In 2016, ransomware became an increasingly serious problem for small and medium businesses. Ransomware has proven a successful revenue generator for criminals, which means the risk to businesses will grow as ransomware becomes more sophisticated and increasing numbers of ethically challenged criminals jump on the bandwagon.

Every business must take steps to protect itself from ransomware, but talking about prevention doesn’t help ransomware victims decide whether to pay to get their data back.

It’s an unpleasant position in which to find oneself. No-one wants to pay criminals for access to their own data, but nor do they want to permanently lose access to information vital to their business.

To pay, or not to pay? As you might expect, there’s no definitive answer, but we can think through some of the factors that should influence your decision.

The FBI’s position on ransomware payments is straightforward: don’t pay. The FBI believes paying doesn’t guarantee access to the encrypted data, that it “emboldens” criminals to target more organizations, and that it encourages more criminals to join the ransomware industry.

All of that is true, but business owners are understandably more interested in getting their data back now than whether paying encourages future attacks.

Nevertheless, before paying, business owners should consider that by paying, they paint a target on their back. Criminals will bleed a victim dry if they’re able. If you make a payment, you show the attacker that you’re the sort of person who pays, and that can only encourage the attacker to find out how much more they can extort.

If you choose to pay, you may or may not receive the keys to unlock your data. There is no guarantee that the keys will ever be delivered. But, counter-intuitive as it may sound, the ransomware model is based on trust. Victims have to trust that attackers will release their data—otherwise there’s no incentive to pay.

In most cases, people who pay get their data back. In fact, the largest ransomware operations provide excellent customer service. They will help you pay and decrypt the data.

Ultimately, your decision to pay should be predicated on a simple calculation: is the data I stand to lose and any future risk caused by paying worth the price being asked?

The best way to avoid paying is to make sure that you never become the victim of a ransomware attack in the first place. That might seem like a truism, but it’s surprising how many business owners don’t take the simplest steps to keep their data safe.

Educating employees about ransomware and phishing should be a high priority, but the single most important action a business owner can take is the creation of regularly updated offsite backups.

Ransomware is only effective if it deprives the business of data; if that data is duplicated in a place the attackers can’t reach, they have no leverage and you won’t have to pay them a cent.