Business 2FA / MFA: Stop Account Takeovers

Why MFA matters for businesses

Passwords leak from phishing, reused credentials, malware, and old breaches. With only a password, an attacker who gets into the owner’s email can reset banking, change vendor ACH details, and approve their own invoices. MFA adds a second proof — something you have or are — so a stolen password alone is not enough.

For companies, MFA is not optional “IT hygiene.” It is payment controls. Pair it with business email compromise defenses and HTTPS / secure servers.

Which MFA methods are strong

• Best: Hardware security keys (FIDO2 / passkeys) for owners, finance, and admins.
• Strong & practical: Authenticator apps (TOTP) or push approvals from a managed identity provider.
• Acceptable backup: SMS or voice codes — better than nothing, weaker against SIM-swap. See SIM swap scams.
• Avoid as primary: Email OTP to the same mailbox you are trying to protect, or “security questions.”

What to protect first

1. 1
   Business email & Microsoft 365 / Google Workspace admin.
2. 2
   Banking, payment processors, payroll, and accounting software.
3. 3
   Domain registrar, DNS, hosting, and website CMS admin.
4. 4
   CRM, ecommerce admin, POS cloud, and remote-access tools.
5. 5
   Every employee account that can read email or approve spend.

Rollout checklist

• Pick one authenticator standard (or company SSO) and document it for onboarding.
• Store recovery codes in a sealed offline vault / password manager shared vault with dual control.
• Require MFA enrollment before the first day of email access for new hires.
• Remove shared “front desk” logins; give named accounts instead.
• Review MFA coverage quarterly — list accounts without it and fix within 7 days.
• Train staff that unexpected MFA prompts mean someone has your password — deny and report.

Common mistakes

• Enabling MFA for staff but not the owner or bookkeeper.
• Keeping a permanent MFA bypass “for convenience.”
• Saving recovery codes in the same inbox attackers will open.
• Using one shared authenticator phone that leaves with a departing employee.
• Ignoring legacy apps that only allow basic auth — retire or wrap them with SSO.

If an account is already compromised

1. From a clean device, change the password and rotate MFA.
2. Sign out all sessions; review forwarding rules, app passwords, and OAuth grants.
3. Notify finance — treat recent payment-change emails as hostile until verified.
4. Alert your bank, payroll provider, and key vendors.
5. Follow what to do if you’ve been scammed if money moved.

FAQ