The Five-Minute Closing Routine for a Small Shop: Phone, Wi-Fi, UPI QR and Cash Drawer

⏱ 8 min read|Published 24 October 2026|By Dibyendu Choudhury

Every shopkeeper has a closing routine. The shutters come down, the lights go off, the lock is tested twice, and someone says a quiet word to whichever deity watches over the till. That routine protects the stock and the cash. It almost never protects the three things that now hold as much value as the stock itself: the phone that receives the payments, the Wi-Fi that connects the billing machine, and the QR code that customers scan to pay.

This note is a five-minute closing routine for those three things, plus the cash drawer, which still deserves a place in the list. It is written for the owner of a small shop, a clinic, a tailoring unit or a one-person office, and it assumes no technical staff. Nothing in it needs a purchase. If you do it every evening, in the same order, it becomes as automatic as pulling down the shutter.

Why a routine, and why at closing time

Most small-shop frauds are not clever. They succeed because the owner is busy, tired and trusting at exactly the moment the fraudster arrives. A routine removes the need to be clever. It also fixes a time when you look at the shop the way a stranger would, which is the best way to notice that something has changed.

Closing time is the right moment for another reason. The day's transactions are complete, so you can compare what you were told with what you were paid. Anything that does not match is easiest to chase while the customers who caused it are still fresh in your memory.

Minute one: the QR code

Walk to the counter and look at your payment QR code as a customer would. Is it exactly the one you put up? A common trick is to paste a different QR sticker over the genuine one, so that payments flow to someone else while the shop assumes it has been paid. The sticker is often almost the same size and colour. Run a finger over the edges: a genuine printed code is flat, and a pasted one has an edge you can feel.

Then do the one test that settles it. Scan your own code with a different phone, send one rupee, and watch whose name appears before you confirm. The name should be your shop or your own. If it is anyone else's, you have found the problem before it has cost you a day of takings. Do this once a week at the least, and every time the code has been out of your sight, for example when the counter was left unattended for lunch.

If you use a small speaker that announces payments, treat its voice as a convenience and not as proof. A speaker tells you that the device was told a payment came in. It does not tell you the money reached your account. The proof is in the bank or payment app.

Minute two: reconcile what you were told with what you were paid

Open the payment app or the bank statement and set it beside the day's sales. You are looking for two kinds of mismatch. The first is a payment you were told about and cannot find. The second is a payment you can find but did not expect, such as a refund request or a collect request you never made.

A customer who shows a screen that says the payment was successful, and then leaves, is the classic case of the first kind. Screens can be faked. A screenshot is not a payment. For anything of real value, make it a habit to look at your own phone, not at theirs, before the goods change hands.

A request on your own phone that asks you to approve a payment is the second kind, and it deserves a firm rule: you never approve a request to receive money. Receiving money does not need a PIN. If a stranger asks you to enter your PIN so that you can get paid, they are taking money, not sending it.

Minute three: the phone

The shop phone has become the cash box, and it needs the same care as the cash box. Three checks are enough at closing. First, the screen lock: the phone should lock itself within a minute and should need a code that no customer could guess by watching. Second, the apps: if any app was installed today that you do not recognise, remove it, and be especially suspicious of any app that a caller asked you to install so that they could help you. Genuine banks do not do that. Third, the messages: delete nothing from the day's one-time passwords until you have looked at them, because a code you did not request is a sign that someone is trying to get into an account.

If the phone is shared between family members, agree that nobody installs games or photo apps on it. It is the one device in the house that is also a bank branch.

Minute four: the Wi-Fi and the billing machine

Most small shops have one router, installed by whoever sold the connection, and it often still carries the default administrator password printed on a sticker underneath. Anyone who has seen that sticker, including a technician who visited two years ago, can change its settings. Make one change this week and then leave it alone: replace the router's administrator password and the Wi-Fi password with long, ordinary sentences you can remember, such as the names of three places you have visited, joined together.

Then separate the customers from the business. Many routers let you create a second, guest network. Put customer phones on that one, and keep the billing machine, the shop phone and any computer on the private one. At closing, check one thing: the list of connected devices. If you see a name you do not recognise, change the Wi-Fi password and reconnect only your own devices in the morning.

Switch the billing computer off at night rather than leaving it asleep. A machine that is off cannot be reached from outside, and the few seconds it takes to start in the morning are a small price.

Minute five: the cash drawer and the day's record

The drawer is the oldest part of the routine, and it still earns its place. Count the cash against the sales record before you leave, not the next morning. A difference found the same evening has a short list of explanations. A difference found three days later has a very long one.

Take the day's cash out. A drawer left with only a float and a written note of the opening amount is far less tempting than a full one. Take a photograph of the closing page of the sales book or the day-end report and send it to your own number. That is your off-site copy: if the shop is flooded, the book is stolen or the computer fails, you still have yesterday.

The routine on one card

Write the routine on a card the size of your palm and stick it inside the shutter. Look at the QR code and test it weekly. Match payments with sales. Lock the phone and review its apps and messages. Check the Wi-Fi list and switch off the billing computer. Count the cash, take the cash out and photograph the day's record. That is all. If you are the owner and someone else closes the shop, give them the card and walk through it once, standing at the counter, with the shutter half down.

What to do when something is wrong

Suppose the QR test shows a stranger's name. Remove the sticker, put your own code back, and photograph what you found before you throw it away. Tell your bank or your payment provider the same day, using the number printed on the back of your card or on the official app, and not a number from a message or a call. File a report on the national cyber crime portal, and keep a copy of the photograph and the day's statement. The speed of the report matters more than its polish.

Suppose instead that a caller claiming to be from your bank asks for a code. The rule is the same in every version of the story: you hang up, and you call the bank back on the number you already trust. A real caller will wait for that. A fraudster will not.

A closing thought

An old teaching says that a householder protects what he is responsible for without being consumed by anxiety about it. The five-minute routine is that teaching made practical. It asks for attention, not fear. Done with calm regularity, it turns a shop that is exposed on three digital fronts into a shop whose owner sleeps well, which, in the end, is the real return on the five minutes.

This note is general guidance for small businesses and is not a substitute for advice from your bank or a security professional about your own setup.

---

Published 24 October 2026 · dibyenduchoudhury.com