Protect your recovery route first
Your email often controls password resets for your bank, shop and marketplace. Use a unique strong password, a password manager and multi-factor authentication where supported. Secure the recovery options too. Keep recovery codes somewhere protected that you can reach if your phone is lost. Add equivalent protection to selling accounts, cloud storage, domain registration and payment dashboards.
Give people the access their job needs
Use separate staff accounts and delegated permissions where the service supports them. Avoid sharing the owner’s password with a contractor or agency. Review who can export customer data, change payout details or approve payments. Remove access promptly when someone leaves. Keep a short list of critical services, their owner and the route to support so you are not trying to reconstruct it during an incident.
Keep devices and backups useful
Install supported operating-system and application updates. Lock devices and use appropriate security settings. Back up business-critical records, designs and product information using a method suitable for your business, with a separate protected copy. Test restoring an important file: a backup you cannot restore is little help. Keep outdated devices away from payment and admin work.
Practise one suspicious-message scenario
Show the team an example of a fake courier invoice or “account suspended” email. Agree that urgent payment or bank-detail requests need an independent check. A phishing message may arrive inside a familiar conversation after an account is compromised. Open the service directly to inspect the claim. Make reporting a mistake easy so you hear quickly if someone entered credentials. If access or money is already affected, follow the emergency guide and contact the actual provider.
YOUR NEXT STEP
Make the next move a clearer one.
- Turn on MFA for email, payments and seller accounts.
- Use unique passwords and secure recovery methods.
- Keep devices and supported software updated.
- Test restoring a backup of a critical file.
- Review staff access and verify payment changes independently.
Where we checked the details
Primary sources checked 11 October 2026. Rules, prices and eligibility can change. Confirm current terms with the official service.
General UK guidance and editorial checklists. Apply the official rules to your circumstances and seek qualified help where needed. This is researched guidance, not a claim that we have tested every provider or situation.
Spotted an update? Tell us →