Most account takeovers don’t involve clever hacking. A password is reused, leaked in a breach somewhere else, or typed into a convincing fake login page. Two-factor authentication (2FA) adds a second step to logging in, so a stolen password alone is no longer enough.

For a small business, this is one of the measures with the best return on the time it takes.

Which accounts first

Start where a takeover does the most damage:

  1. E-mail. Whoever controls your mailbox can reset the password of almost every other account, and can send invoices in your name.
  2. Your password manager, if you use one.
  3. Banking and payment services. Most banks already require it.
  4. Domain registrar and DNS. Control over your domain means control over your e-mail and website.
  5. Cloud admin accounts: Microsoft 365 or Google Workspace administrators, hosting, the web shop back end.
  6. Accounting software and anything containing customer data.

Then extend it to every other account that supports it.

Methods, from strong to weak

Passkeys and security keys are the strongest option. A passkey is stored on your phone or computer, a security key is a small USB or NFC device. Both are tied to the real website, so they don’t work on a fake login page: they stop phishing, not just password theft. Where a service offers them, use them.

Authenticator apps such as Microsoft Authenticator, Google Authenticator or the one built into your password manager generate a six-digit code that changes every 30 seconds. Strong against stolen passwords. A sophisticated phishing page can still ask for the code and use it immediately, so stay alert to where you type it.

Push notifications (“Is this you trying to sign in?”) are convenient, but attackers send dozens of them hoping someone taps Approve. Prefer apps that ask you to type a number shown on screen.

SMS codes are the weakest form, because phone numbers can be taken over through the phone company. They are still far better than no second step. Use SMS only where nothing else is offered.

Rolling it out in a team

  • Start with the administrators, then e-mail for everyone.
  • Set it up together. A fifteen-minute session where everyone enables it on their own phone prevents most support questions.
  • Store recovery codes. Every service gives backup codes when you enable 2FA. Keep them in the password manager or printed in a safe place, not on the same phone.
  • Register a second method. A second security key, or a passkey on both phone and laptop, means a lost phone isn’t a locked account.
  • Arrange recovery in advance. Decide who can reset 2FA for a colleague, and how you verify that the request is genuine. Attackers call help desks too.
  • Turn it on centrally where you can. Microsoft 365 and Google Workspace let administrators require 2FA for everyone.

Together with a password manager

2FA and strong passwords reinforce each other. A password manager creates a unique password per account, so one leak doesn’t open everything else, and it only fills in passwords on the real website, which is an extra defence against phishing. Protect the password manager itself with a strong passphrase: the passphrase generator makes one in a second.