Insights · Published 8 November 2026
For most businesses, email is where the money conversations happen. Invoices come in, payment confirmations go out, suppliers send bank details and customers ask for quotes. That is exactly why criminals want your email password.
Once they are inside a mailbox, they rarely make noise. They read. They learn who you pay, how much, and how you write. Then, at the right moment, they send a convincing message asking for a payment to a new account, or they tell your customers that your bank details have changed. The loss lands on you or on your customers, and your reputation takes the blame.
How passwords get stolen
Most email takeovers do not involve clever hacking. They start with an ordinary password, stolen in an ordinary way.
- A fake sign-in page, sent by email or WhatsApp, that looks like Microsoft or Google
- A password reused from another website that was breached
- A simple password that is easy to guess
- Malware on a computer, often from cracked software, that records passwords
- A password written on a note, or shared between several staff
Two-step verification is the single biggest fix
Two-step verification (also called MFA or two-factor authentication) means a password alone is not enough to sign in. The person also needs something only the real user has, usually a code or approval prompt from an app on their phone.
If a criminal steals the password, they still cannot get in without the phone. This one step blocks a large share of email takeovers. Microsoft 365 and Google Workspace both include it at no extra cost. Turn it on for every account, starting with the owner, managers and anyone who handles payments.
An authenticator app is better than codes sent by SMS, because SMS can be intercepted or diverted. Teach staff one important rule: never approve a sign-in prompt you did not start yourself, and never read out a sign-in code to someone who calls you. Real banks and real IT support will not ask for it.
Better passwords, without the pain
Long passwords are stronger than complicated short ones. A phrase of several unrelated words is easier to remember and harder to guess than a short jumble of symbols. Every account should have its own password, so one breach does not open everything.
A business password manager makes this practical. It remembers the passwords, fills them in, and lets you share access to company accounts safely without sending passwords by WhatsApp.
Shared mailboxes, done properly
Many offices have one account like info@ or accounts@ whose password is known to several people. When someone leaves, the password rarely changes. And a shared password usually means no two-step verification, because only one phone can hold it.
Microsoft 365 and Google Workspace both support shared mailboxes or delegated access. Each person signs in with their own account and their own two-step verification, and can read and send from the shared address. When someone leaves, you remove their access and nobody else is affected.
Check for hidden forwarding rules
A favourite trick after a takeover is to add a hidden rule to the mailbox. It might quietly forward copies of every email to an outside address, or move replies from a particular supplier into a folder you never look at, so you do not see the real supplier asking where their money is.
Check this now. In Outlook, look under Settings, then Mail, then Rules and Forwarding. In Gmail, look under Settings, then Forwarding and also Filters. Remove anything you do not recognise. Your administrator can also check all mailboxes centrally and block automatic forwarding to outside addresses.
Signs an account may be compromised
Watch for colleagues or customers receiving emails you did not send, replies to messages you never wrote, missing emails, unfamiliar rules, sign-in alerts from places you have not been, or a sudden password reset you did not ask for. If you see any of these, change the password from a clean device, sign out all sessions, check rules, turn on two-step verification and tell your contacts to ignore suspicious messages.
Your checklist
Most of this can be done in a single afternoon.
- Turn on two-step verification for every email account, managers first
- Use an authenticator app rather than SMS where possible
- Tell staff never to approve prompts or share codes they did not request
- Replace shared mailbox passwords with delegated access
- Check every mailbox for unknown forwarding rules and filters
- Block automatic forwarding to outside addresses
- Introduce a business password manager
Dalysie Ghana can switch on two-step verification across your business email, check for hidden rules and show your staff what to watch for.