If I could get every small business owner to do one security thing, it wouldn’t be a firewall or a fancy password. It’d be this:
Turn on two-factor authentication on your email.
Your email is the master key. Every other account — your bank, your invoicing, your Google listing, your social pages — resets its password through your inbox. Whoever controls your email controls all of it.
And it’s the account most people protect the least, usually with a password they’ve used somewhere else.
Two-factor means a stolen password isn’t enough. They’d also need your phone. That one step stops most of the account takeovers I come across.
It takes five minutes. Settings, security, two-step verification, follow the prompts. Use an authenticator app if it offers one; text message is fine if that’s the only option.
Then do the same for your bank.
Is it on right now? Not “I think so” — go look.