The accounts to protect first: email, domain, bank
Turn on two-factor authentication first on the accounts that can reset or control the others: your main email account, your password manager, and your domain registrar. Then protect the accounts that hold money, customer data, and your public reputation. A small business can usually cover the first five in one afternoon.
Which accounts to protect with two-factor authentication first
Start with the accounts that unlock other accounts, then move to the ones that hold money and data. In practice: your main email account, then your password manager, your domain registrar, your mobile phone account, and your bank, followed by accounting, cloud storage, your website, and social media. This order turns the advice on adding a second factor into a to-do list. It also matches the list of important accounts in the NCSC’s guide for small organizations, which names, among others, banking and finance, HR and payroll, social media, online storage, and your website and domain hosting.
The logic is simple. An attacker who gets into your email can reset your other passwords one by one; an attacker who gets into your domain registrar can redirect your website and your email addresses.
The priority list
| Order | Account | Why it comes here | What to turn on |
|---|---|---|---|
| 1 | Main email (Google Workspace, Microsoft 365, or personal) | Password resets for other accounts arrive here | A passkey or an authenticator app; check the recovery email and phone |
| 2 | Password manager | It holds every other password | A strong master password and a second factor |
| 3 | Domain registrar and DNS host | It controls your website and your email addresses | A second factor and a domain lock |
| 4 | Mobile phone account | It controls the number that receives text codes | A PIN or password on the account, if your carrier offers one |
| 5 | Bank and payment services | Money moves from here | The bank’s own authentication, plus alerts |
| 6 | Accounting, invoicing, and payroll | Customer, employee, and tax data | A second factor for every user |
| 7 | Cloud storage | Contracts, client files, backups | A second factor; review shared links |
| 8 | Website or online store admin | What customers see and pay for | A second factor for every administrator |
| 9 | Social media business pages | Your public reputation | A second factor for every admin, and at least two admins |
Your main email account
Everything starts here. The NCSC’s advice on email passwords puts it plainly: someone with access to your email can reset all your other account passwords. Give the account a password used nowhere else, turn on its strongest second factor, and check that the recovery email and phone number are yours and current. If you use Google Workspace or Microsoft 365, do this first for the administrator account.
Your domain registrar
The company where you registered your domain name controls where your website and email point. ICANN, which coordinates domain names, warns that a hijacker who takes over your registrar account will likely change the registration details to remove you as the holder. It recommends multistep authentication where the registrar offers it, and a contact email address outside the domain itself, so that you still receive warnings if the domain is taken.
Ask your registrar to apply a lock. ICANN describes statuses that block transfers, deletions, and updates (clientTransferProhibited, clientDeleteProhibited, and clientUpdateProhibited), and some registries offer a stronger Registry Lock through your registrar. ICANN also says a lock is useful but not a fail-safe, which is why the second factor matters.
Your mobile phone account
If any of your accounts still sends codes by text message, the security of your phone number becomes part of your account security. Ask your carrier whether it offers a PIN or password for changes to your account and for moving your number, and turn it on. Then, wherever you can, replace text message codes with an authenticator app or a passkey.
Your bank
In the UK, banks and payment providers have had to apply strong customer authentication to online payments and account access since September 14, 2019, according to the Financial Conduct Authority; in the EU, the same rules apply to online payments above €30, with exemptions. In other countries, check what your bank offers and turn on the strongest option, plus alerts for new payees and large transfers. A second factor does not stop a fake invoice, so confirm any change of bank details by phone.
The rest of the list
Accounting, payroll, cloud storage, your website, and social media pages follow the same pattern: a second factor for every person with access, at least two administrators so that one lost phone does not lock the business out, and a review of who still has access.
Choosing the method for each account
Not every account supports every method. Our guide to picking between text codes, an app, and a key helps you choose the strongest option each account allows.
Before you lock everything down
Every second factor you add is one more thing to lose. Read how to keep access when you change or lose your phone before you finish the list.