
They build customer trust
For online businesses, trust is the foundation of every customer relationship, and customers are wary of sites that do not look secure. Visible signals help: HTTPS on every page, clear privacy and refund policies, and well-known payment options. Security seals and badges can reinforce this, but only show badges for services you genuinely use, and make sure each one links to a real verification page. A fake badge does more harm to trust than no badge at all.
They protect your reputation
A breach costs more than the immediate loss. Customers leave, regulators may ask questions and partners may stop trusting you. Under the original article’s heading on reputation, it said PCI rules require SSL on a site’s payment pages. A clearer way to put it today: serve your whole site over HTTPS, and let a PCI DSS-compliant gateway handle the card details.
Practical steps for a small online business
- Serve every page over HTTPS with a valid TLS certificate, and renew it automatically.
- Turn on passkeys or two-step verification (2SV) for every admin, email, hosting and payment account. The UK’s National Cyber Security Centre (NCSC) recommends passkeys for business-critical accounts where available, and says any type of 2SV is better than none.
- Collect only the customer data you need, and delete what you no longer need.
- Use a tokenising payment gateway rather than storing card details.
- Keep your website software, plugins and devices updated, and remove accounts for staff who have left.
- Back up regularly and have a written incident response plan. Our guide on how a growing business can improve its cybersecurity explains both.
- If you offer an API to partners or apps, secure it too; see our API security practices.
Practical steps for individuals
- Turn on transaction alerts for every bank account and card.
- Use a unique password for each important account, a password manager, and 2SV or passkeys.
- Never share OTPs, PINs or card verification numbers with callers, even if they claim to be from your bank.
- Keep your devices updated and protected. Our article on whether free antivirus is good enough covers the basics.
- If you suspect identity theft, contact your bank immediately, then report it: in India on cybercrime.gov.in or 1930, and in the US at IdentityTheft.gov.
Final words
The original article’s point still stands: antivirus and a firewall alone are not enough to protect a business’s customers. Encryption, strong sign-in protection, careful handling of payment data, monitoring and a tested response plan work together. None of them is expensive compared with the cost of a breach.
Frequently asked questions
Is an SSL certificate the same as a TLS certificate?
People still say “SSL certificate”, but modern certificates are used with TLS. SSL 3.0 itself should no longer be used, according to the IETF.
Do I have to pay for a certificate?
Not usually. Let’s Encrypt issues free TLS certificates, and many hosts include one. Paid certificates add organisation validation, which some businesses want.
Can my online shop store customers’ card numbers?
In India, no. Since 1 October 2022, the RBI has allowed only card issuers and card networks to store card-on-file data; merchants use tokens. Elsewhere, PCI DSS rules make storing card data costly and risky, so most shops leave it to their payment gateway.
Where do I report identity theft in India?
On the National Cyber Crime Reporting Portal, cybercrime.gov.in, or by calling 1930. Inform your bank at the same time.
Checked in October 2026 against Javelin Strategy & Research’s 2017 study release, FTC data releases and testimony, RBI’s card-on-file tokenisation circulars, the IETF’s RFC 7568, Let’s Encrypt and the UK NCSC’s small organisations guide. This is general guidance, not legal advice on your compliance duties.
