A small business owner receives a WhatsApp message from what appears to be a regular supplier. The supplier's number looks familiar. The message asks for a payment to a new bank account.
The owner pays.
Only later does someone call the supplier and discover that their WhatsApp account had been compromised.
There was no sophisticated cyberattack. No server was breached. No specialist hacker had to break through layers of corporate security.
Someone simply gained control of an account.
For Zambia's small businesses, this is an important distinction. Cybersecurity is often discussed as if it belongs to banks, telecommunications companies and large corporations. But as businesses move their banking, accounting, sales and customer communication onto phones and cloud services, the risks increasingly sit inside ordinary business operations.
Your WhatsApp account is part of the business
For many Zambian businesses, WhatsApp is not just a messaging application.
It is a sales channel, customer-service desk, order book and sometimes an informal record of transactions.
That makes a compromised WhatsApp account commercially valuable.
Businesses should enable two-step verification, protect the email account associated with recovery and avoid sharing verification codes. Staff should also be cautious when someone suddenly asks for money, confidential information or a change in payment details.
Most importantly, unusual requests should be verified through a second channel.
A phone call can sometimes prevent a very expensive WhatsApp conversation.
Protect the money first
A business may have only a few digital systems, but those systems can connect directly to money.
Banking platforms, mobile-money accounts, payment gateways and email accounts that receive financial notifications should receive stronger protection than an ordinary social-media account.
Multi-factor authentication should be enabled wherever available. Banking credentials should never be shared between employees, and businesses should establish clear approval procedures for significant payments.
A request to change a supplier's bank details should not be treated as routine administration.
It should trigger verification.
ZRA documents are business data too
Small businesses routinely exchange sensitive documents containing TPINs, tax information, identification details, invoices, payroll records and financial statements.
These documents can end up scattered across WhatsApp chats, personal email accounts, USB drives and office computers.
That creates a different kind of cybersecurity problem: the business may not know where its own sensitive information is.
Companies should maintain a basic record of where important financial and tax documents are stored, who can access them and how they are backed up.
Not every employee needs access to everything.
Backups matter when the laptop fails
Cybersecurity is not only about stopping criminals.
A laptop can be stolen. A hard drive can fail. A phone can be lost. A ransomware infection can make files inaccessible.
For a small business, losing customer records, accounting files or years of documents can be more damaging than losing the hardware itself.
Important files should therefore be backed up regularly, with at least one backup kept separately from the main device.
A simple test is useful:
If the office laptop disappeared tonight, could the business continue tomorrow?
If the answer is no, the problem is bigger than cybersecurity. It is business continuity.
The employee is part of the security system
Many attacks begin with an ordinary message.
A fake invoice. A suspicious link. A request to reset a password. A message supposedly from the boss asking an employee to make an urgent payment.
Technology can identify some of these threats, but employees still make many of the final decisions.
Small businesses should establish simple rules:
- Never share passwords or verification codes.
- Verify unexpected payment requests by phone.
- Do not open suspicious attachments.
- Be cautious about links asking you to log into an account.
- Report suspicious messages rather than hiding mistakes.
- Remove access when an employee leaves the business.
The objective should not be to frighten employees into avoiding technology. It should be to make good security behaviour part of normal business practice.
Do not overlook the office computer
Many small businesses still depend heavily on one or two computers.
Those machines should have automatic updates enabled, screen locks, reputable security software and separate user accounts where appropriate.
Old computers and phones should also be securely wiped before being sold, discarded or given to someone else.
A device does not stop containing business information simply because the business has stopped using it.
Cybersecurity does not have to start with expensive software
For a small Zambian business operating on a limited budget, cybersecurity can appear expensive.
The first investments, however, do not necessarily require a large IT contract.
Start with the basics:
Strong passwords. Multi-factor authentication. Regular backups. Software updates. Limited access. Employee awareness. Payment verification.
Then build from there.
As the business grows, it can introduce stronger controls, professional security assessments, device management, encryption and formal incident-response procedures.
The important thing is to start before the first serious incident.
The bigger issue is trust
A cybersecurity incident does more than disrupt a computer.
It can delay salaries, expose customer information, interrupt sales and damage relationships with suppliers. For a small company that depends heavily on reputation, the financial consequences can extend well beyond the original loss.
Zambia's digital economy will continue to expand. More businesses will use online banking, mobile payments, cloud software, digital tax systems, social commerce and remote services.
That creates opportunities for smaller companies to operate more efficiently.
But digitalisation also changes what it means to protect a business.
Cybersecurity is no longer simply an IT department's responsibility.
For a small business, it is part of protecting the money, records, customers and reputation that keep the business alive.
