Volkswacht Bodensee - TikTok Security Chief Advises SMBs on Free Cybersecurity Protections

Nearly two-thirds of businesses utilize social media platforms, and for many smaller firms, these channels serve as the primary point of customer discovery, engagement, and sales. For a small or medium-sized business (SMB), a social media account often functions simultaneously as its shopfront, sales channel, and customer service desk.

This digital integration yields tangible economic benefits. TikTok reported that it helped UK small and medium-sized businesses generate an estimated £3.4bn in additional output in 2025. However, the shift to a digital-first commerce model has attracted sophisticated scammers and cybercriminals who are evolving their tactics to exploit these vulnerabilities. In the UK alone, nearly half of small businesses have reported being targeted by a cyber breach or attack.

Kim Albarella, Head of Global Security at TikTok, noted that while the platform removes more than 99% of fraud and scam content before users report it, SMBs must take proactive steps to protect themselves. Crucially, these measures do not require a dedicated technical team or a significant budget.

Albarella warned that the most effective scams rarely appear malicious; instead, they mimic legitimate business opportunities. These might include unsolicited messages from investors, brands sliding into direct messages with collaboration offers requiring upfront fees, or services promising rapid follower growth. These schemes succeed by targeting the fundamental desires of every founder: funding and expansion.

To counter this, Albarella advised treating every unexpected offer as unverified until confirmed through official organizational websites or trusted contacts. She explicitly warned against engaging with anyone selling likes, followers, or verification, noting that such services result in hollow metrics at best and account compromise at worst.

The article emphasized that login credentials act as the front door to a business’s digital infrastructure. Recommendations included using unique passwords of at least 12 characters for every business account to prevent cascading breaches if one credential is leaked. Additionally, enabling two-step verification ensures that stolen passwords alone are insufficient for unauthorized access.

For devices that support them, Albarella recommended setting up passkeys. These replace traditional passwords with biometric data tied to the device, such as fingerprints or facial scans, making them significantly harder to steal. She also stressed that passwords should never be sent via email or direct message, regardless of how urgent the request appears or how familiar the sender seems.

In small teams, there is often a temptation to share a single login across all staff, including founders, part-time social media managers, and freelancers. While convenient, this practice obscures accountability and makes it difficult to remove access for departing personnel without disrupting ongoing operations. Instead, Albarella advised giving each team member individual access and using a password manager to organize credentials securely.

Other critical steps include keeping recovery emails and phone numbers up to date, regularly checking security alerts, and monitoring active devices. Most importantly, businesses must remove employees, freelancers, and agencies from their systems immediately upon the end of their roles. Albarella described offboarding as one of the most overlooked yet easily managed aspects of business security.

The guidance also extended to content creation. While behind-the-scenes footage, such as packing orders or manufacturing processes, is effective for building an audience, it can inadvertently reveal sensitive information. Albarella urged businesses to check backgrounds before posting, ensuring that delivery labels, order slips, or customer details are not visible, as this information could help scammers target the business or its customers.

Finally, the article encouraged users to report suspicious activity on social media platforms. Every report helps platforms identify patterns and act faster, protecting not only the reporting business but also others facing similar threats.

Albarella concluded that while cyber incidents can be costly, basic protections cost nothing. For one-person operations or growing teams, adopting these habits helps maintain revenue streams while keeping cybercriminals at bay.

F.Stadler--VB