The hospitality industry is more digitized than ever before. And that’s a great thing — because the right technology can save crazy amounts of time, cut costs, and generally make everyone’s life a whole lot easier.
But with new solutions come new best practices, especially in terms of cybersecurity. Kickfin keeps this top of mind. Our product team has built a platform that takes security seriously — in fact, it’s our number-one priority.
And on the Customer Success side, we do everything in our power to ensure Kickfin users are trained to recognize and avoid any potential risks before they ever log in to the platform.
Periodically, we recommend customers assess the overall strength of their cybersecurity to help prevent any unwanted threats to their businesses. Below is a rundown of the most important and effective ways that Kickfin users can protect themselves and their companies from cybersecurity threats.
Why should I care about cybersecurity?
According to a report by Modern Restaurant Management , cashless payment systems have created new cybersecurity concerns that restaurant operators need to be aware of.
They predict four cybersecurity trends for 2025, with cashless payments resulting in more point-of-sale attacks as their #1 security concern for restaurants this year.
Additionally, deepfakes and AI will enable more sophisticated social engineering and phishing attacks by automating them and increasing their complexity. And the delivery platforms that so many operators have come to rely on have increased the risk of cyberattacks within the supply chain that supports the industry.
Operators need to protect their restaurants from potential internal threats as well. Employees can create risks in two primary ways:
- Direct theft
- Inadvertently revealing sensitive information to outsiders.
Keeping You Safe: Kickfin’s Advanced Security Features
We’ve developed several innovative security features to help customers keep their account safe from all sources of potential threats — both external and internal.
- Role policies for tip payouts: These allow the operator to grant permission to employees to receive tips, while also being allowed to issue tips. You can use this feature for a Manager who also sometimes works in tipped positions without them needing to maintain two accounts. Or you can strictly limit a manager from ever being able to receive a tip payout if you don’t have managers that cover tipped positions.
- Payout limits: You can place limits on what types of payouts a Manager or Admin can issue through the platform. For example, you may allow an Admin issue tips through both our integrated Tip Calculator as well as manually, but you may limit Managers or Leads to only issue tips through the Tip Calculator.
- Secondary approval: This feature requires secondary approval for a payment to be issued if that employee is receiving a payment for the first time ever (or the first time in a set number of days), and if more than a certain number of payments are issued to an individual in a 24 hour period.
- Payout caps: You can limit the max amount that can be paid out to any individual employee in a single payment.
- Locked accounts: User accounts will be locked for multiple failed login attempts or invalid 2FA security.
- Audit log features: Kickfin provides increased accountability through expanded audit log features for tracking who is doing what in your Kickfin account.
Cybersecurity Best Practices
At the end of the day, you really can’t control whether you’re the target of a security attack — but you can control how you react and whether it’s successful. As always, knowledge is power.
Here’s how to ensure scammers aren’t given the “keys to your safe,” so to speak.
1. Use the principle of least leverage
Only give users the absolute minimal access they need to do their jobs. Again, that goes for any software you’re using — but within Kickfin, there are four user roles with varying privileges:
- Org Admin: Has access to all locations in the organization; can add/edit/delete users and make payments at any of the locations. We recommend that the number of org admins be kept to the bare minimum of who needs access.
- Site Admin: Has access only to those worksites to which they are assigned; can add/edit/delete users and make payments at those locations. We recommend that the number of site admins be kept to the bare minimum of who needs access.
- Manager: Has access only to those worksites to which they are assigned; can only make payments at those locations; cannot add/edit/delete users.
- Employees: can only receive payments from those worksites to which they are assigned. They have no access to the administrative areas of Kickfin. Most of your staff should be in the Employee role.
Again (just for the folks in the back!): the majority of your staff should not have Org Admin, Site Admin, or Manager privileges.
2. Educate your staff on proper password management.
Many people are well aware of proper password management, but it’s easy for anyone to get complacent, especially if you’ve never before been the target of a phishing scam. Top things to know about password security:
- Kickfin will never call you and ask for your password. Legitimate service providers will not ask you for your password to assist you with their system. This is a common tactic of phishing scam artists in order to gain access to your accounts.
- Do not share your password with anyone. (Ever.) Managers should not share their passwords with others in the organization, and we do not recommend using a generic login (such as generalmanager@restaurant.com).
- Passwords should be unique to the individual. Make it something you can remember, but that is not easy to guess. They should not include any commonly used catch-phrases or mottos belonging to your organization.
- Passwords should contain multiple character types. Consider using numbers and symbols to replace letters in a word, for example D3liciou$Eats!
- Use a passphrase instead of a password. A long phrase (the longer the better!) is much more difficult to crack, such as !tal!an Food !$ my Favor!t3
- Do not use the same password for multiple systems. If your password is compromised, you can limit the harm caused by only using it for one system.
- Do not make your password accessible. For example: do not write the password on a post-it note stuck to the monitor or under the keyboard or mousepad.
- Consider a password generator. Your team may want to consider using automatic password generators that are available through most operating systems, or using a password manager that will generate a site-specific password that is randomly generated and virtually impossible to guess.
3. Clean up your user list.
Remove any employees (particularly Admins and Managers) who are no longer with your organization. Make sure everyone has the right role for their job (see #1 above!).
4. Take extra steps to protect shared computers.
If your team members are using a shared computer, encourage your users to log out of important systems and applications each time they step away from the computer to avoid someone using their account session for illicit purposes.
5. Educate your staff on how to avoid phishing scams and social engineering hacks.
Provide them with training on common phishing and social engineering techniques, how to avoid them, and how to respond to them.
6. Develop a cybersecurity action plan.
Know who to contact in the event of a breach and how best to protect your business. Make sure all managers know your company’s protocol for reporting an incident should one occur.
What to do if you’re the victim of a phishing scam
Chances are, you’re already doing a lot of things right.
If you, an employee or your business becomes a victim of a phishing scam, please do the following:
- If it involves your Kickfin account, notify our support team immediately. We can help minimize the loss and help you recover your account.
- Report the incident to your local law enforcement agency, the FBI’s Internet Crime Complaint Center at www.ic3.gov, and FTC’s Report Fraud site at www.reportfraud.ftc.gov
- Make sure all passwords are updated with new passwords that include letters, numbers and symbols.
- Scan your computer to make sure any malicious or unknown software has been removed.
And as always, we’re here to help. If you’d like a security review of your account, please contact us at support@kickfin.com. We’ll work with you to ensure that all your users are in the appropriate role for their needed level of access.
