B2C (business to consumer)
B2C describes selling directly to individuals through digital channels. From a security point of view it is the model where consumer data, payment flows and account takeover become the defining risks.
B2C, business to consumer, describes the direct commercial relationship between a company and the individuals who buy from it.
The model means selling products or services straight to people through digital channels: websites, mobile applications, ecommerce platforms.
Security in a B2C context is about protecting consumer information, securing online transactions and holding on to customer trust by keeping their data confidential and intact.
What matters in a B2C environment
Transaction security. Payment flows are the obvious target. Encryption protects financial information while it moves, and strong authentication is what stops somebody other than the account holder from spending.
Consumer data protection. Personal and financial data of individuals brings regulatory obligations with it: a clear privacy policy, real information security controls, and compliance with data protection law such as the GDPR.
Fraud and phishing. B2C companies invest in detecting suspicious activity, and in explaining to their own customers how to recognise a phishing message that impersonates them, because the attack on the customer is also an attack on the brand.
Security that people will actually use. In consumer products, security and usability are the same conversation. A control that adds enough friction gets bypassed, disabled or abandoned, and a checkout nobody completes protects nothing.
The risk that defines the model
Account takeover is what B2C security mostly comes down to. The attacker does not need a vulnerability in the platform: they need a password the customer reused somewhere else, and there are billions of those in circulation.
Which is why credential stuffing defences, rate limiting and a second factor that people are willing to use matter more, in this model, than most of the things that get discussed first.
Where to read more
“Start with Security”, US Federal Trade Commission: practical security guidance for consumer facing businesses, with the considerations that matter for protecting customers and transactions.
Cyber Readiness Institute: security resources aimed specifically at small consumer facing businesses, with practical solutions rather than frameworks.
A worked example
An online shop sells electronics directly to consumers.
To keep that environment secure, the shop serves everything over HTTPS, so that information in transit, card details included, is encrypted.
It requires authentication at registration and again at the point of transaction.
It monitors for fraudulent activity, and tells customers plainly why keeping their credentials to themselves matters.
Its privacy policy is clear and meets data protection law, so customers know what is collected, where it is stored and what it is used for.
And it keeps the platform patched, because a known vulnerability in an ecommerce component is the cheapest way in that exists.