Tap to Pay Scams: What Small Businesses Should Know

The other day I was speaking to a project manager at a small Vancouver, WA. He’d stopped at a community fundraiser after work. A volunteer asked for a $20 donation by tap-to-pay, then offered to “help” when the payment seemed slow. The manager handed over the phone and later discovered a $200 charge.

Tap-to-pay is generally a secure way to make purchases. The real danger is often not the payment technology itself, but a scammer using urgency, distraction, or trust to hide the amount being charged. As USA Today reported, a few simple habits can protect your money.

Why Tap-to-Pay Scams Matter to Businesses

Small companies make payments constantly: fuel, materials, meals, travel, office supplies, and vendor charges. If several employees carry company cards or use mobile wallets, one careless transaction can become an accounting headache, or a significant financial loss. These scams can also affect businesses that accept contactless payments. Customers expect a clear total, a recognizable business name, and a receipt. A sloppy payment process may look suspicious even when it is legitimate.

How to Use Tap-to-Pay Safely

Confirm the amount before tapping

Never approve a payment until the amount and merchant name are visible. A legitimate seller should have no problem showing you the full transaction before asking for payment. Pay special attention when making donations, buying from temporary vendors, or paying someone who is using a phone instead of a familiar checkout terminal. A scammer may enter $200 instead of $20 and hope you do not notice. If the screen is hidden, the amount changes unexpectedly, or someone tries to rush you, stop the transaction and use another payment method.

Keep control of your phone and card

Do not hand an unlocked phone or company card to a stranger. Once someone has your device, even briefly, they may be able to change the charge, approve another action, or view information that was not intended for them. Employees should hold their own phones and bring them to the payment reader themselves. If the terminal is difficult to reach, ask the seller to move it closer or cancel the purchase. The same rule applies to company cards: keep the card in sight and do not let someone take it into another room or vehicle to process a payment.

Turn on transaction alerts

Configure company cards and banking apps to send an immediate notification for every purchase. Do not limit alerts only to large transactions, because scammers sometimes begin with a small test charge to see whether an account is active. Employees should know who to contact if an alert does not match the purchase they just made. A quick phone call to the office manager or card issuer can prevent additional charges. Alerts also make expense reporting easier because employees can confirm the merchant and amount while the transaction is still fresh.

Use company cards carefully

Give payment access only to employees who genuinely need it. Set spending limits that reflect each employee’s normal responsibilities rather than providing everyone with the same purchasing authority. Create a short written policy explaining where company cards may be used, whether mobile wallets are allowed, and which receipts must be retained. Review charges frequently instead of waiting for the monthly statement. These controls are not about distrusting employees; they help honest staff recognize unusual activity and respond consistently.

Act quickly after a suspicious charge

Contact the card issuer immediately if a tap-to-pay transaction looks wrong. Ask the issuer to lock or cancel the affected card, dispute the charge, and check for other recent activity. Save the receipt, transaction alert, merchant information, location, and approximate time of the incident. If a company phone may have been accessed, change relevant passwords and ask your IT provider to check the device. Fast reporting can limit further losses and gives the bank, police, or other investigators better information to work with.

Small Habits Prevent Expensive Problems

That Vancouver project manager could not undo the awkward encounter, but the company changed its payment policy afterward. Employees at the firm now confirm every total, keep their phones in hand, and receive instant purchase alerts.

Good security practices usually look like this: clear expectations, simple safeguards, and employees who feel comfortable stopping when something seems off.

If your business is in Vancouver, WA, or Portland, OR, Mickler & Associates, Inc. can help strengthen its cybersecurity, Microsoft 365 environment, cloud services, and everyday IT practices. Contact us for a friendly conversation about making technology safer and easier to manage.

R

BNI Resources Available to You

2026.10.06 Education Coordinator Presentation

SlideDeck | PDF

What Happens If Your Scheduling Software Goes Down on Monday Morning?

Okay, it’s 8:05 on a Monday morning. Suddenly, a Vancouver contractor discovers that nobody can open the company scheduling system. Dispatchers can’t see the day’s appointments, technicians do not know where to go, and customers are already calling.

