If you could do one thing this week that would block over 99% of automated attempts to break into your business accounts, would you do it? Microsoft has found that simply turning on multi-factor authentication (MFA) — the prompt that asks for a code after you enter your password — stops the vast majority of automated account attacks. It costs nothing, takes a few minutes per account, and it is the single biggest security upgrade most small businesses have not finished yet.
What Is MFA, in Plain English?
When you log in to a bank account and the bank texts you a code before letting you in, that is multi-factor authentication. “Factors” are just the different ways you prove you are who you say you are:
- Something you know — your password.
- Something you have — your phone, with an authenticator app or texted code.
- Something you are — a fingerprint or face scan.
A password alone is one factor. MFA means requiring at least two. So even if a criminal steals or guesses your password — from a phishing email, a data breach, or a reused password on another site — they still cannot get in, because they do not have your phone.
Why Hackers Count on Businesses Skipping It
Most attacks on small businesses are not master hackers hand-picking targets. They are automated bots trying stolen passwords against thousands of email and bank logins per hour. The credentials come from the endless stream of data breaches, and from phishing emails like the ones we covered in a recent post. One factor — a password — is all those bots can handle. A second factor stops them cold.
Small businesses are the favorite target for exactly this reason: the owners assume attackers only go after big companies, so MFA stays off. According to multiple industry surveys, a large share of small business breaches start with a compromised login. That is not a coincidence — it is a business model.
Turning It On: Start With These Four
You do not have to secure everything in one sitting. Start with the accounts that would hurt most if an attacker got in:
- Your business email (Microsoft 365 or Google Workspace). This is priority number one — email is the master key that resets passwords for nearly everything else.
- Your bank and financial accounts. Most banks and payment processors offer MFA in their security settings.
- Your social media and website logins. A hijacked Facebook business page or website can take days to recover.
- Your remote access tools. If staff log in from home or on the road, those logins need a second factor too.
For the method, authenticator apps (like Microsoft Authenticator or Google Authenticator) are the best balance of convenience and security. Texted codes work too — they are far better than no MFA at all — though apps are harder for attackers to intercept. Turn on biometrics (fingerprint or face) on your phone itself while you are at it, since your phone is now one of your security keys.
The Two Objections Every Owner Raises
“My staff will hate the extra step.” They will notice it for about a week. Most services now offer “remember this device” options, so the second prompt only appears on new sign-ins — roughly as annoying as a bank login. Compare that to explaining to customers that their information was stolen. Frame it that way once, and the grumbling stops.
“We are too small to matter.” That is precisely why attackers love small businesses: easier targets, less monitoring, and real money in the accounts. You do not need to be interesting to be profitable for a bot.
A 15-Minute Action Plan
- Log in to your business email’s admin settings and enable MFA for every user — administrators first.
- Have each employee install an authenticator app and enroll their account.
- Walk through your bank, social media, and website logins and switch MFA on there.
- Make it policy: no new business account gets set up without MFA on day one.
If this sounds like one more thing on an already full plate, you do not have to do it alone. West Main Tech helps Frederick County small businesses tighten up their security — including rolling out MFA across email, banking, and remote access — so you can get back to running your business. Call us at (240) 490-9703 for a quick conversation about where to start.
Your password is no longer enough. The good news is that the fix is free, fast, and one of the most effective things you can do.