The summary.
PROTECT EMAIL FIRST
It controls password resets for everything else. Whoever holds it can take the rest.
Check periodically for forwarding rules and filters you did not create. That is the classic sign of a compromised mailbox.
PROTECT YOUR DOMAIN REGISTRAR SECOND
Control of your domain means control of your website and your email.
Keep recovery contact details independent of that domain.
INDIVIDUAL ACCOUNTS, NEVER SHARED
Actions become attributable and access can be removed for one person.
ON FINANCIAL SYSTEMS
Enable transaction alerts. They are your earliest warning of unauthorised activity.
Reconcile the bank monthly. That is how unauthorised transactions are actually found.
ON SOCIAL ACCOUNTS
A compromised business page is used to defraud your customers in your name.
Check who still has access, including agencies you stopped working with.
ON AI TOOLS
Never submit customer data, credentials, financial records or confidential material.
Tell staff specifically what is prohibited; a general instruction to be careful is not enough.
REVIEW ACCESS QUARTERLY
You will find accounts for people who left and applications authorised years ago.
