The Cyber Risk Nobody in the Recycled Parts Industry Wants to Talk About

Most cyber incidents hitting recycled parts businesses now start with impersonation, not a traditional “breach”. Criminals use cloned login pages, convincing links and silent redirects to trick staff into handing over credentials. For parts sellers handling more remote, card-not-present payments, cyber risk becomes an operational control issue: tighten website/DNS oversight, strengthen logins, and train staff routinely.

Cyberattacks hitting recycled parts businesses are increasingly starting without a “breach” in the traditional sense. Lisa Samuel, founder of PayBuddy™ and Sabhi™, argues that most incidents begin with impersonation: convincing links, cloned login pages and silent redirects that trick staff into handing over access. For recyclers selling parts online and handling more remote, card-not-present transactions, the message is practical: cyber risk is now an operational control issue, requiring tighter website and DNS oversight, stronger login practices, and routine staff training, not just faith in platforms and payment tools.

Over the past year, I’ve had more conversations than I can count that start the same way:

“We were hacked.”
“Our system failed.”
“A platform was breached.”

But when we slow down and look at what actually happened, the story is almost always different.

Not a platform failure.
Not a system compromise.
Not a breach in the way most people imagine.

What actually occurred is quieter and far more common.

A staff member clicked a convincing link.
A login page looked real.
A website silently redirected.
Credentials were entered.
Access was handed over.

No alarms. No broken servers. No visible warning signs.

This is how most modern cyber incidents begin.

The Attacks You Don’t See

Today’s cybercrime doesn’t usually involve breaking into systems. It involves impersonating them.

Bad actors now routinely:

Inject malware into poorly secured websites
Clone legitimate pages
Create invisible redirects
Harvest login credentials
Hijack DNS records
Poison search results
Impersonate real businesses
Sell fake inventory
Collect real payments

This doesn’t require elite hackers; it requires outdated plugins, unmonitored hosting, weak passwords, and no active security oversight.

Unfortunately, that describes many small and mid-sized businesses, including a large portion of the recycled parts industry.

Why This Keeps Happening

Most businesses still think of cybersecurity as a software problem; it isn’t, it’s a human + process + visibility problem.

These attacks succeed because:

People are busy
Pages look legitimate
Emails sound routine
No one expects fraud
Everything “seems normal”

No platform can prevent someone from entering their password on a fake page.

No gateway can prevent a staff member from clicking a malicious link.

This is why modern security is no longer about just tools; it’s about awareness, monitoring, training, and guardrails.

What PCI Was Actually Designed to Do

PCI DSS was never meant to make businesses immune to fraud; it was designed to define responsibility.

Security is shared.

Platforms must secure their infrastructure.
Merchants must secure their environments.

That includes:

Devices
Networks
Website integrity
DNS controls
Login practices
Staff training
Access management
Monitoring

Compliance does not mean invincibility; it means structure.

Why This Conversation Matters

When something goes wrong, we look for a single cause:

A system.
A vendor.
A tool.

But most modern incidents don’t have a single point of failure; they happen because old assumptions no longer hold:

“We’re too small to be targeted.”

“Nobody would bother with us.”

“This only happens to big companies.”

This is no longer true; small businesses are now the easiest targets.

A Simple Recommendation

Every business today, regardless of size, should have its website, devices, and access practices reviewed by a cybersecurity professional. Not after something happens, but before.

This doesn’t need to be expensive or complicated. But it does need to be intentional.

If helpful, I’m happy to introduce anyone in the industry to a cybersecurity or IT professional who can review internal controls, website integrity, and access practices to identify blind spots, not to sell anything, just to prevent the next problem before it happens.