How to set up multi-factor authentication in 10 minutes: a step-by-step guide for small businesses

Let's say Dave runs a small landscaping business with six staff. Years ago, he signed up to a gardening forum using the same password he uses for his work email. That forum was hacked, and his password ended up on a list that criminals trade online.

One night, a criminal tries that password on Dave's work email. It works. They read his emails, find a customer who is about to pay a $9,000 invoice, and send that customer a message with a new bank account number. The customer pays the criminal, not Dave.

There is one simple thing that would have stopped all of this: multi-factor authentication, or MFA. With MFA turned on, the stolen password alone would not have been enough to get in.

The good news is that MFA is free on most business tools, and you can set up your main accounts in about 10 minutes. This guide shows you how, step by step.

What is MFA, in plain words?

MFA means you need two or more proofs that it is really you before you can log in. A password is the first proof. The second proof is usually something only you have, like your phone.

Think of your front door. A key alone lets anyone who steals it walk in. But if the house also has an alarm that needs a secret code, a thief with a stolen key still gets stopped. The password is the key, and the code from your phone is the alarm code.

When you log in with MFA, it works like this:

1. You type your email and password, as usual.
2. The system asks for a second proof, like a six-digit code from an app on your phone, or a tap on a "yes, it's me" message.
3. You enter the code or tap the message, and you are in.

The extra step takes a few seconds. For a criminal on the other side of the world, it is a wall they cannot get past.

Which accounts to protect first, and which type of MFA to use

Start with the accounts that would hurt most if a criminal got in. Do these first:

Most services let you pick how you get your second proof. Here are your main choices:

• Authenticator app (best choice for most people). An app on your phone shows a new six-digit code every 30 seconds. Microsoft Authenticator and Google Authenticator are both free.
• Text message (SMS). A code arrives by text. This is better than no MFA, but criminals can sometimes trick phone companies into moving your number, so use an app if you can.
• Passkey or security key (strongest). You log in with your fingerprint, face or a small USB key. If a service offers a passkey, it is a great choice.

If you are not sure, pick the authenticator app. It is free, quick and safe enough for most small businesses.

Step by step: Gmail and Google accounts (about 4 minutes)

Have your phone and your computer ready. Menu names can change a little over time, but the steps are close to this.

Part A: Install an authenticator app

1. On your phone, open the App Store (iPhone) or Google Play (Android).
2. Search for Google Authenticator or Microsoft Authenticator and install it. Both are free. Pick one and use it for all your accounts.

Part B: Turn on 2-Step Verification

1. On your computer, go to myaccount.google.com and sign in.
2. Click Security in the menu on the left.
3. Under "How you sign in to Google", click 2-Step Verification, then Get started.
4. Follow the on-screen steps. Google will ask you to confirm with your phone.

Part C: Add the authenticator app

1. On the same 2-Step Verification page, scroll down to "Second steps" and click Authenticator.
2. Click Set up authenticator. A square barcode (called a QR code) appears on your screen.
3. Open the app on your phone, tap the + button, and choose Scan a QR code. Point your phone at the screen.
4. The app will show a six-digit code. Type that code into your computer and click Verify.

Done! Next time you sign in on a new device, Google will ask for the code from your app.

Using Google Workspace for your business email? If your business email is managed by an administrator, these steps may not work for you. Ask the person who looks after your Google Workspace to turn on 2-Step Verification for everyone.

Step by step: Microsoft 365 and Outlook (about 4 minutes)

Many Australian small businesses use Microsoft 365 for email, Word and Excel. If that is you, follow these steps. Keep your computer and phone close.

1. On your phone, install the Microsoft Authenticator app from the App Store or Google Play. (If you already installed an authenticator app in the Gmail steps, you can use that one instead.)
2. On your computer, go to mysignins.microsoft.com/security-info and sign in with your work email and password.
3. Click Add sign-in method.
4. Choose Authenticator app, then click Add.
5. Click Next until you see a QR code on the screen.
6. On your phone, open the app, tap +, choose Work or school account, then tap Scan QR code. Scan the code on your computer screen.
7. Click Next. Your phone will ask you to approve a test sign-in. Tap Approve and enter your phone's PIN or fingerprint.
8. Click Next, then Done.

