Turn on two-factor authentication in your tools

A password alone no longer protects a work tool. Two-factor authentication adds a second proof when you sign in: a code on your phone, an approval in an app or a security key. This guide helps you turn it on where it matters most, then extend it to your team.

Why a password is not enough

A password can leak without you doing anything wrong: a hacked website where you had reused it, a fake e-mail imitating a sign-in page, a password that is too simple. With the password alone, whoever got hold of it gets in as you.

With two-factor authentication, that password is no longer enough. They also need your phone or your key, which they do not have. It is one of the simplest protections to put in place, and one of the most useful.

Which tools to start with

Start with the tools where a break-in would do the most damage, in this order:

• Your e-mail first. It receives the "forgot password" links of your other tools: whoever controls your mailbox can reset most of your passwords.
• Your bank, for access to your accounts and to payments.
• Your invoicing and accounting, which hold your clients, your amounts and your bank details.
• Your file storage, such as Google Drive, Dropbox or OneDrive, where your contracts and sensitive documents often sit.
• Your CRM and the other tools that hold client data.

The option does not have the same name everywhere. Look for "two-step verification", "two-factor authentication", "multi-factor authentication" or "2FA" in the security settings of your account.

Which method to choose

Most tools offer several methods. They are not equal:

• An authenticator app on your phone, which shows a one-time code renewed at regular intervals. It is the right default choice when the tool offers it.
• SMS, better than nothing, but less safe: a fraudster can sometimes divert your number to another SIM card. Only keep it if the tool offers nothing else.
• A physical security key, which you plug in or hold near your phone. It is the strongest protection, to keep for the most exposed accounts: the main administrator, the bank, the person who pays the invoices.

Keep your recovery codes somewhere safe. When you turn it on, most tools offer single-use recovery codes. They save you the day you lose your phone. Print them or store them in a password manager, but not only on the phone they are meant to replace.

One last habit: if an app asks you to approve a sign-in you did not start, refuse. Someone may be trying to get in with your password.

Extend it to the whole team

A single poorly protected mailbox is enough to open a door. So two-factor authentication must cover everyone, not just the person running the company. In Google Workspace as in Microsoft 365, an administrator can make it mandatory for the whole organization from the admin console. Look there for the security settings related to two-step verification or multi-factor authentication. For it to go smoothly:

• Tell the team a few days ahead, with a clear date.
• Set aside some time to help those who get stuck.
• Decide in advance who helps someone who has lost their phone, and how to check it is really them.

Your checklist

• Two-factor authentication is on for my e-mail.
• It is on for my bank, my invoicing and my accounting.
• It is on for my file storage and my CRM.
• I use an authenticator app rather than SMS whenever possible.
• My recovery codes are stored somewhere safe, not only on my phone.
• Two-factor authentication is mandatory for the whole team.