Two-factor authentication for small business: a practical setup guide

We earn a commission if you buy through some links on this page, at no extra cost to you. It never affects the order. How we make money.

Two-factor authentication (2FA) adds a second check when someone logs in, such as a code from an app, a security key or a passkey, so a stolen password alone is not enough to break into an account. It is one of the most effective and cheapest ways to protect a small business from account takeovers, invoice fraud and data breaches. This guide explains the different methods, which accounts to protect first, how to roll it out across a team, and how to handle lost phones and recovery codes.

Why passwords alone are not enough

Passwords are stolen through phishing emails, data breaches at other websites, malware, and guessing. Once attackers have a password, they can read email, reset other passwords, send fake invoices to customers, change bank details or lock you out of your own accounts. Two-factor authentication stops most of these attacks, because the attacker also needs the second factor, which is usually a device in your possession.

The main types of second factor

• SMS codes: a code sent by text message. Easy to use, but vulnerable to SIM swap attacks and interception. Better than nothing.
• Authenticator apps: apps that generate time-based codes on your phone. More secure than SMS and widely supported.
• Push notifications: approve a login with a tap in an app. Convenient, but watch for "push fatigue" attacks where attackers send repeated prompts.
• Security keys: physical keys you plug in or tap. Very strong and resistant to phishing.
• Passkeys: cryptographic credentials stored on your devices or password manager, replacing passwords and resisting phishing.

Phishing-resistant methods

Codes from SMS and authenticator apps can still be phished: a fake login page asks for the code and passes it to the real site in real time. Security keys and passkeys resist this, because they check the website's real address before responding. For high-value accounts, such as email administrators, finance staff and domain owners, consider security keys or passkeys. For everyone else, authenticator apps are a strong, practical default.

Which accounts to protect first

1. Email, because it can reset almost every other password.
2. Banking, payment and payroll accounts.
3. Accounting software and expense platforms.
4. Domain registrar and DNS, since losing these takes down website and email.
5. Website admin and hosting.
6. Cloud storage and file sharing.
7. Password manager.
8. Social media accounts representing your brand.
9. CRM, help desk and other systems holding customer data.

Turning on 2FA for your whole team

Most business platforms let administrators require 2FA for all users. In email and productivity suites, enforce 2FA in the admin console, give staff a grace period to enrol, and choose allowed methods, such as authenticator apps and security keys but not SMS. In other tools, check security settings for an organisation-wide requirement. Where enforcement is not available, include 2FA in onboarding checklists and verify it is on.

Authenticator apps

Authenticator apps generate a new six-digit code every 30 seconds. To set one up, scan a QR code shown by the website, then enter the code to confirm. Many password managers can also generate these codes, which is convenient; some businesses prefer a separate app for the most critical accounts so that the password and second factor are not in the same place. Back up authenticator accounts or keep recovery codes, so a lost phone does not lock you out.

Security keys and passkeys

Security keys are small USB or NFC devices. Register at least two per person, keeping one as a backup, because losing your only key can lock you out. Passkeys are increasingly supported by major services; they let staff log in with a fingerprint, face or device PIN, with the passkey stored on the device or in a password manager. Passkeys reduce both password reuse and phishing. See password managers for small business for managing passkeys across a team.

Recovery codes

When you enable 2FA, most services provide one-time recovery codes for when you lose your second factor. Store them securely, such as in your password manager's secure notes or printed in a locked place. Never store them in plain email or unprotected documents. For shared business accounts, make sure more than one trusted person can recover access.

Lost phones and staff changes

Plan for lost or replaced phones: administrators should be able to reset 2FA for staff after verifying identity, and staff should know whom to contact. When staff leave, remove their accounts or reset shared credentials and 2FA. When staff get new phones, they should move authenticator accounts before wiping the old phone. A short written procedure prevents panic and risky shortcuts.

Shared accounts and 2FA

Some accounts are shared, such as a social media login or a supplier portal. 2FA on shared accounts is awkward if codes go to one person's phone. Options include using the platform's multi-user features instead of sharing, storing the authenticator secret in a shared password manager vault, or using a shared security key kept securely. Avoid turning off 2FA for convenience; shared accounts are attractive targets.