On the same page, check that the Default sign-in method says Microsoft Authenticator. If it does not, click Change and pick it from the list.

Are you the boss or the person who runs Microsoft 365 for your team? Then do one more thing. Ask whoever set up your Microsoft 365 to turn on security defaults. It is a free setting that asks every person in your business to use MFA. Otherwise, each staff member can skip it.

Accounting software and online banking (about 2 minutes each)

Every app looks a little different, but finding MFA is usually the same. Here is a simple way that works almost everywhere.

1. Log in and click your name, profile picture or account icon, usually at the top right.
2. Look for Security, Login settings or Account settings.
3. Find a setting called Multi-factor authentication, 2-step verification or Two-factor authentication, and click Turn on or Set up.
4. Choose Authenticator app if it is offered, scan the QR code with your phone, and type in the six-digit code.

Example: Priya runs a small bookkeeping business. She logs in to her accounting software, clicks her profile name, opens the security settings and turns on MFA. It takes her three minutes. Now, even if a criminal has her password, they cannot reach her clients' invoices or bank feeds.

Online banking: Banks in Australia have their own security steps, and the rules differ between banks. Open your banking app or website and look for security settings, or ask your bank which options they offer. Many banks let you approve logins and payments inside their own app. If you can, turn that on. If you are not sure, call the number on the back of your bank card and ask, "How can I make my business login more secure?"

What if you lose your phone? And mistakes to avoid

Most people worry about one thing: "What if I lose my phone and get locked out?" A little planning now solves this.

Before something goes wrong:

• Add a second method. For example, add your mobile number as a backup, as well as the authenticator app.
• Save your backup codes. Some services, like Google, give you a list of one-time codes. Print them and keep them somewhere safe, such as a locked drawer. Do not keep them in an email.
• Check before you change phones. Look at your authenticator app's backup or transfer option before you trade in or reset your phone. If you forget, you will have to set up each account again.

If you do lose your phone: Use a backup code or your second method to log in, then set up MFA again on your new phone. If you are an employee, tell your boss or IT person right away so they can reset it for you.

Common mistakes to avoid:

• Tapping "Approve" on a request you did not start. If your phone asks you to approve a login and you are not logging in, tap Deny. Then change your password straight away. Someone may have your password.
• Sharing a code with anyone. A real bank, IT company or government agency will never ask you for the six-digit code. If a caller asks for it, hang up.
• Only protecting the owner's account. Criminals go for the easiest door. Make sure every staff member turns on MFA.
• Skipping the "boring" accounts. Accounts like your website host, domain name and social media pages need MFA too.

Your 10-minute checklist

Go back to Dave from the start of this post. If he had spent ten minutes turning on MFA, the stolen password would have been useless, and his customer's $9,000 would have gone to the right place.

Here is your checklist. Tick them off one by one:

1. Install an authenticator app on your phone.
2. Turn on MFA for your work email.
3. Turn on MFA for your accounting software.
4. Check your online banking security settings.
5. Turn on MFA for your cloud storage, website and social media.
6. Add a backup method and save your backup codes somewhere safe.
7. Ask every staff member to do the same.

MFA is one of the eight steps in the Essential Eight, and it is one of the easiest. If you have not read it yet, check our guide to the Essential Eight to see what else you can do to protect your business. Start with MFA today. Your future self will thank you.

Need a hand? GoUpp can set up MFA for your whole team

Ten minutes is enough for your own accounts. Getting every staff member, every shared login and every app covered is where it often gets messy. That is where GoUpp can help.

• Find every login that needs protecting. We list your email, accounting, banking, cloud storage, website and social media accounts, including the ones people forget.
• Turn on MFA for everyone. We switch on Microsoft 365 security defaults or Google Workspace 2-Step Verification so no one can skip it, and we help each staff member set up their phone.
• Plan for lost phones. We set up backup methods and recovery steps, so a lost phone is a small hassle, not a locked-out business.
• Show your team the warning signs. A short session on fake login requests and why they should never share a code.
• Keep it working. Through our managed IT support, we look after new staff, new phones and leavers, so MFA stays on as your team changes.