A plain-English checklist to protect your business from hacked accounts

Small businesses often assume hackers only go after big companies. In practice, most attacks are not targeted at all: criminals send fake messages to thousands of people and wait for someone to click. A few habits and settings stop the large majority of them.

Protect your accounts

1. 1Turn on two-step verification for business email, social media pages, banking and your website admin. A stolen password alone is then not enough to get in.
2. 2Use a different password for every important account. A password manager makes this easy for the whole team.
3. 3Make sure at least two trusted people have admin access to your social pages and domain, and remove former staff promptly.

Spot fake messages

1. 1Be suspicious of urgency: “your account will be closed today”, “pay this invoice now”, “verify your password”.
2. 2Check the real sender address and hover over links before clicking. Fake pages often copy logos perfectly.
3. 3Confirm any request to change bank or mobile money details by calling the person on a number you already have, never the one in the message.
4. 4Never share one-time PINs or codes. No genuine bank, telco or IT provider will ask for them.

Protect your data

1. 1Back up important files automatically, and keep at least one copy offline or in a separate account. Test that you can actually restore it.
2. 2Keep computers, phones and your router updated. Many attacks use holes that were fixed months ago.
3. 3Separate guest Wi-Fi from your business network, and change default router passwords.

What to do if an account is hacked

• Change the password from a clean device and sign out of all sessions.
• Check recovery email, phone number and forwarding rules. Attackers often add their own.
• Warn your contacts not to act on messages sent from the account.
• Get help early, especially if money or customer data is involved.

Cliq runs security checks for small businesses, sets up two-step verification, backups and firewalls, and trains staff to spot phishing. We’ll never ask for your passwords.