One Google Account Away From Losing Your Business
Start With One Question
If you lost access to your email tomorrow morning, how much of your business goes with it?
Most owners I talk to around Delray and Boynton have never actually run that thought all the way through. They should. I have sat with businesses doing seven figures a year whose domain name, phone system, accounting software, and Google Business Profile all trace back to a single free Gmail account somebody made in 2011. One phone number attached. No backup owner. No recovery codes anywhere.
That is a whole company balanced on one wobbly leg.
Passwords Aren’t the Weak Point. Recovery Is.
Everybody worries about their password getting stolen. Fine, that matters. But account recovery is the thing that actually takes businesses down, and almost nobody looks at it.
Think about how a reset works. You click forgot password, a link lands in your inbox, and thirty seconds later you’re back in. So whoever controls that inbox controls every single account attached to it. Your password strength stops mattering at that point. The lock is fine, somebody just has a copy of the key.
Here’s a partial list of what’s probably wired to yours right now:
- Your domain registrar (GoDaddy, Namecheap, whoever sold you the .com)
- Microsoft 365 or Google Workspace billing
- QuickBooks or your payroll provider
- Your bank’s alert notifications and sometimes the login itself
- Google Business Profile, the thing that puts you on the map when somebody searches for your service
- Your Facebook and Instagram business pages
- The camera system app
- Every SaaS tool your team signed up for with a card
Now picture that account being unreachable for two weeks. Not hacked, just unreachable. Phone stolen, number ported by a scammer, account flagged by an automated system, whatever. You cannot call Google. There is no branch office in West Palm you can walk into with your ID. That’s the part that catches people off guard.
How This Actually Goes Wrong
Three versions of this show up constantly.
The employee owns it. A marketing person or a nephew set up the Google Business Profile years ago under their own address. They’re gone now. They’re not answering. Your listing is frozen with old hours and an old phone number, and Google’s recovery process wants proof from the current owner, which is a slow and unpleasant process.
The phone is the whole plan. All the MFA is text messages to one cell number. Lose the phone, or let somebody talk your carrier into moving that number, and every code goes to them instead. That’s not theoretical, it happens to small business owners in South Florida regularly.
The recovery email is a dead end. Your business Gmail’s recovery address points to an old AOL or Yahoo account you haven’t logged into since 2014. Those providers delete inactive accounts. Somebody else can register that address and quietly become the recovery path for your entire company.
The Fix Takes About Two Hours
This isn’t expensive and it isn’t complicated. It’s just tedious, which is why it never gets done.
1. Write down what’s attached
Open your email, search for phrases like welcome to, your receipt, and confirm your account. You’ll be surprised. Make a list of every service that resets through that inbox. This list is worth more than any software you’ll buy this year.
2. Move business services onto business accounts
Your domain and your critical tools should live under an account at your own domain, something like [email protected], not a personal Gmail. If you already pay for Microsoft 365 or Google Workspace, you can create that in five minutes.
3. Add a second owner
Google Business Profile, Facebook, your registrar, and Microsoft 365 all support more than one admin. Add someone. A partner, a spouse, your IT provider, whoever you’d trust with the keys to the building. One human being should not be the only path back in.
4. Get off SMS codes for the important stuff
Use an authenticator app for MFA. Better yet, buy two hardware security keys (about $30 each), register both, and put one in a drawer at home. Text message codes are better than nothing, but a hardware key can’t be socially engineered out of your phone carrier.
5. Print your backup codes
Every major service gives you a set of one-time recovery codes when you turn on MFA. Almost nobody saves them. Print them, put them in a sealed envelope, and stick it in a fire safe or a bank box. Paper survives things the cloud doesn’t.
6. Give your recovery email one job
Create a separate address that exists only to be the recovery point. Don’t email anyone from it. Don’t sign up for anything with it. Turn on MFA there too. It’s a fire exit, not a room you live in.
7. Lock the registrar
Turn on registrar lock and enable two factor on that account specifically. Domain theft is quiet and it’s brutal, because your email stops working the same day your website does.
Do the Ten Minute Version Today
If you only do one thing after reading this: log into your primary email, go to security settings, and look at the recovery phone and recovery email on file. Are they current? Are they yours? Do you still have that number?
I’ve watched that single check catch a dead recovery address more than once. Ten minutes, no cost, and it removes the most common way a small business gets locked out of itself.
Not sure what’s attached to what? That’s a normal place to be, and it’s exactly the kind of mess we untangle. We map every account, every owner, and every recovery path for businesses from Delray Beach to West Palm, then hand you the documentation so it’s never a mystery again. Always happy to troubleshoot.