Generic advice says use strong passwords. That is necessary and it will not save you. The realistic threats are specific: someone takes over the WhatsApp Business number your customers message, and someone changes a supplier’s bank details.
What actually gets attacked
| Priority | Threat | What it costs you | Cost to fix |
|---|---|---|---|
| 1 | Business email taken over | Password reset for everything, invoice fraud, lockout | Free, 20 minutes |
| 2 | WhatsApp Business number taken over | Order book, customers scammed in your name | Free, a few hours |
| 3 | Invoice or bank-detail redirection | Lakhs out in one payment | Process change, free |
| 4 | Credential stuffing on reused passwords | CRM, cloud, admin panels, website | Free, an afternoon |
| 5 | UPI and netbanking fraud | Money out through your number | Free, awareness |
| 6 | Ransomware via a shared laptop | Everything, plus a demand | Backups and patching |
Items 1 and 2 are free to fix and cause the most damage, so they come first. A firewall is worth buying eventually, but it is not where small firms lose money.
The business email account is the master key
Almost every service you use has a password reset that goes to email: Meta Business Manager, Google Workspace, the registrar, the bank portal. Take the email and nothing is left to attack.
- Turn on two-factor authentication with an authenticator app rather than SMS, and keep recovery codes in a password manager.
- Add a second administrator on important accounts. On Meta Business Manager, it should not be the owner’s handset.
- Check forwarding rules and active sessions quarterly. An attacker who gets in sets an auto-forward you never see.
- Never share a password with staff, and never approve an MFA prompt you did not start. Attackers phone people posing as IT.
The WhatsApp Business number
Indian small businesses are least prepared for this: the number holds the order book, the customer list and the brand on one device, and a SIM swap is enough to get the OTP your phone receives.
- Turn on two-step verification in WhatsApp and keep the PIN in the office safe. If somebody asks for it, they are asking for your business.
- Never read out an OTP, and never let anyone remote-access your phone to “complete verification”. That is the mechanism behind almost every takeover.
- Mirror the catalogue, price list and important chats outside the phone, and register the number on Meta Business Manager with MFA and a second admin.
- Ask your operator about a porting lock for the number. It is free and blocks the usual route.
Invoice and bank-detail fraud
The successful version is boring. A real supplier’s email is spoofed or compromised, the bank details change, accounts payable pays the new account, and the money leaves in one transaction.
- No payment detail change is accepted on email alone. Call back on a number on file, not one in the message.
- Any change to vendor bank details needs a second approver plus phone confirmation with the vendor.
Credential stuffing and UPI fraud
Credential stuffing is automated: leaked password pairs are replayed against your services, and it works because owners reuse their personal password on the admin panel.
- Unique passwords everywhere, stored in a password manager. Reuse is the problem, not weak characters.
- MFA on anything holding customer data or money: CRM, cloud, hosting, website admin, dashboards.
- Never approve a collect request you did not start, open a “send money” link from a stranger, or allow screen sharing on a call from an unknown number. Fake care and job calls are the wrapper.
Patching, backups, and the first hour
The rest is ordinary: automatic updates on every machine, security software somebody looks at, unused software removed, no cracked downloads. The hard part is backups, because one on the same network is not a backup, which the backup and disaster recovery page covers.
Write down the first hour before you need it. If something is wrong: do not wipe anything or power off the machine; if money has moved, call your bank’s fraud line first, because recall is time-bound; change the email password from a clean device; if a number may have been ported, call the operator.
FAQ
What is the single most important thing to do? Turn on two-factor authentication on the business email account. It is free, takes twenty minutes, and blocks the attack that unlocks everything else.
Is WhatsApp Business really a security risk? Yes. It is where customers reach you and where the order history lives, and taking it over is cheap for an attacker.
How much should a small business spend on security? For under fifteen people, the priority spend is a managed backup and a review of your email, cloud and website, a few thousand rupees. A two-person studio with no payments needs four: MFA, a password manager, one backup, and no shared logins.
Do I need antivirus on a managed work laptop? Keep built-in protection on, but what decides your exposure is how fast software is patched and how many share a login.
How do I know if my email has been accessed? Check active sessions and forwarding rules for anything you did not create, then change the password from a trusted device.
Get the assessment done properly
24Bit System runs security assessments and monitoring for small businesses across Noida and Ghaziabad, focused on the items above rather than generic checklists, and it can sit under a monthly IT AMC. Your website has its own list in website security best practices, and we can scan what is public with Aegis Inspect. Call +91 7840002466 or contact us.
