The single change that stops most phishing losses: MFA
Multi-factor authentication won't stop every attack, but it stops the overwhelming majority of account takeovers — because a stolen password alone stops being enough.
Phishing emails are aimed at one outcome above all others: getting a password. Once an attacker has it, they can log in as you, read your email, reset other accounts, and impersonate you to colleagues or customers — all without needing to break anything technically clever.
Multi-factor authentication (MFA) breaks that chain. Even with a correct password in hand, an attacker also needs the second factor — a code from your phone, a push notification you approve, or a physical security key — none of which a phishing email can capture alongside the password itself.
It's not a perfect defence; a small number of more sophisticated attacks can work around certain forms of MFA. But for the everyday phishing email that's still the most common way small businesses get compromised, it's the single change that does the most work for the least effort.
If MFA isn't switched on for email and anything that touches money or customer data, that's the first place to start — not backups, not a security policy, not a training programme. MFA first.