Many cyber incidents affecting small businesses don’t start with sophisticated hacking. They start with a reused password, a phishing email or an account without extra protection. The good news is that two simple habits, using multi-factor authentication and a password manager, block a large share of these attacks.
This guide explains both in plain terms and shows where to start.
What multi-factor authentication is
Multi-factor authentication (MFA), sometimes called two-factor authentication, means proving who you are in more than one way when you log in. Usually that is something you know, like a password, plus something you have, like a code from an app on your phone or a physical security key.
If a scammer steals or guesses your password, they still can’t get in without the second factor. The Australian Signals Directorate’s Australian Cyber Security Centre recommends turning on MFA wherever it is available.
Types of MFA, from strongest to weakest
- Security keys and passkeys: very resistant to phishing.
- Authenticator apps: an app on your phone that generates codes or approves logins.
- SMS codes: better than nothing, but more vulnerable to interception and SIM-swap scams.
Use the strongest option each service offers.
Where to turn it on first
Start with the accounts that would hurt most if someone took them over:
- Email, because it is used to reset every other password.
- Banking and payment accounts.
- Accounting software and payroll.
- Your website, hosting and domain accounts. See what to do if your website is hacked.
- Social media accounts, including Meta Business Suite.
- Cloud storage and any tool holding customer information.
Why a password manager helps
Most people reuse passwords because remembering dozens of unique ones is impossible. The problem is that when one website is breached, attackers try the same email and password on other services.
A password manager creates and stores a strong, unique password for every account. You only need to remember one strong master passphrase, protected with MFA. Many password managers also let teams share access to business accounts securely, without sending passwords by email or text.
Use passphrases where you need to remember one
For the few passwords you do need to remember, such as your password manager and computer login, the ACSC recommends passphrases: several random words strung together. They are long, which makes them hard to crack, and easier to remember than a jumble of symbols.
Set up your team properly
- Give each person their own login rather than sharing one account.
- Only give people access to what they need.
- Remove access promptly when staff or contractors leave.
- Keep at least two trusted people able to access critical accounts, so you aren’t locked out if one person is unavailable.
- Store backup and recovery codes somewhere safe.
Watch for MFA fatigue and phishing
Some scammers bombard people with login approval requests, hoping they will tap “approve” to make them stop. Never approve a login you didn’t start. If you receive unexpected requests, change your password straight away.
Be careful with links in emails and texts asking you to log in. Go to the website directly instead. Our guide to business email setup covers settings that make your domain harder to impersonate.
A 30-minute starting plan
- Turn on MFA for your main email account.
- Do the same for banking and accounting.
- Choose a reputable password manager and set it up with a strong passphrase.
- Change your most reused password first, then work through the rest over the following weeks.
Want help securing your accounts?
Madexify helps small businesses across Pakenham, Officer, Beaconsfield, Berwick, Narre Warren, Cranbourne, Clyde and Bunyip secure their website, hosting, domain and email accounts. See our web design and development services, or contact us to talk about website security.
Sources: Cyber.gov.au: multi-factor authentication; Cyber.gov.au: passphrases. Accessed 26 September 2026.
This article is part of our Website Security and Tech Guide. Browse all our guides on the guides page.
