One Password Is No Longer Enough
The 15-minute cyber check every family business should do
Written by: Melissa Cunliffe (CA)
If somebody obtained the password to your email account tonight, what could they access tomorrow morning? For many small businesses, email is effectively the master key to payroll, invoices, cloud storage, password resets and client information.
The Australian Signals Directorate says 42% of industry, government and critical-infrastructure cyber incidents reported to it in 2024–25 involved compromised accounts or credentials. Its September campaign is urging Australians and businesses to enable multi-factor authentication, preferably phishing-resistant MFA such as passkeys where available.
A strong password is useful. A strong password plus MFA is substantially harder for an attacker to exploit.
Why email is such a valuable target
Once an attacker controls email, they may be able to reset passwords to other systems, read invoices, impersonate staff, redirect payments or learn enough about the business to make a scam look credible.
That makes email security a financial-control issue, not simply an IT issue.
What MFA does when a password is compromised
Multi-factor authentication requires more than one form of verification. A password may be combined with a passkey, authenticator app, biometric or another factor. If a password is stolen, the attacker still needs the additional verification.
ASD recommends phishing-resistant options such as passkeys where supported. Where they are not available, authenticator apps are generally preferable to relying on a password alone.
The 15-minute access review
Start with the systems that could cause the greatest damage if compromised.
Email and Microsoft/Google accounts.
Internet banking.
Accounting software.
Payroll and HR systems.
ATO and government-related access.
Cloud storage and document systems.
CRM and client databases.
Social media accounts.
For each system ask: is MFA enabled, who has administrator rights, are former employees still present, and does each person need the level of access they currently have?
Changed bank details: create one hard rule
Invoice-redirection scams often begin with a genuine-looking email saying supplier bank details have changed. The message may contain real names, invoice details and the normal writing style of the supplier.
A useful internal rule is simple: never change supplier or employee bank details solely from an email. Verify independently using a phone number already held in your records or another trusted channel.
Do not use the phone number contained in the change request itself — if the message is fraudulent, that number may belong to the scammer.
Remove access when people leave
Small businesses often accumulate old accounts because disabling access feels less urgent than hiring the replacement. Former employee accounts, shared logins and old administrators create unnecessary risk.
Offboarding should include email, banking, accounting, payroll, cloud storage, CRM, password managers, social media and any industry-specific systems.
Backups and recovery still matter
MFA reduces the chance of account compromise, but no single control is perfect. Businesses also need reliable backups and a simple plan for what happens if a key system is unavailable.
Ask: if email, payroll or accounting software was unavailable tomorrow morning, could the business still pay staff, contact clients and access critical records?
AI makes impersonation easier
AI-generated messages, voice and images can make social engineering more convincing. Businesses should therefore rely less on whether a request “sounds like” the right person and more on a repeatable verification process.
That is particularly important for urgent requests involving money, bank details, payroll or confidential data.
A practical 15-minute checklist
Turn on MFA for email, banking, accounting, payroll, cloud storage and social accounts.
Prefer passkeys or authenticator apps where available.
Remove former staff and unused accounts.
Review administrator permissions.
Stop shared logins where practical.
Introduce independent verification for changed bank details.
Confirm backups exist and can actually be restored.
Nominate who is responsible for responding to a suspected compromise.
The educational takeaway
Cyber security does not require a small business owner to become an IT expert. The most useful first step is to reduce the easy ways into the business and make high-risk financial changes require independent verification.
The 4P's Future Prosperity Model
PEOPLE
Cyber incidents affect real people: owners, employees, customers and families. Protecting payroll, identities and confidential information is part of looking after the people who trust the business.
PRESERVE
Preserve business data, reputation, cash and the ability to keep operating after an incident.
PROTECT
Use MFA, appropriate access, backups and verification processes to reduce the chance that one stolen password becomes a major financial loss.
PROSPER
Strong controls allow the business to use technology and AI confidently, because innovation is being supported by sensible guardrails rather than unmanaged risk.
Is your business protected if one password is compromised?
From MFA and administrator access to bank detail verification and backups, small security controls can help prevent a single compromised account from becoming a much larger financial problem.
Book a consultation with our team today to review your business controls, identify potential risks and build practical processes that help protect your people, data and finances.
Disclaimer
This article does not constitute financial advice and is for general information only. It does not take into account any individual’s personal objectives, situation or needs, and is not intended as professional advice. Any similarity to an individual’s personal circumstances and the examples provided in this article is purely coincidental. Any person acting upon such information without receiving specific advice, does so entirely at their own risk.
Authorisation under an Australian Financial Services Licence (AFSL) is not required in the provision of this article and the author plus Future Accounting Group Pty Ltd is not acting in its capacity as an Australian Financial Services Licence holder
Liability limited by a scheme approved under professional standards legislation.
