“How do I keep my business accounts from being hacked?” In a one- or two-person contracting business, the accounts are the business: the email that every password reset goes to, the bank, the card processor, the accounting file, the website and the business profile customers find you on. Lose control of the email, and a criminal can reset the passwords on the rest.
You do not need an IT department to protect them. The Cybersecurity and Infrastructure Security Agency (CISA) lists four core steps for everyone: avoid and report phishing scams, use strong passwords, use multifactor authentication and a password manager, and update software. For organizations it adds steps such as backing up data. Those five are this article.
Why a small shop is a target
The FBI's Internet Crime Complaint Center (IC3) received 1,008,597 complaints in 2025, with reported losses of about $20.9 billion. Phishing and spoofing was the most reported crime type, with 191,561 complaints. Tech support scams drew 47,794 complaints and losses of $2,134,675,818. The FTC's small-business guide opens with the point that matters here: cyber criminals target companies of all sizes. CISA adds that small businesses often do not have the resources to defend against attacks like ransomware.
1. A password manager, and one password you remember
Reusing a password means a breach at one website can expose every account that shares it. The FTC's fact sheets say never to reuse passwords, never to share them by phone, text or email, and to consider a password manager. A password manager makes and stores a long, different password for every account and fills it in for you, so you remember only one: the one that opens the manager.
How long is long enough? The agencies' numbers differ. The FTC's fact sheets say at least 12 characters. NIST's current digital identity guidelines, written for the services that check passwords, set 15 characters as the minimum when a password is the only thing protecting an account. The same guidelines say services should not force password changes on a schedule, but should force one when there is evidence the password was compromised, and must let you use password managers and autofill. The common thread: long, unique, and changed when there is a reason.
2. Two-factor login, email first
Multifactor authentication (MFA, or two-factor) means a second step after the password: in the FTC's words, something like a temporary code on a smartphone or a key that is inserted into a computer. CISA calls making sure everyone uses MFA on key systems, especially email, the most important step an organization can take. Email comes first because so many other accounts can be reset from the inbox.
CISA is also clear that “any form of MFA is better than no MFA.” Text-message codes and authenticator apps both raise the cost of an attack. The strongest kind is phishing-resistant: CISA says the only widely available phishing-resistant method is FIDO authentication, which refuses to log you in to an imposter site even if you are fooled into trying, and is built into the browsers and smartphones you already use. Where an account offers it, take it.
Turn it on in this order: email; the bank; the card processor or payment app; the accounting software; the domain registrar and website host; your business profiles and social accounts. One warning from CISA's guidance: MFA gaps often open when someone moves to a new phone. If a phone is dropped off a roof, check every account's second step on the replacement before you need it.
3. Updates, set to automatic
CISA says many attacks succeed because the victim was running vulnerable software when a newer, safer version was available, and calls patching one of the most cost-effective practices there is. The FTC's sheet says to update apps, web browsers and operating systems and to set updates to happen automatically, noting that on mobile devices you may have to do some of it by hand.
4. Backups you have actually restored
CISA's guidance is pointed: many ransomware victims had no backups, or incomplete or damaged ones, and it is not enough to schedule backups; you have to test restoring them. The FTC says to keep backups offline, on an external drive or in the cloud, and to make sure they are not connected to the network, so an attack on the office cannot reach them. For a contractor, that means the accounting file, contracts and change orders, estimates, job photos and the customer list. Once a quarter, restore one file from the backup to prove it works.
5. The phishing that gets past all of it
The FTC's phishing sheet describes the pattern: an email or text that seems to come from someone you know asks you to click a link, or give a password or bank details. It looks real, because logos are easy to copy, and it is urgent. Lures that fit a trade business might look like this:
The defense is the same each time. Do not use the link or the number in the message. Open the app, or type the company's address yourself, and look; the FTC says to check with the sender on a number you know to be correct. On the computer warnings, the FTC is blunt: an unexpected tech support call is a scam, even if the number looks local, and you should never give a password or remote access to someone who contacts you out of the blue.
If you click anyway, the FTC's steps are to change any compromised passwords at once, disconnect the infected device from the network, tell the people you work with, and report it to the FTC. If money has left an account, the IC3's report says to contact your bank immediately to ask for a recall, and to file a complaint at ic3.gov whatever the amount.
A worked example: one evening, two people
Say a husband and wife run a painting company from the kitchen table. In one evening they install a password manager on both phones and the laptop, change the email password first and turn on two-factor for email, the bank and the card processor, using an authenticator app or a security key where offered. They set every device to update automatically, make the laptop's daily account a normal one, and connect a backup that runs on its own. Then they restore one estimate from the backup to prove it works. Last, they write one page: what to do if one of them clicks a bad link, who to contact, and where the recovery codes live. CISA recommends exactly this kind of written incident plan, with contact details you can reach if your own systems are down.
Much of it is settings you already have, switched on, and all of it is done before the first suspicious email arrives. If you also take card payments over the phone or in the field, the card side has rules of its own: Taking Card Payments Safely: PCI Basics for Contractors.