Cybersecurity basics for small service companies

Why a ten-person contractor is worth attacking

Most attacks on small service companies are not sophisticated. They target the email inbox where invoices, supplier statements and payroll notices arrive, the shared password on the office computer and the technician tablet that never gets updated. In 2024 the FBI's Internet Crime Complaint Center received 859,532 complaints with reported losses of $16.6 billion^[1]. The Federal Trade Commission separately received fraud reports from 2.6 million consumers who lost more than $12.5 billion, and the share of reporters who lost money rose from 27% to 38%^[2].

The structure of the trades makes this worse. About 58.3% of US plumbing, heating and air-conditioning contractor establishments had fewer than five employees in 2023^[3]. Few have an IT person. Security is something the owner or office manager does on a Friday afternoon, if at all. The good news is that a short list of controls stops most of the common attacks, and none of them needs specialist skills.

The five controls that matter most

1. 01

   Multifactor authentication on every important account

   Start with email, because a hijacked inbox can reset every other password. Then banking, payroll, your field service or CRM software, accounting, your website host and domain registrar, and your Google Business Profile.

2. 02

   A unique password for each account, kept in a password manager

   Reused passwords are how one leaked site becomes a break-in to your email. A business password manager lets you share access with staff without sharing the actual password, and remove it when they leave.

3. 03

   Automatic updates on every device

   Office computers, technician phones and tablets, the router and any card reader. Turn on automatic updates and replace devices that no longer receive them.

4. 04

   Backups you have actually restored

   Accounting files, customer list, price book, job photos and contracts. Keep an automatic cloud backup plus one copy that is not connected all the time, and test a restore every quarter.

5. 05

   A payment verification rule

   No change to bank details, and no urgent payment request, is acted on from email alone. Call the person back on a number you already had, not one in the message.

Choosing the right kind of MFA

Not all second factors are equal. CISA ranks them from strongest to weakest: a physical security key, an authenticator app with number matching, an authenticator app with one-time codes, biometrics combined with another method, and finally codes sent by text or email, which it suggests using only when nothing stronger is available. CISA also says plainly that any MFA is better than none^[4].

For a small office, a sensible standard is an authenticator app for every staff account and a physical key for the owner's email and banking. Text codes are acceptable for low-risk accounts, but phone numbers can be hijacked through a carrier account takeover. Put a port-out PIN or account PIN on your business phone carrier account so nobody can move your main number without it.

Where to start: an account priority list

Phishing lures aimed at the trades

Nine in ten US adults think people often or sometimes pretend to be someone else to steal personal information by phone or online^[5]. They are right, and the lures aimed at contractors are predictable. Train everyone who handles email or the phones to recognize these:

• A supplier statement or invoice with a link to view it, from an address that is one letter off.
• A notice that your business listing will be suspended unless you sign in through the link.
• A permit office, utility or city department asking for payment through an unfamiliar portal.
• A new customer who sends job photos as a zipped attachment or a document that asks you to enable content.
• A pop-up or call claiming your computer is infected and asking for remote access.
• A text that looks like it is from the owner asking the office to buy gift cards for a client.

Phishing complaint counts to IC3 have fallen since 2022, but the category still led all others in 2024^[1]. The habit to build is simple: never sign in or pay from a link in an unexpected message. Open the site or app yourself, or call a number you already trust.

Technician phones and shared devices

Field devices carry customer addresses, gate codes and photos of the inside of people's homes. Treat them as business records. Require a screen lock, turn on find-and-erase, give each technician their own login to the field app and avoid shared accounts that nobody can audit. When someone leaves, run the same offboarding list every time: collect or wipe the device, remove app and email access, change any shared codes they knew and update the voicemail or call routing that pointed to them.

Collect less customer data, and keep it in fewer places

Every copy of customer information is something you have to protect. Keep customer records in your field service or CRM system rather than in spreadsheets, personal email and phone photo rolls. Never ask customers to email or text card numbers; use a payment link or a card reader that keeps the number out of your hands. Delete old exports and downloaded reports once the job they were made for is done.

The same rule applies to new tools. Before connecting a chat widget, call recording service, marketing platform or AI assistant to your customer list, ask what data it will hold, who at the vendor can see it and how you get it deleted when you stop using the service. A short written answer is a good sign; a vague one is a reason to wait.

Example: an inbox takeover that did not happen

Example: the office manager at a fictional six-person heating company clicks a link in what looks like a shared document from their parts supplier and types her email password into a convincing sign-in page. Because the account requires an authenticator app, the attacker's sign-in stalls at the second step and her phone shows an unexpected approval request. She denies it, changes the password from a different device and tells the owner. The owner checks the account for new forwarding rules, finds none, and sends a short note to the supplier so they can warn other customers. Total time lost: about twenty minutes.

Without MFA, the same click often ends with a hidden forwarding rule that copies every invoice to the attacker for weeks. That is the setup for the payment fraud described in our guide to fake invoice and payment scams.

Your one-page incident plan

1. If money went out: call your bank's fraud line immediately and ask for a recall of the payment. Speed matters more than paperwork.
2. Disconnect any affected computer from the network, but do not wipe it yet.
3. From a clean device, change the password on the affected account and sign out all sessions.
4. Check email for forwarding rules, new filters and sent messages you did not write.
5. Report the incident to the FBI at ic3.gov and keep a record of what happened and when.
6. Review your state's breach notification rules if customer information was exposed, and get legal advice if you are unsure.
7. Tell staff what happened and what to watch for, then fix the gap that allowed it.

Print the plan and keep a copy away from the computer. When an incident happens, the computer may be the one thing you cannot use. If you are adding new software that stores customer calls or messages, read our AI vendor data privacy questions before you sign.

A 30-day rollout for a small office

• Week 1: turn on MFA for email and banking for every user; add a carrier account PIN.
• Week 2: set up a password manager, move shared logins into it and give each technician their own field app login.
• Week 3: confirm automatic updates on every device and set up backups; do a test restore of one file.
• Week 4: write the payment verification rule and the incident plan, and run a fifteen-minute team briefing on the lures above.