Which Business Accounts Should Get a Passkey First?
Which business accounts should get a passkey first?
The ones that would hurt the most to lose. And for almost every small business, that list starts in the same place.
(If you're not sure what a passkey is yet, start with our post Should My Business Switch From Passwords to Passkeys? The short version: you sign in with your face, fingerprint or phone PIN, and a fake login page can't use it.)
1. Your business email
This one comes first, no contest. Whoever gets into your email can click "forgot password" on just about every other account you have and reset it. It's the master key.
If your email runs through Google or Microsoft, both offer passkeys. Set one up for yourself and have anybody else with a business email address do the same.
If we host your email, it doesn't offer passkeys yet. For that one, a strong password you don't use anywhere else, plus a phone call before you click any link that asks you to sign in, is the defense.
2. Anywhere money moves
Your bank, your card processor, and any account that sends or receives payments. Many banks are adding passkeys, so check your bank's security settings. If yours doesn't offer them yet, turn on two-step sign-in, where a code goes to your phone, and use a password you don't use anywhere else.
3. Where the business buys things
Amazon especially, if that's where supplies come from. Amazon offers passkeys, and the holidays are exactly when fake "problem with your order" emails show up.
4. Your Facebook page and your Google Business Profile
These are how a lot of local customers find you. Your Google Business Profile lives under your Google account, so the passkey you set up for Google covers it too. Facebook offers passkeys as well. Getting a hijacked business page back is a long, miserable process, and in the meantime somebody else is talking to your customers in your name.
5. Your website, domain and hosting
If you manage these yourself, whoever controls the domain controls your website and your email, so check whether your domain company offers passkeys or two-step sign-in. For most of our own clients we take care of the domain, the website and the hosting in one place, so that's on us, and anybody else emailing you about renewing them is a fake. (We wrote about keeping track of all that in How Do I Keep Track of My Website Renewals?)
What about everything else?
Do it as you go. Next time you log in somewhere and it offers to create a passkey, say yes. You don't need a weekend project, just a habit.
Frequently asked questions
What if an account doesn't offer passkeys?
Use a strong password you don't use anywhere else and turn on two-step sign-in. Passkeys are spreading, so check again in a few months.
Should employees use their own passkeys?
Yes. Each person should have their own login where the service allows it. When somebody leaves, you remove their access without changing anything for everybody else.
Does a passkey protect me from fake invoices?
No. A passkey stops fake login pages. A fake invoice just asks you to pay, so the rule there is to call the company at a number you already have before you pay anything that looks new or different.
Let's talk
If you're not sure who controls your domain or website logins, call me at 979-217-1544 and I'll help you sort it out.
Tom Bruch has built websites since 1998 and is the owner of Aggieland Website Design.