Give Your Business Email a Second Lock

Imagine opening the shop on Monday and finding that the email account used for orders has been locked. A customer cannot get a reply, a supplier's message is missing, and the password reset link for another business tool goes to an inbox you can no longer reach. It is a miserable way to start the week, and one ordinary password may be all an intruder needed.

Business email often sits at the center of daily work. Staff use it to talk with customers and vendors, and other services use it to send sign-in links or reset passwords. That makes it worth protecting separately from a low-stakes account. The good news is that you do not need an IT department to make a useful start.

Add a second check at sign-in

Turn on multifactor authentication, often shortened to MFA, for the business email account. MFA asks for another proof of identity after the password, such as a code from an authenticator app, a security key, or an approval prompt on a trusted device. The exact options depend on your email provider. CISA recommends MFA as an extra layer for business accounts.

A password can be stolen, reused from another service, or guessed. A second step makes it harder for someone to sign in with the password alone. It is not a magic shield, and some methods are safer than others, but enabling the strongest option your provider and team can reasonably use is a solid move.

Start with the owner or administrator account, then cover the inboxes used for money, customer records, and password resets. If the provider offers security keys or an authenticator app, compare those with text-message codes and choose an option the team can keep using. A security step that nobody can access during a busy shift tends to get switched off, so plan for recovery before you need it.

Keep the backup route under your control

During setup, email services often ask for a recovery phone number, another email address, or backup codes. Those details are the spare key to the account. Use a business-controlled recovery address when possible, keep the phone number current, and store backup codes somewhere secure that the owner can reach if a phone is lost. Do not leave the only copy in the very inbox you are trying to protect.

Decide who can reach the recovery information and what to do if that person is away. For a tiny team, that might mean one owner and one trusted backup person. For a larger shop, write the steps down in a secure password manager or another approved place. Avoid putting recovery codes on a sticky note by the register. It is convenient, right up until it is not.

When someone changes roles or leaves, remove their access and update recovery arrangements if they had a role in managing the account. Keep the main business inbox tied to a role, such as orders@ or hello@, rather than to one person's personal account when your provider supports that setup. That makes a handoff less dependent on someone's private phone or personal inbox.

Give every account its own password

Use a long, unique password for business email. Reusing the same password across several sites creates a chain: if one unrelated site is breached, attackers may try that password on your email next. A password manager can create and remember different passwords, so staff do not have to rely on memory or a notebook hidden under the keyboard.

For shared work, avoid passing one password around a group chat. Ask the email provider whether it supports separate user accounts, delegated inbox access, or team mailboxes. Individual logins make it easier to remove one person's access without changing the password for everyone else. They also help the owner understand who can see the inbox.

Make unusual requests wait for a human

Good sign-in protection helps, but it does not decide whether a message is honest. A fake email can look familiar, and a real account can be taken over. Treat sudden requests for passwords, gift cards, account changes, or urgent payments as a reason to pause, especially when the message asks you to skip the usual steps.

If a vendor says its bank details changed, do not reply to the message to confirm. Call the vendor using a number already saved in your records or printed on a previous statement. FBI guidance on business email compromise recommends verifying through a known business phone number rather than a number supplied in the email. The same habit works when a manager appears to request a sensitive change. Use the contact route you already trust.

Make this a normal rule, not a judgment about whether the sender sounds convincing. A short call may feel awkward when someone says a payment is urgent. Losing money because a stranger wrote that they sent the message from their phone is more awkward.

Teach the team what to do when something feels off

Staff do not need to become security experts. They do need a clear way to ask for help. Tell everyone where to report a strange sign-in alert or message, and make it clear that asking before clicking is welcome. If a message claims an account will close in ten minutes, go to the service by typing its known web address or using a saved bookmark. Do not use a link in a message you are unsure about.

It helps to agree on a few simple habits:

• Use MFA and a unique password for the business email account.
• Confirm payment or account changes through a known phone number.
• Report unexpected sign-in alerts promptly, even if you did not click anything.
• Keep recovery details current and limit who can use them.

Keep the rule easy to follow on an ordinary Tuesday, not only during a training session. Put the verification phone number in the vendor record before there is a problem. Show staff how to report suspicious messages. When a new employee gets access, include sign-in and recovery basics in their first-week checklist.

If you think someone got in

Act quickly, but use a device you believe is safe. Contact the email provider through its official support route, change the password, review recovery methods, and sign out other sessions if the provider offers that option. Check for unfamiliar forwarding rules, automatic filters, or new users. Attackers sometimes change settings so copies of future messages go somewhere else.

Then review services that use that email address to reset passwords, especially accounts that handle money or customer information. If payment details may have changed, contact the bank and affected vendors through known numbers. Keep a short record of what happened and when. If customer or employee information may have been exposed, follow the provider's instructions and the reporting rules that apply to your business.

Do not wait for a perfect security plan. Turn on MFA for the most important inbox, confirm its recovery path, and tell the team how to verify a surprising request. Those are manageable steps that can make a stolen password less useful and a convincing message less likely to hurry money out the door.