Your business uses MFA. But are you using it on the right accounts?

Multi-factor authentication (MFA) is one of the simplest ways to make your business accounts harder to break into. You probably already know that. You may even have MFA enabled on several of the tools you use every day.

But there’s another question worth asking: Is MFA protecting the accounts that matter most?

For a small business, MFA should protect the accounts that could cause the most damage if someone else got into them.

Here’s where to start.

Key takeaways

• MFA should protect your most important business accounts first, including email, financial, administrator and cloud accounts.
• Accounts that can reset passwords or provide access to other systems deserve particularly strong protection.
• Ideally, everyone who accesses business systems should use MFA, not just owners and administrators.
• Strong passwords, protected devices, phishing awareness and broader security tools should work alongside MFA.

What does MFA actually protect your business from?

MFA adds another step when you log in. Instead of relying only on a password, you also need to prove that you are really you, for example by approving a notification, entering a code, using an authenticator app or signing in with a security key or passkey.

That extra step matters because passwords get stolen all the time. You or an employee could enter one on a phishing site, reuse a password that later appears in a data breach, or unknowingly have credentials stolen by malware. If a criminal has your password but can’t complete the second authentication step, they may not be able to access the account.

MFA isn't foolproof. Criminals have developed ways to get around some forms of it, including phishing attacks designed to steal authentication codes and MFA fatigue attacks that bombard people with login approval requests until someone accepts one.

But it still creates an important additional barrier between a stolen password and your business accounts.

Why having MFA isn't enough if it's protecting the wrong accounts

It’s likely that your business uses ten or twenty different online services. You might have MFA on Instagram or your project management tool, while one employee has enabled it for their Microsoft account.

Technically, you can say that your business “uses MFA.”

But your main business email doesn't have it. Neither does the account that manages your website domain. Your accountant logs in with a password alone, and the Microsoft 365 administrator account hasn't been reviewed since you set it up three years ago.

Not all business accounts carry the same risk. If someone takes over the business email you use to reset passwords for ten other services, the consequences could be very serious.

When deciding where MFA matters most, think about what an attacker could do with the account rather than how often you use it.

Which business accounts should always have MFA?

Ideally, MFA should be enabled wherever it is available. But if you run a small business and don't know where to start, protect the accounts that control your email, money, data and other accounts first.

1. Your business email accounts

Business email should be near the top of your MFA list, especially the owner's account and accounts belonging to employees who handle payments, invoices or sensitive information. A compromised inbox can give an attacker access to customer conversations, invoices, attachments and internal information. It can also allow them to impersonate you or an employee.

2. Microsoft 365 or Google Workspace administrator accounts

Administrator accounts deserve special attention because they can have far more control than an ordinary employee account. Depending on how your business is set up, an administrator may be able to create or remove users, reset passwords, change permissions and access other parts of your business environment.

3. Banking, payment, payroll and accounting accounts

Any account that can move money or change where money goes should be considered high priority. That includes online banking, accounting platforms, payment processors and payroll systems.

Criminals targeting businesses aren't always looking for files or passwords. Sometimes the goal is much simpler: change payment details, redirect a transfer or steal money.

4. Cloud storage and file-sharing accounts

Think about what's sitting in your Google Drive, OneDrive, Dropbox or other cloud storage.

For many very small businesses, cloud storage has quietly become the filing cabinet for almost everything they do: contracts, invoices, customer information, employee documents, business plans, tax records, copies of IDs.

5. Your website, hosting and domain registrar

If an attacker gains access to your domain registrar, hosting account, website administrator account or DNS settings, they may be able to interfere with your website, redirect visitors, change content or use your business identity for scams.

6. Social media and advertising accounts

Facebook, Instagram, LinkedIn and other social accounts may be an important part of how customers find and communicate with your business.

Losing access can mean losing an audience you've spent years building. A hijacked account could also be used to scam your customers while appearing to speak on behalf of your company. Advertising accounts deserve particular attention because they may also have payment methods attached.

7. CRM and customer databases

If your business uses a CRM or another platform to store customer information, protect it with MFA. Even a small customer database can contain names, email addresses, phone numbers, conversations, sales information and other data that shouldn't fall into someone else's hands.

8. Remote access, VPN and security accounts

Finally, pay particular attention to accounts that provide access to other systems, devices or security settings.

That could include remote desktop services, business VPNs, endpoint security dashboards and other tools used to manage your business technology.

Don't forget the accounts that can reset other accounts

There is a simple question you can use when deciding which accounts deserve the strongest protection: If someone got into this account, what else could they get into?

