Spoiler alert, you’re not too small. You’re the PERFECT size. Hackers love small businesses precisely because most of us don’t have a dedicated IT team, multi-factor authentication turned on everywhere it should be, or a game plan for what to do in that gut-punch first hour after something goes sideways.
Here’s the silver lining though. Most of the damage isn’t inevitable. It usually comes down to a handful of habits that are SO easy to skip… until the day you desperately, desperately wish you hadn’t. That’s something we think about a lot at Luma Accounting, headquartered in Portland, Oregon, because bookkeeping and accounting depend on the systems and processes behind the numbers.
We’re writing about this now because we watched two very real situations play out with clients recently. Same category of nightmare. Wildly different endings. Grab your coffee (or your second coffee, no judgment), let’s get into it.
Story one: the one that still makes us wince
A client’s Stripe account got hacked. Fully taken over, like someone walked right in and put their feet up on the desk. The attacker ran fraudulent charges on saved client cards, then moved money internally between two Stripe accounts like it was theirs to move.
Here’s the part that stung. Even after the owner tracked down a way to report the fraud and got a real human at Stripe on the phone, the account didn’t get locked down right away. More money moved hours after the report was filed. Hours.
We’re not here to drag Stripe through the mud, fraud moves fast and security at scale is hard to pull off. But this one’s proof that reporting the fraud is step one, not the finish line. You have to stay on it like it’s your full time job. Because in that moment, it is.
Story two: the one with a happy ending
A different client had their QuickBooks Online deposit account changed, and get this, they didn’t do a single thing wrong. Someone hacked into their CPA’s login, not ours, and used that access to quietly reroute deposits like a ghost.
That’s the blind spot nobody talks about. You can lock your own front door as tight as Fort Knox and still get robbed through your neighbor’s spare key.
The difference here was speed. Our team got QuickBooks Online on the phone immediately, confirmed what had happened, and shut it down before a single dollar moved. This is the version of this story we love telling. The one where Team Luma gets to be the hero.
“It won’t happen to us” is not a strategy, it’s a wish
Neither of these business owners was careless. Not even a little bit. Both got hit by sophisticated attacks on systems that are supposed to be secure. Running a small business right now means you can’t out-smart every attacker. What you can do is build a business that catches trouble fast when it inevitably slips through. And it will slip through. Ask anyone who’s been in this industry more than five minutes.
Six habits worth building into your routine, starting today, not “eventually”
- Turn on multi-factor authentication everywhere, including your accountant’s or CPA’s login, not just yours
- Set up transaction and login alerts on every financial platform you touch
- Verify any bank or deposit change by phone, using a number you look up yourself, never one sitting in the email or text asking for the change
- Don’t click links or open attachments in anything that looks off, unexpected, or comes from a sender you can’t verify. When in doubt, delete it or pick up the phone
- Use a password manager. The specific one matters far less than using one instead of reusing “Fluffy2019!” across six different logins
- Review who has access to your financial systems every quarter, including vendors and outside advisors
And if you get hacked, don’t wait, don’t panic-scroll Reddit for twenty minutes first. Report it immediately and get everything in writing.
None of this requires an IT department or a fancy budget. It requires making these habits part of how you actually run your business, instead of something you keep meaning to get to. Right after you reorganize the supply closet. Sure.
The bottom line
Good cybersecurity isn’t about becoming bulletproof. Nobody is, no matter what the software ads promise you at 2am while you’re doom-scrolling. It’s about shrinking the gap between something going wrong and someone catching it. Fast. Whether you’re running a construction crew, a law office, or something else entirely.
That’s a big part of why we built Luma around Accounting + Technology + Process instead of just bookkeeping. Catching a problem in the first hour instead of the third day is the whole point. Kind of our whole secret sauce. We serve small businesses across the U.S., and no matter where the business is located, that combination of accounting, technology, and process is what helps us spot the things that don’t look right.
If you want a second set of eyes on your financial security setup, we’re always happy to talk it through. BEST. EXPERIENCE. EVER, even when it’s about the stuff that could go seriously, terrifyingly wrong.
Luma Accounting serves small businesses across the U.S. with bookkeeping, accounting, job costing, and financial clarity support. If you want a second set of eyes on the financial side of your business, contact Luma Accounting.
