Two-Factor Authentication: The Small Annoyance That Saves Your Business
Achieng runs a small events company. One Tuesday, a long-standing client called to confirm that the deposit for a wedding should go to the "new bank account" in the email Achieng had sent that morning. Achieng had sent no such email. Someone had guessed her email password, logged in from another country, read through months of conversations, and then written to her clients in her exact tone, complete with her habit of signing off with "Blessings!". It was a textbook business email security failure, and it happens to Kenyan companies far more often than anyone admits.
Fortunately, that client called first. Not all of them did. The password, by the way, was her company name followed by the year she started. She is not the only one. Somebody in your office is using the same trick right now.
What two-factor authentication actually is
Two-factor authentication, often shortened to 2FA, means that logging in needs two different things instead of one. The first is something you know, like your password. The second is something you have, usually your phone. Even if a criminal gets your password, from a leak, a guess or a fake login page, they still cannot get in without that second thing.
Think of it like a building with a watchman. A password alone is a key that can be copied. 2FA is the key plus the askari at the gate who knows your face. Copying the key is easy. Fooling the askari is much harder.
The different flavours, from okay to excellent
SMS codes: a code sent by text message. Better than nothing, but vulnerable to SIM-swap fraud
Authenticator apps: free apps on your phone that generate a fresh code every thirty seconds, even without network
Push approvals: a prompt on your phone asking if this login is really you
Security keys: small physical devices you plug in or tap, which are the strongest option for high-value accounts
For most businesses, an authenticator app is the sweet spot. It is free, it works when the network is being moody, and it does not depend on your SIM card staying in your own hands.
Start with business email security, then the rest
You do not need to secure everything in one afternoon. Start with the accounts that would hurt most if someone else controlled them.
Your business email, because it resets every other password
Online banking and any payment dashboards
Your domain registrar and website hosting
Social media pages that customers trust
Accounting, payroll and client management systems
WhatsApp, by setting up the two-step verification PIN in its settings
Email comes first for a reason. Whoever controls your inbox can click "forgot password" on almost everything else and take over your whole digital life before lunch.
Making the annoyance bearable
The main complaint about 2FA is that it is a nuisance. Fair. But most services let you mark a trusted device, so you only enter a code occasionally on your own laptop rather than every single time. The extra step appears mainly when someone logs in from a new place, which is exactly when you want it.
The other worry is losing your phone. This is why services give you backup codes when you set up 2FA. Print them, put them somewhere safe, like the office safe or a locked drawer, and do not save them as a photo in the same phone you might lose. Some authenticator apps can also back up to a cloud account, which makes changing phones much less dramatic.
The shared account problem
Many offices share logins. One email for the whole sales team, one social media password stuck on the wall near the printer. 2FA makes this awkward, because the code goes to one person's phone, and that person is inevitably on leave when it is needed.
Treat this as a gift rather than a problem. Shared logins are a security risk anyway, since you can never tell who did what. Where possible, give each person their own account with the right permissions, which good business software supports out of the box. Where a shared account is unavoidable, use an authenticator that can be set up on two trusted devices, and write down who holds them.
Do it this week
Pick one account today, ideally your email, and switch on 2FA. It will take about five minutes and one mild sigh. Then do your banking tomorrow. By the end of the week, the most dangerous doors will have an askari. Achieng now has 2FA on everything, and she still signs off with "Blessings!", but only when it is really her.
Next step: open your email security settings right now, before the next "kindly revert" lands in your inbox. Future you will be grateful, and so will your clients' bank balances.