Email safety for tiny offices

For offices with 1 to 20 people. No IT team needed. Most steps are free settings you already have.

The checklist

• Turn on MFA for every email accountStart with the owner and whoever pays bills. CISA: Turn on MFA.
• Use a team password managerSo you can remove access when someone leaves. See password managers.
• Make a "call to confirm" money ruleAny new bank details, rush payment, or gift card request gets a phone call to a number you already have. The FTC suggests verifying by phone. (FTC: Business email imposters)
• Set up email authenticationSPF, DKIM, and DMARC help stop others from sending email that looks like it is from your domain. Ask your email provider or domain host. FTC: Email authentication.
• Train everyone for 15 minutesWalk through our scam email checklist together.
• Turn on automatic updatesComputers, phones, browsers, and the router.
• Back up important filesKeep at least one backup that is not always connected.
• Know where to reportReportFraud.ftc.gov and, for online crime losses, the FBI's IC3.

The two scams that hit tiny offices most often

Fake invoice or "new bank details"

A vendor seems to email that their bank changed. The new account belongs to the scammer. Always call the vendor at a number on file before changing payment details.

Boss impersonation

An email "from the owner" asks someone to buy gift cards or send a quick wire, and keep it quiet. Make it a rule that the owner will never ask this by email.

Free official guides

• CISA Cyber Essentials
• CISA: Small and medium businesses
• FTC: Phishing (small business guide)

General information only. Not legal, financial, or security advice, and not a guarantee. Check with the company or agency involved.