Business Account Safety: Passwords, Two-Step Login and Recovery
Posted on 29th Oct 2026 11:12:24 in Digital Growth Tips
Tagged as: account security, passwords, two-step verification, small business security, digital growth
Most small shops in India now run on a handful of logins. There is the Google account that holds your Business Profile and your Maps listing. The Instagram and Facebook page that brings walk-ins. The WhatsApp Business number customers message every day. The domain registrar that keeps your website address alive, and the dashboard where online payments land. Each one looks harmless on its own. Together they are your shop's second address, and the day you cannot get into one of them is the day a quiet part of your business stops.
Account takeovers rarely look dramatic. There is no broken shutter, no missing stock. A shop owner simply finds one morning that the page has a new admin, that reviews are disappearing, or that the phone number on the Business Profile has been changed to somebody else's. Recovery takes days, calls and paperwork, and some of it never comes back.
The fix is boring and cheap. An afternoon of settings work, one printed sheet of paper, and a rule that nobody in the shop ever reads out a verification code. The practical version below is written for a shop with two or three people and no IT department. Note that in this article "two-step" and "two-factor" mean the same thing: a password plus a second proof that it is really you.
Start With the Accounts You Cannot Afford to Lose
Before you change any setting, make a list. On paper, at the counter, not in your head. Write down every online account the shop depends on and the email address that owns it. A typical list for an Indian small business looks like this:
- Google account — carries your Business Profile, your Google Maps pin, your reviews and often your website analytics.
- Instagram and Facebook page — often linked through one Meta business account, and often the only place some customers ever see you.
- WhatsApp Business — the number customers save, plus your catalog, quick replies and labels.
- Domain registrar and hosting panel — whoever holds this can redirect your website or let the domain expire.
- Payment and billing dashboard — the place where online order money and settlement reports live.
- Courier, marketplace and booking dashboards — pickup requests, listings, appointments.
- The email inbox itself — because almost every password reset in the list above lands there.
Next to each account, note three things: which email owns it, which phone number is attached to it, and whether anyone else in the shop can log in. This list is also your staff access register, so keep it current. An account nobody remembers owning is an account nobody protects, and it is usually the one that gets used against you, because an old page or an unused profile with your brand name on it is exactly what a scammer wants.
One Long Password Per Account, Kept in One Place
Password advice has changed in the last few years, and most shop owners are still following the old rules. The current guidance from the US Cybersecurity and Infrastructure Security Agency is short and specific: make passwords long, make them random, and make them unique, with a minimum of 16 characters. A random string of mixed-case letters, numbers and symbols works. So does a passphrase of four to seven unrelated words, which is far easier for a human to type and remember.
For a shop, a passphrase beats a clever short password every time. Something like four unrelated words with a number, in a language mix you will not forget, is long enough to resist guessing and short enough to type on a phone. What it must not be is reused. One leaked password on a shopping site or an old forum is enough for an attacker to try the same email and password combination on Gmail, Instagram and your hosting panel, because that is exactly what automated tools do all day.
So you need a place to keep the passwords, and memory is not it. Any one of these is acceptable, in rough order of convenience:
- Google Password Manager — built into Chrome and Android, free with the Google account you already have, and it suggests and stores long random passwords for you.
- A dedicated password manager — Bitwarden, 1Password and similar tools store an encrypted vault behind one master password, and the business plans let you share chosen passwords with staff without handing over the whole list.
- A sealed paper record — for the two or three most critical logins, a written copy kept with the shop's other documents in a locked drawer is better than a note on the counter.
What does not work: the "You" chat in WhatsApp, a photo in the phone gallery, a spreadsheet called passwords, or the same six-digit number you have used since your first email address. If a customer or a delivery person can see your counter, they can see a sticky note.
And do not rotate passwords on a calendar. Standard guidance, including from NIST, is that forced changes every 60 or 90 days push people towards weaker, predictable variations. Change a password when you have a reason: a staff member leaves, a device is lost, a service reports a breach, or you notice something odd. That is also the moment to check, not guess, whether the account is still secure.
Turn On Two-Step Login Everywhere It Exists
A password alone is one lock. Two-step verification adds a second proof, usually a code from an app or a tap on your phone, and it is the single highest-value setting in this article. If a password leaks, the attacker still cannot get in without that second step.
On a Google account, sign in and go to your account security page, then turn on 2-Step Verification and add your phone. Google then offers several second steps: a tap on your phone, a code from an authenticator app, a security key, or a passkey using your fingerprint or screen lock. For a shop phone that is always in the same pocket, the prompt plus an authenticator app is a sensible default, with a passkey for the owner's own device.
Then print the backup codes. Google issues eight-digit backup codes that let you get in when the phone is lost, broken or left at home. Keep them with your shop documents, not in the phone's photo gallery, because the gallery is inside the account you are trying to recover. Google's own help page is blunt about two things that shop owners get wrong: never share a verification code with anyone, and Google will not call you to ask for one.
The same setting exists almost everywhere else you do business, and each takes under two minutes:
- WhatsApp Business — open Settings, then Account, then Two-step verification, and set a six-digit PIN with a recovery email. This is what stops someone from re-registering your number on another phone.
- Instagram and Facebook — in Accounts Centre, under Password and security, turn on two-factor authentication. Choose the authenticator app option if you can; text messages are convenient but weaker.
- Domain registrar and hosting — look for two-factor or login protection, and also switch on the registrar lock that prevents unauthorised transfers.
- Payment, courier and marketplace dashboards — same drill. If a platform genuinely does not offer it, use a unique long password and never reuse it elsewhere.