Your main email account is an obvious example because password-reset messages for other services often arrive there.

But the same thinking applies to administrator accounts, identity providers, password managers and accounts used as recovery methods for other services.

These are sometimes described as the “keys to the kingdom.” For a very small business, you may have only two or three of them. Find out what they are and protect them first.

Who in your business needs MFA?

Don't focus only on the owner. Attackers don't necessarily target the person with the most access; they may simply look for the easiest account to compromise.

Ideally, everyone who accesses business systems should use MFA, with particular attention to:

• Owners and administrators
• Employees handling payments, payroll or invoices
• Anyone with access to sensitive customer or employee data
• People who can change permissions or security settings

And don't forget former employees. Remove accounts and access as soon as someone leaves the business.

What is the best type of MFA for a small business?

Yes. Not all MFA methods offer the same level of protection.

SMS codes are convenient and widely supported, but they can be vulnerable to attacks such as SIM swapping and phishing. Authentication apps generally offer stronger protection than SMS, while security keys and passkeys can provide stronger protection against phishing when supported by the service.

For your most sensitive accounts, choose the strongest MFA option the service supports and that your business can realistically manage.

But don't let the search for the “perfect” method stop you from enabling MFA at all.

How to check whether your business has MFA gaps

Start with the accounts where a compromise could affect your money, communications, customers, data or access to other systems. Then work your way through the rest.

What else should you do besides enabling MFA?

MFA is important, but it shouldn't have to carry your entire business security strategy. Even with MFA enabled, employees can still encounter phishing, malware, malicious links and scams, and a compromised device can put business accounts and data at risk.

Alongside MFA, make sure you:

• Use unique passwords for every business account. Store them in a password manager instead of reusing passwords or sharing them through email or chat.
• Remove accounts and access you no longer need. Former employees, old administrator accounts and unused services can become security gaps if nobody is paying attention to them.
• Limit administrator privileges. Employees shouldn't have more access than they need to do their jobs.
• Keep recovery information up to date. Check the email addresses, phone numbers and recovery methods connected to your most important accounts.
• Pay attention to login and security alerts. An unexpected password reset, new device or login attempt deserves investigation.
• Teach employees not to approve unexpected MFA requests. If someone receives an authentication prompt they didn't trigger, they should treat it as a warning sign.
• Protect the devices employees use to access business accounts. MFA protects the login, but it doesn't replace protection against malware, phishing, scams and other threats that can reach employees before or after they sign in.

Bitdefender Ultimate Small Business Security complements the protection MFA provides by helping secure the devices and online activity your team uses to access those accounts. It protects your team's devices, provides a VPN for more secure remote work, offers AI-powered scam and email phishing protection, helps manage strong and unique passwords across platforms, and adds protection against credit card fraud.

Try Bitdefender Ultimate Small Business Security free for 30 days. No credit card required.

You may also want to read:

• The first 5 cybersecurity measures every small business should take
• How to Prevent or Recover from A Business Email Compromise (BEC) Attack
• What's the best cybersecurity solution for a small business?
• Can your small business be hacked without you knowing?

FAQs

Does a small business really need MFA?

Yes. Small businesses rely on email, cloud services, banking, accounting platforms and other online accounts that can expose sensitive information or give attackers access to other systems if compromised. MFA adds another layer of protection when a password is stolen or exposed.

Which business accounts should have MFA first?

Start with business email, administrator accounts, banking and payment services, accounting and payroll platforms, cloud storage, and any account that can reset passwords or provide access to other business systems.

Should every employee use MFA?

Ideally, yes. Don't limit MFA to the business owner or administrators. Employees with access to email, customer data, financial information or other business systems can also be targeted, and attackers may deliberately look for the easiest account to compromise.

Is SMS MFA safe enough for a small business?

SMS MFA is generally better than protecting an account with a password alone, but stronger methods are available. For sensitive business accounts, consider authenticator apps, security keys or passkeys when the service supports them.

Can hackers still get into an account with MFA enabled?

Yes. MFA significantly strengthens account security, but it isn't foolproof. Phishing, MFA fatigue, stolen session cookies, malware and compromised devices can sometimes allow attackers to bypass or work around MFA. That's why MFA should be one part of a broader business security strategy.

What should I do if an employee receives an MFA request they didn't initiate?

They should not approve it. An unexpected MFA request could mean someone already has the account password and is trying to log in. The employee should report it, change the account password and review recent login activity for anything suspicious.