Small business cyber safety guide

How Safe Is My Small Business Email Account?

Learn how small business email accounts get misused for fake invoices, account takeover and password problems, and what to check first in plain English.

Based on public ASD/ACSC Essential Eight guidance. Written for Australian small business owners who want a practical next step, not jargon.

Your IT & Tech Mates small business email account safety hero image showing email safety, fake invoice warning, account takeover risk and two-step login.
Cyber Safety Shorts guide image from Your IT & Tech Mates.
Quick answer

Your email is usually one of the most important accounts in the business. If someone gets in, they may reset other passwords, read invoices, contact customers or pretend to be you.

Plain-English explanation

This guide keeps the business problem first, then shows how it relates to the Essential Eight. It is a practical support guide, not a formal certification, audit, legal advice or insurance advice.

A supplier says they received strange payment instructions from your email. A staff member reused a password, and the business does not know whether two-step login is turned on everywhere.

Business owner scenario

A supplier says they received strange payment instructions from your email. A staff member reused a password, and the business does not know whether two-step login is turned on everywhere.

What can go wrong

  • Fake invoices can be sent from a real business mailbox.
  • Attackers may read old email threads to make scams sound believable.
  • Shared passwords make it hard to know who used the account.
  • Old staff or contractor access can stay open longer than intended.

What to do now

  • Check Microsoft 365 or Google Workspace two-step login.
  • Prioritise accounting, banking, website and social media accounts.
  • Remove old staff and contractor access.
  • Use separate accounts instead of shared logins where possible.

What not to do

  • Do not send one shared password around by text or email.
  • Do not wait until after a scam to turn on two-step login.
  • Do not ignore admin accounts because only one person uses them.
Related free tool

Use the related Your IT & Tech Mates tool to turn this guide into a simple self-check and practical next step.

Local help from Your IT & Tech Mates

Need help turning this into real protection? Your IT & Tech Mates can help set up two-step login, backups, updates, admin access, safer devices, and a plain-English cyber action plan for your business.

Related guides and tools

FAQ

Is this a formal Essential Eight audit?

No. This is a plain-English guide based on public ASD/ACSC Essential Eight guidance. It is not a formal government certification or audit.

Can Your IT & Tech Mates help set this up?

Yes. We can help with practical setup such as two-step login, backups, updates, admin access reviews, safer devices and plain-English action plans.