Short answer: turn on multi-factor authentication (MFA) for every email account in the business, using an authenticator app or a passkey rather than text-message codes. A phished or leaked password then gets the attacker nothing. It takes about ten minutes per person, it is included with Microsoft 365 and Google Workspace, and it stops the attack behind most of the mailbox takeovers we clean up for Portland-area businesses.
This post was first written in 2018 after three clients in a row had mailboxes hijacked by convincing fake invoices. It was rewritten in October 2026 because the advice got more specific: not all MFA is equal, and the weakest kind is the one most people turn on.
| Key facts | |
|---|---|
| What an email takeover costs nationally | $2.77 billion in business email compromise losses reported to the FBI in 2024, from 21,442 complaints |
| Best MFA | Passkey or FIDO2 security key (phishing-resistant) |
| Good MFA | Authenticator app (Microsoft Authenticator, Google Authenticator, Duo) with number matching |
| Weakest MFA | SMS text or voice call codes |
| Where to turn it on | Microsoft 365: Security Defaults or Conditional Access. Google Workspace: 2-Step Verification enforcement. |
| Time per user | About 10 minutes |
How does an email account actually get hacked?
Almost never by “breaking in”. The attacker already has the password, from one of two places: a reused password leaked in some other company’s breach, or a phishing email that led the person to a fake Microsoft or Google login page where they typed the real one. In the cases that started this post, the lure was a PDF “updated invoice” from a company the client genuinely did business with, because that vendor’s mailbox had already been taken over. One click, one login, and the attacker was reading everything.
With the mailbox, the attacker reads invoices and payment patterns, sets up a forwarding rule so they see replies, and sends the client’s customers a “new bank account” notice from the real address. That is business email compromise, and the FBI counted $2.77 billion of it in 2024.
What does MFA change?
The login now needs the password plus something the attacker does not have: a code from an app on your phone, a tap to approve, a hardware key, or a passkey unlocked by your face or fingerprint. A stolen password alone no longer opens the mailbox. Microsoft and Google both report that MFA blocks the overwhelming majority of automated account attacks, which is why both now push it on by default.
Which kind of MFA should a business use?
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) ranks them:
- Phishing-resistant MFA (passkeys, FIDO2 keys such as YubiKey). A fake login page cannot capture or relay it. CISA’s recommended target.
- App-based MFA with number matching. Good. A fake page can still relay a six-digit code in real time, so pair it with the external-sender banner and training.
- SMS and voice codes. CISA calls these the weakest form: phishable, interceptable, and defeated by SIM swapping. Better than nothing, and the thing to migrate away from.
How do we turn it on?
Microsoft 365: the simplest route is Security Defaults in the Microsoft Entra admin center, which requires every user to register an authenticator and blocks old protocols that bypass MFA. Businesses with Business Premium licences can use Conditional Access for finer rules (require MFA off the office network, block sign-ins from countries you never work with). Add passkeys in the Authentication methods policy.
Google Workspace: Admin console, Security, 2-Step Verification: enforce for all users, allow security keys and Google prompts, and turn off SMS as an option once everyone is enrolled.
Everything else: banking, payroll, accounting, the password manager, social accounts. Work through the list in our password and MFA guide.
What if a mailbox is already compromised?
- Change the password from a different, clean device.
- Turn on MFA for that account immediately.
- Check and delete any mailbox forwarding rules and inbox rules the attacker created; this is the step most people miss, and it is how they keep reading after the password changes.
- Sign out all sessions and revoke app passwords.
- Tell customers and vendors who may have received payment instructions from that mailbox, by phone.
- Check whether customer personal data was in the mailbox; if so, Maine’s breach notification law may apply. Here is what it requires.
If you are not sure how far the attacker got, call us before you delete anything.
Frequently asked questions
Is text-message MFA better than nothing?
Yes, and it should be the starting point only for a week or two. Move to an authenticator app or passkey; SMS codes can be phished and redirected with a SIM swap.
Will MFA annoy staff every time they open email?
No. Once a device is trusted, Microsoft and Google ask again only on new devices, new locations or after a set period. Most people see a prompt a few times a month.
What happens when someone loses their phone?
An administrator resets their MFA registration and they enrol a new device. Keep a second method (a security key in the safe, or a backup phone number for admins only) so nobody is locked out.
Does MFA protect against ransomware?
It closes the most common entry route (a stolen login to email or remote access). Patching, endpoint protection and backups cover the rest. See the eight-control baseline.
Sources
- FBI Internet Crime Complaint Center, 2024 Internet Crime Report (April 2025): 21,442 BEC complaints, $2.77 billion in losses
- CISA, Implementing Phishing-Resistant MFA: cisa.gov
Cite this page: “The One Setting That Stops Most Email Hacks: Multi-Factor Authentication”, Information Systems of Maine, Portland, ME, updated October 2026.
Need MFA rolled out, or a mailbox cleaned up? Request IT help or call 207-653-4143. Cybersecurity services for Portland and Southern Maine businesses.