Where you have a choice between a text message and an app, prefer the app or a passkey. SMS codes can be intercepted or received on a number that is no longer truly yours, and a shop number that has been recycled by a telecom operator is a real risk in India. Use SMS if it is the only option, but do not treat it as equal.
Build a Recovery Path Before You Need It
Almost every account takeover story ends with the same sentence: the recovery email was one I stopped using. Recovery details are the spare key, and they need the same attention as the password.
On Google, set a recovery phone and a recovery email that you actually control, and add a recovery contact if you trust one person that far. Keep in mind that a change of recovery phone can take up to seven days to take effect, a deliberate delay that protects you if someone else is trying to move your account to their number. Plan around that delay rather than discovering it in an emergency.
Three habits make recovery reliable. First, the phone number on your accounts should be a number you intend to keep for years, ideally the owner's, not a staff member's personal SIM. Second, if the shop changes its number, update the recovery details in the same week, not the same year. Third, the recovery email should be an inbox that is itself protected with two-step verification, and preferably on your own domain rather than a free address you rarely open.
Write the recovery details on the same sheet as your account list, note where the printed backup codes are kept, and tell one trusted person in the family where that sheet lives. If the owner is hospitalised or travelling, the shop should not lose its Google listing because nobody knows which email address was used.
Give Staff Their Own Access Instead of Your Password
Sharing one login is the most common reason shops cannot tell who did what, and the most common reason a password leaks. Every major platform now lets you add people properly, and it takes minutes.
- Google Business Profile — add managers and owners from the profile's user settings, each with their own Google account, instead of passing around one password.
- Meta Business Suite — add people to the business portfolio and assign the page or ad account, so they never need your personal Facebook login.
- WhatsApp Business — the account belongs to one number on one phone. If staff reply to customers, keep a shop phone with the app, and do not install the same number on multiple devices unless you are using the official linked-devices feature.
Then set the rule that makes all of this work: no one in the shop ever reads out a verification code, and no one asks for one. Not the accountant, not the "Meta support" caller, not a customer who says the code went to your number by mistake. A code is a key. Handing it over is handing over the account.
Finally, review the access list on a fixed date. The start of a festival season and the end of the financial year are easy to remember. Anyone who has left the shop should lose access within a day, and any page or profile you no longer use should be closed rather than left dormant with your brand name on it.
Five Ways Shops Actually Get Caught
Most incidents are not sophisticated. They are a short conversation or a single tap. Recognising the five common patterns is worth more than any software.
- The support call. Someone claims to be from the bank, Meta, WhatsApp or a courier, says there is a problem with your account or a stuck payment, and asks for the code you just received. Real companies do not ask. Google states plainly that it will not call you to verify a code.
- The deletion threat. A direct message or SMS says your page will be removed unless you verify through a link. The link goes to a fake login page that copies your password and your code.
- The helpful stranger with remote access. A "customer" or "technician" asks you to install a screen-sharing app so they can fix an order or a refund. Once installed, they can see your screen and your codes.
- The forgotten number. The account still points to a SIM that was disconnected two years ago, or to the personal number of an employee who has since left. When you need recovery, the code goes to somebody else.
- The shared computer. Logging into the payment dashboard or the page at a cyber cafe, a hotel business centre or a friend's laptop, and closing the browser without signing out. Sessions can stay alive for weeks.
Each has a one-line defence: never share a code, never log in from a link in a message, never install remote access for a stranger, keep recovery details current, and always sign out of shared machines.
If an Account Is Taken Over: The First 30 Minutes
Act in order. Speed matters more than perfect decisions.
- Reset from a device you still control. Change the password and, if the platform allows it, sign out of all other sessions so the intruder is pushed off.
- Check the recovery details. If the recovery email or phone has been changed, reverse it and re-add yours before anything else. On Google, a new recovery phone may sit in a pending state for up to seven days, so confirm it in the security settings rather than assuming it worked.
- Report money-related fraud immediately. If any payment, card or bank detail was exposed, dial the national cyber fraud helpline 1930 and file a complaint on the Ministry of Home Affairs National Cyber Crime Reporting Portal. Reporting early matters because funds are easier to trace in the first hours.
- Warn your customers. If a page or number was hijacked, a pinned post, a broadcast to regulars and a printed notice at the counter stop people from paying a fraudster who is now using your name.
- Rebuild the locks. New password, fresh two-step setup, new backup codes, and a check of every device still signed in. Old backup codes should be treated as burned.
Keep a short record of what happened, when, and what you changed. It helps with platform appeals, and it stops the same mistake from repeating next season.
A One-Afternoon Safety Setup
Block ninety minutes. Work through this list once, and you will not have to think about it again for months.
- 15 minutes: write the account list on paper, with the owning email and phone number for each.
- 20 minutes: install a password manager or open Google Password Manager, and replace the passwords on your five most important accounts with long, unique ones.
- 25 minutes: turn on two-step verification for Google, WhatsApp Business, Instagram, Facebook, your domain registrar and your hosting panel. Print the backup codes and put them with your shop documents.
- 10 minutes: set and confirm recovery email and phone on the Google account, and check that the recovery inbox itself is protected.
- 10 minutes: add staff as users on the Business Profile and Meta page, and remove anyone who has left.
- 10 minutes: agree the shop rule out loud with everyone who touches the phone, and put a small note near the counter: we never share codes.
None of this grows sales directly, which is exactly why it gets postponed. But a shop that loses its Google listing, its page or its WhatsApp number in the middle of a festive week loses far more than an afternoon. Treat the logins like the shutter lock and the cash box: ordinary, unglamorous, and checked before you close.
