Walk into a 3D lesson.Watch a learner go through the bar scenario, step by step.- Industries
- Retail
Security awareness training for retail, from the till to head office.
Retail runs on seasonal teams, shared tills and a service desk that wants to help. Attackers use all three. Cyberfrog trains store, e-commerce and head-office staff with short lessons and realistic simulations, and gives you the PCI DSS 12.6 evidence your assessor asks for.
- Lessons for shift and seasonal staff
- SMS, QR, voice and email lures
- Service-desk vishing tests
- PCI DSS 12.6 evidence
Store 214: tomorrow's pricing update will lock all tills at 08:00. Store managers must re-verify their back-office login tonight to keep trading. Unverified stores open on manual card machines only.
Re-verify back-office login- Sent from a mobile number, not the store system
- Deadline before opening, when nobody at head office can be reached
- Head office never asks for a login by text
What attackers send to retail teams.
Retailers hold card and loyalty data, depend on many suppliers and hire large numbers of people for a few busy weeks. Attackers combine technical attacks with calls, texts and fake suppliers aimed at the people in between.
- Major UK retailers hit in 2025
M&S and the Co-op both reported cyber incidents to the UK Information Commissioner's Office in 2025. ICO statement, May 2025
- Service-desk calls before ransomware
The joint advisory on Scattered Spider describes calls to IT help desks to reset passwords and MFA, followed by the deployment of DragonForce ransomware. CISA/FBI advisory, July 2025
- Third parties and stolen logins
In retail, third parties are involved in 68% of breaches and the human element in 58%. Credential abuse is 14% of initial access and phishing 9%. Verizon DBIR 2026
- Phone calls for customer data
A vishing campaign against Salesforce customers, tracked as UNC6040, hit about 20 organisations, including retail, hospitality and education. The Register, on Google threat intelligence findings, June 2025
- QR codes and copied brands
ENISA reports quishing campaigns and phishing-as-a-service kits such as Darcula, which impersonated more than 200 organisations. ENISA Threat Landscape 2025
One programme, from shop floor to service desk.
A seasonal cashier, a customer-service agent with CRM access and a buyer paying suppliers each meet a different attack. Cyberfrog gives each group its own path, so new starters are trained before the busy weeks begin.
- Store and till staff
Texts from 'head office', QR codes on staff notices and the card-terminal checks PCI DSS asks for, in lessons of a few minutes on any device.
- E-commerce and customer service
Callers and chat messages that ask for order changes, refunds to new cards or access to the customer database.
- Buying, finance and suppliers
Fake suppliers, changed bank details and invoices timed for the peak season, when nobody wants to hold up a delivery.
- IT service desk and management
Reset requests from callers who sound like a store manager locked out at the till, and a verification routine practised on AI voice calls.
Retail lures, practised safely.
Simulations arrive on the channels store teams really use, often a phone rather than a desk, and every mistake leads to a short lesson on that exact trick.
- SMSTill lock-out warning
A text from 'head office' asks a store manager to re-verify their back-office login before opening.
- VoiceThe manager who is locked out
An AI caller asks your service desk to reset the password and MFA of a manager 'stuck at the till'.
- QRStaff discount poster
A QR code on a notice promises a seasonal staff discount and opens a cloned sign-in page.
- EmailNew bank details from a supplier
A familiar supplier asks for the next payment to go to a new account before a peak-season delivery.
Find the logins attackers can already buy.
Retail teams change fast, and many people reuse one password across work, shopping sites and the staff portal. Cyberfrog checks your domains against Darknetsearch's breach and stealer-log data, as often as every hour, and shows which employees appear in a leak.
Each person gets a personal notice and a lesson on how their data leaked, and the finding feeds their risk score. Passwords are shown only as much as your privacy settings allow. Look-alike domain defense finds copies of your shop's domain that could be used against staff and customers.
What the rules ask of retailers.
Card payments bring PCI DSS, and larger retailers may also fall under NIS2 or the Swiss reporting duty. Cyberfrog keeps training and simulation records per person, ready for your assessor.
| Rule | What it asks for | How Cyberfrog helps |
|---|---|---|
| PCI DSS v4.0.1, Req. 12.6Mapped in Cyberfrog | A formal security awareness programme, with training at hire and at least every 12 months, covering phishing and social engineering (12.6.3.1), plus annual acknowledgement by staff. | Programme mapped to PCI DSS 4, with phishing and social-engineering topics and completion records per person. |
| PCI DSS v4.0.1, Req. 9.5.1.3 | Training for staff at points of interaction to spot tampering with, or replacement of, card terminals. | Physical-security lessons and posters for till staff, with a record of who completed them. |
| NIS2 Directive, Annex IIMapped in Cyberfrog | Large food distribution and online marketplaces are in scope, with management training and basic cyber hygiene training for staff. | NIS2 coverage report and the Cyber risk for leaders course for management. |
| Swiss Information Security Act, Art. 74b(r) | Companies that supply the population with essential everyday goods must report cyberattacks within 24 hours. | Store and office staff who report early, through a report button that feeds your SOC. |
| UK GDPR (ICO guidance) | Appropriate initial and refresher training on data-protection and security responsibilities, including for staff who handle customer and loyalty data. | Data-handling lessons at onboarding and as yearly refreshers, with dates per person. |
Summaries for orientation, not legal advice. Cyberfrog provides training records and coverage reports; it does not certify compliance.
Questions from retail teams.
What are the PCI DSS security awareness training requirements?
PCI DSS v4.0.1 Requirement 12.6 asks for a formal security awareness programme. Staff are trained at hire and at least every 12 months, the training covers phishing and social engineering (12.6.3.1), and staff acknowledge it every year. Requirement 9.5.1.3 adds training for staff at card terminals to spot tampering.
How often is PCI training required?
At hire and at least once every 12 months. A short refresher before the peak season is also useful, because that is when many new people join the stores.
How do you train seasonal store staff?
Keep it short and mobile. Cyberfrog lessons run in the browser on any device, simulations can arrive by SMS or QR code instead of email, and new starters can join an onboarding path in their first week.
How do attackers get in through the service desk?
The joint CISA and FBI advisory on Scattered Spider describes it: a caller poses as an employee, asks the help desk to reset a password and MFA, and uses the new access to go further, in some cases to ransomware. Practising a fixed verification routine on simulated calls helps service-desk staff say no politely.
Is QR-code phishing really a retail problem?
ENISA lists quishing among current phishing techniques, together with phishing-as-a-service kits that copy trusted brands. QR codes on notices, parcels and receipts are easy to fake, so Cyberfrog includes QR simulations and a QR lesson in the retail programme.
Related industries.
- IndustryHospitality
Fake guest messages from booking platforms that lead to ClickFix pages and stolen extranet logins.
Read more - IndustryLogistics
Fake load-board listings, remote-access tools that end in stolen cargo, and ransomware that stops transport.
Read more - IndustryFinancial services
Payment-diversion emails, deepfake executives and phone calls that push staff to release a transfer or reset an account.
Read more
Ready before the busy season.
In a 30-minute demo we show the SMS, QR and service-desk simulations and the lessons for store and head-office teams, on your own domain.