I hate friction. If something takes longer than it should, requires more steps than it needs to, or interrupts my flow for no good reason; it bothers me. I’ve built Telegram bots to avoid friction. I’ve automated things that probably didn’t need automating just because the manual version was annoying. So it might surprise you to know that I enter credentials somewhere between 10 and 15 times a day. Two-factor codes, authenticator apps, login confirmations. Pure friction, every time. And I’ve made my peace with it. Here’s why.
The Story That Changed My Perspective
A client of mine received an email that looked like it came from me. Same name, professional tone, reasonable context. The email requested updated banking details for an upcoming payment. The email address was off by one character. Not my domain, something close enough to pass a quick glance. My client did something really smart: before acting on the request, they reached out to confirm. A quick message asking if I’d sent it. I had not.
Someone had spoofed my email address, created a fake account one character off from mine and was attempting to redirect my client’s payment to a fraudulent account. Business email compromise. One of the most common and most expensive types of fraud targeting small businesses. And it requires almost no sophistication to attempt. Just a free email account, a little patience, and a client who doesn’t verify before wiring money. We caught it. My client didn’t lose anything. But for a few minutes it was a very uncomfortable situation.
I’ll also tell you this: I know firsthand through someone close to me, what it looks like when a hack actually succeeds. Weeks of delays. Reprocessing. Cleanup that takes far longer than anyone wants to spend on it. It’s genuinely awful. I’d prefer not to experience it firsthand. So. Fifteen credential entries a day. Fine.
What Financial Security Actually Looks Like for a Small Firm
This isn’t an enterprise security post. I’m not going to talk about penetration testing or zero-trust architecture. I’m going to talk about the basics; the things every professional services firm should have in place and most don’t think about until something goes wrong.
Two-Factor Authentication everywhere.
Every financial account. Every accounting platform. Every email account. Every system that touches client data or money. Yes, it’s friction. Yes, you’ll enter codes constantly. Do it anyway. A compromised email account is the entry point for most of the fraud I described above. 2FA makes it dramatically harder to get in even with a correct password. Enable it. Require it for your whole team. No exceptions for senior people who find it inconvenient; that’s usually where the breach happens.
Password managers: Stop reusing passwords.
If your password for your bank is the same as your password for anything else, that’s a problem. When one platform gets breached, and platforms get breached constantly, those credentials get sold and tested everywhere else. A password manager generates and stores unique, complex passwords for every account. You remember one master password. Everything else is handled. It’s one of the highest-leverage security investments you can make and most of them cost less than $5 a month.
User access controls: Who actually needs access?
This one gets overlooked constantly. A new team member joins, gets access to everything to get started, and that access never gets reviewed or adjusted. A contractor finishes a project and their login stays active for months. Audit your access regularly. Who has access to your accounting system? Your bank accounts? Your client portals? The answer should be only the people who genuinely need it to do their jobs and nothing more. When someone leaves the firm or finishes a project, revoke access the same day. Not eventually. That day.
Segregation of duties: Even in small firms.
In a perfect world, the person who approves a payment isn’t the same person who initiates it. The person who manages vendor relationships isn’t the same person who processes their invoices. Separation of duties is the classic internal control. It means that fraud or error requires two people to be involved rather than one. Small firms can’t always achieve full segregation. But you can get closer than you think. Have someone other than the bookkeeper review bank reconciliations. Require a second approval on payments above a threshold. Build in at least one checkpoint that creates accountability.
Bank account alerts: Know when money moves.
Most banks let you set up alerts for transactions above a certain amount, new payees, international transfers, and other activity. Set them up. All of them. If money moves unexpectedly, you want to know immediately not at month end when the reconciliation catches it.
Phishing awareness: Train your team.
The spoofed email my client received wasn’t sophisticated. But it almost worked. And it would have worked on someone who didn’t take the extra step to verify. Your team needs to know what phishing looks like. Urgent requests for payment changes. Slightly-off email addresses. Requests that bypass normal process. Anything that creates pressure to act quickly without verification. Train them. Talk about it. Make it normal to slow down and verify before acting on any financial request especially one that involves changing payment details or wiring money. And add this to your client communication: if you ever receive a request to change our banking details, please call us directly to confirm before acting on it. That one instruction is what saved my client from a costly mistake.
Regular access audits: Make it a routine.
Set a calendar reminder. Quarterly is fine. Go through every system your firm uses and ask: who has access, what level of access do they have, and does that still make sense? Remove anything that’s outdated. Tighten anything that’s too broad. It takes an hour. It’s worth it.
The Math on Friction
Here’s how I think about it. The friction of entering a two-factor code takes maybe 15 seconds. At 15 times a day, that’s about 4 minutes. Across a year, that’s roughly 24 hours of credential entry. The friction of a compromised account; the cleanup, the client calls, the reprocessing, the potential financial loss, the reputational damage, is measured in weeks. Sometimes longer. Twenty-four hours a year versus weeks of crisis. That’s not a hard trade-off. I hate friction. But I hate that outcome more.
The One Thing Your Clients Should Know
Financial fraud doesn’t always start with a breach of your systems. Sometimes it starts with a spoofed email and a client who doesn’t verify before wiring money. Tell your clients explicitly: if you ever receive communication from us requesting a change to payment details, call us directly to confirm. Don’t reply to the email. Don’t click a link. Call. That instruction, delivered proactively, before anything goes wrong, is one of the most valuable things you can do for your client relationships. And it costs you nothing but a sentence.
Chris Geno is a CPA and fractional controller at High Rock Accounting, working with professional services firms on financial strategy, internal controls, and operations. Questions about what financial security should look like for your firm? It’s worth a conversation.
Enjoyed this article? Consider Sharing
Author
