A salon rarely thinks of itself as holding a database, but it does. The booking app knows every client's name, mobile number, appointment history, and in many cases a stored card token for deposits or no-show fees. That is a genuine customer record, and for most sole traders it lives on the same phone that is left on the counter, lent to the junior, and occasionally left in a taxi.

The risk is not dramatic. Nobody is hacking a hairdresser for sport. The everyday version is a lost or stolen phone, or a booking account signed in on a device that later goes to a family member or a new owner. Once someone is into that account, they have every client's number - which is exactly the raw material a scammer wants for convincing ‘confirm your appointment’ texts.

The fixes are quick and none of them cost anything. Put a proper passcode and face or fingerprint unlock on the phone itself. Turn on the code-on-the-phone sign-in for the booking app account, so a stolen password alone is not enough. And check what the app actually stores about cards; most reputable ones keep only a token and never the full number, but it is worth knowing which you are using.

One more habit worth building: know how you would tell clients if the worst happened. A short, honest text - ‘our booking account was accessed, please ignore any messages asking for payment’ - keeps trust and heads off the follow-on scam. You are unlikely ever to send it, but deciding the wording now is easier than deciding it on a bad Tuesday.