Watching for 2FA attacks

• Repeated login prompts you did not trigger: deny them and change your password immediately.
• Calls or messages asking for your code: legitimate services never ask for 2FA codes.
• Sudden loss of mobile service: could indicate a SIM swap; contact your carrier and check accounts.
• Fake login pages asking for passwords and codes: check the web address carefully.

Train staff on these signs. See how to prevent invoice fraud for how attackers use compromised accounts.

2FA and email security together

Email is the hub of account recovery and business communication, so protect it with 2FA, strong unique passwords and email authentication records that prevent others from spoofing your domain. See email deliverability: SPF, DKIM and DMARC. Alerts for new logins and forwarding rules help detect compromise early.

Costs

2FA itself is usually free: authenticator apps and SMS codes cost nothing, and major platforms include enforcement in business plans. Security keys cost a modest amount each, with two per person recommended for critical staff. Password managers that store 2FA codes and passkeys are priced per user; see the password managers ranking. Compared with the cost of an account takeover, 2FA is one of the best-value security measures available.

Common mistakes

• Enabling 2FA on some accounts but not email or the domain registrar.
• Relying only on SMS for critical accounts.
• No recovery codes stored, leading to lockouts.
• Only one security key with no backup.
• Turning off 2FA on shared accounts for convenience.
• Approving login prompts without checking.

Example: an accounting firm after a phishing attempt

A staff member at a small accounting firm entered her email password on a fake login page. Because the firm had enforced two-factor authentication with an authenticator app, the attacker could not log in without the code. She received an unexpected sign-in alert, reported it, and changed her password. The firm then moved its partners and finance staff to security keys, which would have blocked even the fake page, and ran a short training session on recognising phishing.

Example: an online shop owner

An online shop owner turned on two-factor authentication for her store platform, payment gateway, email and domain registrar after hearing of a competitor whose store was hijacked. She used an authenticator app, saved recovery codes in her password manager, and added a second admin with 2FA so the business was not dependent on her phone alone. When her phone was later stolen, she used recovery codes to regain access and moved her authenticator to a new phone within an hour. See the cost to start an online store.

2FA for payment and banking accounts

Banks and payment providers often require their own 2FA, such as app approvals or hardware tokens. Make sure more than one authorised person can approve payments, so the business can operate when someone is away, and combine 2FA with payment approval controls. Payment gateways and business accounts should all have 2FA enabled; compare providers in the business accounts ranking and payment gateways ranking.

A rollout plan for a small team

1. List critical accounts and check 2FA options for each.
2. Choose methods: authenticator apps for everyone, security keys for admins and finance.
3. Turn on 2FA for administrator accounts first.
4. Enforce 2FA in email and productivity suites with a short grace period.
5. Help staff enrol and store recovery codes.
6. Write a lost-device procedure.
7. Review coverage quarterly and add new tools as they are adopted.

2FA and AI tools

AI assistants and other new tools often connect to email, files and calendars. Protect these accounts with 2FA too, and review which tools have access to company data. Remove access for tools no longer used. Include 2FA requirements in your AI use policy and in the approval process for new software. Tools with broad access are attractive targets.

Making 2FA easy for staff

Resistance to 2FA usually comes from friction. Reduce it by choosing methods that are quick, such as push approvals with number matching, passkeys or security keys; using "remember this device" options on trusted company devices where risk allows; and helping staff set up in person. Explain the reason with real examples. Most people accept a few seconds per login once they understand the risk.

Protecting your domain and website

Your domain registrar and website admin accounts are high-value targets: an attacker who controls them can redirect your website and email. Turn on 2FA at the registrar, lock the domain against transfers, and protect hosting and content management accounts with 2FA. Limit admin access to people who need it. See how to choose a domain name and how to protect a small business website.

2FA for remote and travelling staff

Staff who travel may lose mobile signal or roaming access, which affects SMS codes. Authenticator apps and security keys work without signal. Before travel, staff should check that their 2FA methods work offline and that recovery codes are accessible securely. Combine 2FA with a VPN on public networks; see VPN for business.

Auditing 2FA coverage

Most admin consoles show which users have 2FA enabled. Check monthly, follow up with anyone not enrolled, and review new tools as they are adopted. Keep a simple list of critical accounts with their 2FA status and who holds recovery codes. Coverage tends to slip as new software arrives, so make 2FA part of approving any new tool.

Questions