Your business email is the key to almost everything. It resets your passwords, receives your invoices, and talks to your customers. If someone gets into it, they don’t just read your mail. They can send fake invoices to your clients, change where payments go, and lock you out of your own accounts.

Most small businesses think hackers only go after big companies. In real life, small businesses are often easier targets, because they have no IT team watching. The good news: most attacks are stopped by a few simple settings.

Here are six checks you can do in about an hour, plus one rule that protects your money.

1. Turn on two-step sign-in

A password alone is not enough anymore. Passwords get leaked, guessed and stolen every day. Two-step sign-in (also called multi-factor authentication, or MFA) asks for a second proof, like a code or a tap on your phone, before anyone can log in. Even if a hacker has your password, they still can’t get in.

Try this week: turn on two-step sign-in for your email first, then your bank, your website and your social media accounts. An authenticator app on your phone is safer than text-message codes.

2. Check who still has access

Over time, accounts pile up: a former employee, a summer student, a web designer you worked with two years ago. Every account that is still active is a door someone could walk through.

Try this week: open the list of users in your email system. Remove anyone who no longer works with you, and reset the password for any shared account they knew.

3. Look for hidden forwarding rules

This is one of the sneakiest tricks. After breaking into an email account, attackers often set up a quiet rule that copies your mail to them, or hides certain emails from you. You may never notice, while they watch your invoices and conversations for weeks.

Try this week: check your email settings for forwarding and inbox rules. If you see a rule you didn’t create, delete it and change your password right away.

4. Learn the signs of a scam email

Most attacks start with one email that looks normal. Watch for these warning signs:

• It creates urgency: “pay today”, “your account will be closed”
• The sender’s address is slightly off, like a missing letter or a strange domain
• It asks you to log in through a link, or open an unexpected attachment
• It asks for gift cards, a wire transfer or a change in banking details

When in doubt, don’t click. Go to the website yourself, or call the person on a number you already have.

Try this week: share this list with everyone on your team, including family members who help with the business.

5. Protect your domain name from fakes

If your business uses its own email address (like you@yourbusiness.com), scammers can pretend to send emails from your name. Three behind-the-scenes settings, called SPF, DKIM and DMARC, tell other email systems which senders are really you. They also help your real emails land in the inbox instead of spam.

Try this week: ask whoever manages your website or email to confirm these three settings are in place. It’s usually a short job.

6. Make sure you can recover your account

If you ever get locked out, recovery options are your way back in. Old phone numbers and old backup email addresses can make recovery hard, or let someone else take over.

Try this week: update the recovery phone number and backup email on your main accounts. Save your backup codes somewhere safe, offline.

The one rule: never change payment details by email alone

A common scam goes like this: a supplier or client “emails” to say their bank details have changed, and asks you to send the next payment to a new account. The email looks real, because sometimes it comes from their real, hacked account.

The rule is simple: any request to change banking details, or to send money in a hurry, gets a phone call first. Use a number you already have, not one from the email. A two-minute call can save thousands of dollars.

If something does go wrong, act fast. Call your bank right away, change your passwords, and report it to the Canadian Anti-Fraud Centre. If customers’ personal information was exposed, Canadian privacy law may require you to report it and tell the people affected.

Where to start

Start with check #1. Two-step sign-in on your email takes about 10 minutes and blocks most account takeovers. Then work through the rest, one per day.