How to secure your business accounts against hackers

How to secure your accounts when you are the IT department

If you work alone or run a small team, nobody else is going to secure your accounts. There is no IT department to reset a password, notice a strange login from another continent, or check that the person who left in March no longer has access to the shared drive. That job falls to you, usually between two other jobs.

The good news is that most attacks on accounts are not clever. In its 2025 Digital Defense Report, Microsoft found that more than 97% of the identity attacks it observed were password spraying or brute force: trying common or leaked passwords until one works. Other attacks persuade you to type your password into a fake page, or send an invoice with new bank details that look perfectly routine. Each of these has a known defense, and none of the defenses requires a security budget.

This guide covers the accounts that keep a small business running: email, cloud storage, banking and payments, accounting software, your domain name and website, and the social media pages your customers see. It sets out what to protect first, which tools to use, which scams to watch for, and what to do if something goes wrong. The detailed guides linked below go deeper into each step.

Why it feels harder than it is

Account security has a reputation for being complicated, mostly because the advice around it contradicts itself. You may have been told to change every password every 90 days, to use a mix of symbols and capital letters, and never to write anything down. Current guidance has moved away from most of that. The US National Institute of Standards and Technology (NIST) now tells online services not to impose composition rules or periodic password changes, and the UK’s National Cyber Security Centre (NCSC) recommends three random words or a password manager, and prefers passkeys wherever they exist.

The tools add to the confusion. Your browser offers to save passwords, your phone offers to save them too, and a dozen companies sell apps that do the same thing. Some sites send a code by text message, others ask for an authenticator app, and more and more of them now offer passkeys. Each option has real trade-offs, and most of the comparisons you find online are written by sites that earn a commission on the app they recommend.

Then there are the differences between countries. Where you report a scam, how you freeze your credit after identity theft, and which free government guidance applies to your business all depend on whether you are in the US, the UK, Canada, or Australia. This guide says which country a step applies to whenever it matters.

The order that protects the most

You do not need to do everything at once. The steps below are ordered by how much each one reduces your risk for the time it takes.

Your main email account comes first. When you click “forgot password” on almost any service, the reset link goes to your email. Whoever controls that inbox can take over the accounts attached to it, one reset at a time. The NCSC advises a strong password used only for your email for exactly that reason. Secure it before anything else, then work outward to the accounts that hold money, customer data, or your public reputation.

The tools come next, because they protect every account at once. The scams come after the tools, because some of them do not need your password at all. The recovery plan comes last, but it is worth writing down before you need it: it takes 20 minutes on a quiet afternoon and saves hours on a bad one.

Start with an inventory of your accounts

Before changing anything, list the accounts your business depends on. Most people underestimate the number, and the forgotten ones are the risky ones: the old Dropbox account a client still shares files with, the domain registrar you log into once a year, the payment app on the phone of an employee who left.

Copy this table into a spreadsheet or a note and fill it in. It takes about half an hour for a small business, and it becomes your checklist for the steps below.

Two columns deserve special attention. “Who can log in” shows the accounts shared with an assistant, an accountant or a former employee. “Recovery email and phone” shows where a reset would go: an old personal address or a number you no longer use can lock you out, or let someone else in.

Store a different password for every account

Reusing a password is the habit that does the most damage, because a leak at one site becomes a key to every account that shares the password. The fix is a password manager: an app that creates a long random password for each account, remembers it, and fills it in for you. You only remember one strong password, the one that opens the manager.

The choice is wider than it looks. The password manager built into your browser or phone may be enough for one person, while a team needs shared vaults, a way to remove access when someone leaves, and sometimes an administrator who can recover an account. Our guide to choosing a password manager for yourself or your team compares the built-in options with dedicated apps, explains what the free plans actually include, and shows what each one costs per user.

Add a second factor, then switch to passkeys where you can

A second factor means that a password alone is not enough to log in: you also need a code from an app, a tap on your phone, or a physical security key. It turns a stolen password into a much smaller problem, and Microsoft’s 2025 report found that it blocks over 99% of unauthorized access attempts. Text message codes are the weakest option but still better than none, while authenticator apps and security keys resist more attacks.

Passkeys go one step further. They replace the password with a key stored on your device and unlocked with your fingerprint, face, or PIN, and they are designed to work only on the website they were created for, which makes them resistant to fake login pages. Google accounts support them, and the password managers built into Apple devices and Chrome can store them. In April 2026, the NCSC announced that it no longer recommends passwords where passkeys are available. Our guide to adding a second factor and switching to passkeys covers which second factor to choose, how to set up passkeys on the main platforms, and how to keep access when you change or lose your phone.

Learn the scams that skip the password

Some attacks never touch your password. A fake invoice from a supplier you really use, an email from “the boss” asking for an urgent transfer, a call from “Microsoft support” asking you to install remote access software: none of these is stopped by a password manager or a second factor. They are stopped by habits, such as confirming a change of bank details by phone on a number you already have.

These scams are common. In the UK government’s Cyber Security Breaches Survey 2025/2026, 43% of businesses reported a breach or attack in the previous 12 months, and phishing was by far the most common type, reported by 38% of businesses. In the US, the FBI’s Internet Crime Complaint Center recorded more than 24,000 complaints about business email compromise in 2025, with reported losses of about $3 billion, according to its 2025 Internet Crime Report. Our guide to the scams aimed at small firms shows how to recognize these messages by email, text, phone, and QR code, and where to report them in each country.

Prepare for the day something goes wrong

Even careful people get caught. What matters then is speed and order: which password to change first, which sessions to close, which bank to call, and which authority to tell. A breach alert from a service you use, or a message saying your email “was found on the dark web,” calls for a different response than an account that has actually been taken over.

Our guide on what to do after a hack or a breach alert explains what these alerts mean, how to recover a hacked Google, Microsoft, or social media account, and the first steps after identity theft, country by country. Before anything happens, the most useful preparation is simple: make sure the recovery email and phone number in your inventory are current, and keep the backup codes your accounts offer somewhere safe and offline.

Bring the whole team along

A small team multiplies the accounts and the ways in. Each person has a mailbox, shared folders, and probably a few logins that nobody else knows about. The same five steps apply to each of them, plus a few that only exist in a team: turning on the security settings of Microsoft 365 or Google Workspace for everyone, sharing logins without sending passwords by email, and closing every access on the day someone leaves.

Free government guidance helps here, and it differs by country: Cyber Essentials in the UK, the baseline cyber security controls for small and medium organizations published by the Canadian Centre for Cyber Security, the Essential Eight and its successor, ASD Essentials, in Australia, and the resources of CISA and the FTC in the US. Our guide to protecting a small team’s logins compares them and turns them into a checklist for teams of two to 20.

What to do this week

Start small and start with the account that matters most:

1. Fill in the first row of the inventory: your main email account.
2. Give that account a long password that you use nowhere else.
3. Turn on its second factor, and check its recovery email and phone number.
4. Choose a password manager, then move your other accounts into it, starting with the domain registrar, the accounting software, and the cloud storage.

One national difference matters here. The UK’s NCSC considers it safe to save passwords in a password manager, including the one in your browser on your own devices, and CISA in the US advises giving every employee one. The Canadian Centre for Cyber Security, by contrast, advises against storing the passwords of sensitive accounts such as banking and email in a password manager. If you follow the Canadian advice, those two passwords stay in your head, and they should be long, unique, and protected by a second factor.

The rest of this series follows the same order. Each guide states which countries it applies to and when its facts were last checked, and it says what we could not verify.