Most business accounts don't get broken into by someone cleverly guessing a password. They get broken into because a password that was already floating around from some unrelated breach — a forum, an old app, a shopping site — still works, because it's the same one you used for your email, your hosting, your payment processor. One password reused in enough places is really just one lock on every door you own.
Two-factor authentication is the fix for that exact problem, and it's one of the few security habits that's both free and genuinely effective. It's also one of the most commonly skipped, usually because it sounds like a hassle before you've actually turned it on.
Here's what it actually does, where to turn it on first, and where it still isn't enough on its own.
What It Actually Is
Two-factor authentication (2FA) means logging in takes two things instead of one: your password, plus a second proof that it's really you — a code from an app, a tap on your phone, or a physical key. If someone else has your password but not that second thing, they're stopped at the door.
The three common forms
- Authenticator app (Google Authenticator, Authy, or similar) — generates a fresh 6-digit code every 30 seconds, works offline, tied to your phone specifically.
- SMS code — a text message with a code each time you log in. Better than nothing, but the weakest of the three (more on that below).
- Security key — a physical USB or NFC key you tap or plug in. The strongest option, but most small business owners won't need to go this far unless they're handling something particularly sensitive.
For almost every small business, an authenticator app is the right default — stronger than SMS, and no extra hardware to buy or lose.
Where to Turn It On First
You don't need to do this everywhere at once. Start with the accounts that, if lost, would take everything else down with them:
- Your email — almost every other account resets its password through email. This is the one account that protects all the others.
- Your domain registrar — whoever you bought your domain name from. Losing this means someone can point your domain anywhere they want.
- Your hosting account — where your website's files actually live.
- Payment and banking logins — anywhere money moves.
- Your business's social media pages — Facebook, Instagram, anywhere customers reach you directly.
If you only do one thing from this list today, do your email. Everything else resets through it.
Where It Still Falls Short
2FA is a real improvement, not a magic fix, and it's worth knowing honestly where its limits are.
SMS can be hijacked. A "SIM swap" scam tricks your mobile carrier into moving your number to an attacker's phone, which hands them your text codes too. It's not common, but it's the reason an authenticator app is the better default wherever a site offers the choice.
It doesn't stop every kind of phishing. A convincing fake login page can capture your code the moment you type it in, same as it captures your password. 2FA stops the far more common case — a stolen or reused password used on its own — but it's not a reason to stop checking that a login page is actually the real one.
Losing your phone can lock you out. This is the part that scares people off the most, and it's a fair concern. The fix is simple: every service that offers 2FA also gives you a set of one-time backup codes when you turn it on. Save them somewhere durable — a password manager, or written down somewhere physical — before you need them, not after.
What This Actually Comes Down To
None of this needs to happen in one sitting. Turn it on for your email today, add the next account tomorrow, and you've closed off the single most common way business accounts actually get taken over — not a dramatic hack, just one old reused password finally getting used against you. The backup codes are the part people skip and regret; save them the same day you turn 2FA on, not the day you lose your phone.
Closing
A password alone was never meant to be the only thing standing between your business and whoever finds it in a breach list somewhere. Two-factor authentication is free, takes a few minutes per account, and closes off the most common way in. It's one of the few security habits that's actually this simple.
If you're not sure which of your business accounts still only have a password protecting them, that's the part I can help with.