When scheduling software goes down, the immediate answer is simple:

• switch to a prepared backup process

• confirm whether the outage is local or widespread

• communicate your Recovery Time Objectives (RTO’s) clearly with employees and customers.

So, wait — you’re saying you don’t have a plan, you don’t know who to call, and are asking, what in the Hell is an RTO?

Yeah.

Without that preparation, even a brief interruption can turn into missed appointments, lost revenue, and a long day of apologies.

Why Scheduling Software Downtime Hurts

For many small businesses, the calendar is the day’s operating plan. It may contain customer details, job locations, staff assignments, appointment notes, and billing information. But let’s pretend there’s a forest fire (probably not too hard — look outside) and the electricity goes out, then your Internet connection drops. If that information suddenly becomes unavailable, work slows or stops. Employees begin making guesses, customers receive conflicting answers, and private information may end up scattered across personal texts and scraps of paper.

1. Keep an Accessible Daily Schedule

Create an automatic daily export or report containing the next few days of appointments. Store it somewhere authorized employees can reach without relying on the scheduling platform itself. A printed Monday schedule may feel old-fashioned, but during an outage, it can keep crews moving and phones answered.

2. Write Down the Backup Process

Decide in advance who will check the vendor’s service status, contact technical support, coordinate employees, and update customers. Include phone numbers and instructions in a short business continuity plan. When responsibilities are clear, five people do not waste time trying the same fix—or assume somebody else is handling it.

3. Prepare a Simple Communication Plan

Give employees one approved place to receive outage updates, such as Microsoft Teams, email, or a group text managed by the office. Prepare a short customer message explaining that appointments are being confirmed manually. Clear communication protects trust. Most customers will understand a software outage; they become frustrated when nobody can tell them what is happening.

A Recovery Time Objective (RTO) is a management benchmark. Downtimes should last only two hours. Anything beyond two hours is considered a critical emergency. Anything lasting eight hours or more may be declared a catastrophic emergency. Let’s lay it out:

• an incident affecting one employee, minor emergency.

• an incident affecting the company for up to 120 minutes, critical emergency.

• an incident affecting the company up to eight hours, catastrophic emergency.

Now lets’ work the list:

• A minor emergency has a narrow scope and narrow impact. RTO is one hour. Contact the IT vendor.

• A critical emergency has a wider scope with a timeline. RTO is two hours. Contact the IT vendor and the ISP. How quickly will services be restored? Activate the Emergency Communications Plan (ECP) to advise stakeholders when to expect the resumption of regular operations.

• A catastrophic emergency has a prolonged scope without a timeline. RTO may be indeterminable but beyond a day. Contact the IT vendor to begin preparations on setting up an emergency operations center (EOC). Contact the ISP for a timeline on repairs. Contact staff to man the EOC, and break open the ECP to get communication flowing to employees: where to show up for work, when to show up for work, who should stay home, etc.

Now let’s make a real Disaster Recovery Plain from the RTO objectives:

• Who is in charge?

• How will it be managed?

• How will success metrics be calculated?

• What other options are available? Example: there’s no EOC, or the EOC is flooded. Now what?

Get that plan signed-off by stakeholders and start practicing it.

4. Review Your Vendor and Recovery Options

Find out what your scheduling provider backs up, how service interruptions are reported, and whether your data can be exported. Cloud software can still experience outages, account lockouts, and internet-related disruptions. Also protect the computers and accounts used to access it with updates, multifactor authentication, and reliable IT support.

Turn a Bad Morning Into a Manageable One

Going back to our Vancouver contractor, the office manager opens the previous night’s schedule export, contacts the crews, and keeps the day largely on track. The software outage is inconvenient, but it does not become a business crisis. That is the real benefit of preparation: less downtime, fewer missed appointments, calmer employees, and customers who continue to see your business as dependable.

If your business in Vancouver, WA, or Portland, OR needs help planning for outages, Mickler & Associates, Inc. would be glad to help. Contact us for practical guidance on managed IT, cybersecurity, Microsoft 365, cloud services, and professional IT support.

R