A second login factor is the only safeguard that still works after a password has leaked. And passwords do leak — not from your company, but from services where employees signed up with the same address and the same password.
Three places to start
- E-mail. The mailbox is the key to everything else — it is where passwords to other services get reset. A compromised mailbox is also the starting point for invoice fraud.
- Banking. Usually already covered, but check that confirmation does not arrive on the very phone the app runs on.
- Admin panels and remote access. Anything that lets someone into the company from outside.
Not every second factor is equally good
An SMS code is better than nothing, but it can be intercepted or talked out of you — the fraudster calls „from the bank” and asks you to read the code out. An authenticator app is clearly safer and needs no signal. Hardware keys are strongest, but in a small company an app is usually enough.
What not to do
Do not enable a second factor on an account whose recovery codes you have not saved. Phones get lost, reset and change owners — and an account without recovery codes can disappear with them. Print the recovery codes and keep them where you keep company documents, not in a file on the desktop.
What about the staff
Most resistance comes from surprise, not from the inconvenience itself. Warn people, show them on one account how it looks, and do it on a calm day — not on Friday afternoon when orders still have to go out.