Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The practical answer: require multifactor authentication (MFA) for every company account, give administrators and finance staff phishing-resistant security keys, authenticate your sending domain with SPF, DKIM and DMARC, and make every payment or credential change subject to an out-of-band verification call. Then monitor mailbox activity and maintain a written response procedure for suspected compromise. These controls reduce the chance that one stolen password becomes a fraudulent wire transfer, altered invoice or hijacked project conversation, but they do not eliminate the need for monitoring and rapid response.
Why construction-company email needs a specific security routine
Construction businesses combine office staff, project managers, estimators, payroll and accounting teams with supervisors, subcontractors and field crews working from phones or shared jobsite devices. Email often carries contracts, change orders, schedules, insurance certificates, invoices and bank details. An attacker who takes over one mailbox can impersonate a project executive, watch a vendor conversation, create a believable payment request and hide replies from the real employee.
Phishing is the initial deception: a message tries to make someone reveal a password, approve a sign-in, open a malicious attachment or visit a counterfeit sign-in page. Business email compromise (BEC) can follow without malware. The criminal may simply use a stolen session or password to read a thread and send convincing instructions. Spoofing is different: a forged message is made to appear to come from your domain even when the attacker does not control a mailbox. Account takeover and spoofing require different controls, so a complete program addresses both.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallThe controls below are written for a small or midsize contractor, but the sequence also works when an outside IT provider administers the mail system.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
1. Block account takeover with MFA and disciplined identity management
Require MFA for every account
Password-only email is not an adequate baseline. Enforce MFA for employees, temporary workers, contractors and field staff who use company identities on mobile devices. Apply the requirement to email, file storage, remote-access tools and administrative consoles, not only to the inbox.
Start with global administrators, executives, payroll, accounts payable, estimating and anyone who can change vendor or banking information. Enroll the remaining workforce in a short, scheduled rollout and track exceptions until coverage is complete. CISA’s small-business guidance states: “Businesses should aim to use a phishing-resistant MFA method.” MFA lowers the chance that a phished password is enough to enter an account, but sign-in monitoring and response remain necessary.
Choose the strongest method your work conditions support
| MFA method | Phishing resistance | Field and office considerations | Recovery planning |
|---|---|---|---|
| FIDO2/WebAuthn security key | Strongest option presented in CISA guidance; designed to resist counterfeit sign-in sites | Confirm that the email service, browsers and devices support the key. Check USB and NFC connections before purchasing. A phone may need NFC or a compatible adapter. | Issue and register a spare key where the provider permits it, or document a secure identity-verification recovery process. |
| Number-matching authenticator approval | Stronger interim choice than a simple “approve” push, because the user must match the number shown on the sign-in screen | Usually practical for office and mobile users, but users still need to inspect the sign-in they are approving. | Maintain backup enrollment and a staffed process for a lost or replaced phone. |
| Ordinary authenticator push | Weaker than number matching because attackers can repeatedly prompt a user until one approval is accepted | Easy to deploy, but train workers never to approve an unexpected request. | Have a documented replacement-device process and review suspicious approval activity. |
| SMS or email code | Weaker fallback; vulnerable to interception, account recovery abuse or takeover of the alternate channel | Useful only when stronger methods cannot be deployed immediately. | Treat it as a temporary exception and set a date to move the user to a stronger method. |
Security keys are standards-compatible physical products, not a particular brand. Before deployment, test them with the company’s email platform, browsers, desktop operating systems, mobile devices and account-recovery rules. Keep a spare key under controlled custody rather than leaving recovery dependent on a single employee’s phone.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Make passwords and account lifecycle part of the control
- Use long, unique passwords for every service. A business password manager can help generate and store them when it fits your operating model.
- Never reuse an email password for accounting, project-management or personal services.
- Define joiner, mover and leaver steps: create the right access for a new hire, remove old privileges after a role change, and disable accounts and active sessions promptly when someone leaves.
- Review administrator and delegate access at regular intervals. Remove dormant accounts and unneeded mailbox permissions.
- Protect recovery email addresses, phone numbers, authenticator registrations and app passwords as carefully as the primary password.
Do not treat MFA enrollment as complete until you know who can recover an account, how that person is verified and how a lost device or security key is replaced.
2. Make impersonation of your company domain harder
Inventory every legitimate sender first
Ask the domain administrator to list every service that sends mail using your company domain. Include the main email platform, accounting and invoicing systems, project-management tools, website forms, payroll systems and marketing services. Include legacy systems and equipment that sends alerts. An incomplete inventory can cause legitimate invoices or forms to fail after enforcement is tightened.
Configure SPF, DKIM and DMARC in that order
- SPF: publish an SPF record that authorizes the actual sending services in your inventory. Do not paste a generic record. Google notes that forwarding can affect SPF and that the record must account for all authorized senders.
- DKIM: enable cryptographic signing for each service that supports it and publish the required public key in DNS. Verify that messages are being signed with your domain.
- DMARC: publish a policy for your domain and specify where aggregate reports should be delivered. DMARC evaluates whether the visible
Fromdomain aligns with the domain authenticated by SPF or DKIM. - Monitor before enforcing: review aggregate reports and alignment failures. Identify legitimate senders that are failing before moving from a monitoring policy toward quarantine or rejection.
Forwarding, mailing lists and third-party senders can produce failures that are not evidence of an attack by themselves. The goal is to understand the sending ecosystem first, then increase enforcement without disrupting project or payment mail.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
| Control | What it addresses | What the administrator must verify |
|---|---|---|
| SPF | Whether a sending server is authorized to send for the domain | All current senders are included and the record remains within DNS and provider limits. |
| DKIM | Whether a message carries a valid signature from an authorized service | Each service is signing and the published key matches the service configuration. |
| DMARC | Whether the visible sender identity aligns with SPF or DKIM and what receivers should do on failure | Reports are reviewed, legitimate failures are corrected, and quarantine or rejection is introduced deliberately. |
3. Use a verification routine that works on a jobsite
A familiar display name, an existing email thread or a real project number does not prove that a message is genuine. A compromised mailbox can give an attacker all three. Make verification a normal business control, not a judgment call left to a busy superintendent or accounts-payable clerk.
Require a second channel for high-impact requests
- Changed bank or payment details
- Urgent wire, ACH or check requests
- Requests to change a subcontractor’s remittance address
- Password-reset or MFA-reset instructions
- Unexpected links to shared drawings, contracts or payroll files
- Requests to bypass an established approval process
Call a known number from your vendor master, contract or previous records, or use a previously established contact channel. Do not use the phone number, QR code or link included in the message being checked. If the request came from an executive, confirm it through a separate channel and require the normal approval record.
Give workers a simple pause-and-report script
- Pause when a message is unexpected, urgent, financially consequential or asks for credentials.
- Inspect the sender address, reply-to address, link destination and attachment type. A mismatched link or look-alike domain is a warning sign.
- Do not open an unexpected attachment or enter credentials after following a message link.
- Verify the request with a known contact method.
- Use the platform’s Report phishing control or the company’s single agreed reporting channel.
Tell employees that reporting a suspicious message is rewarded, not punished. A fast report can let an administrator search for similar messages and warn other recipients before anyone pays an invoice or enters a password.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
4. Choose cloud email and outside support according to capability
Hosted email is not secure by default. It can be a practical choice for a small company that cannot reliably maintain servers, patching, backups and identity controls on-premises, but the tenant still needs MFA, domain authentication, logging and administrative safeguards. CISA has advised small businesses that struggle to maintain on-premises email and file systems to consider a secure cloud service such as Microsoft 365 or Google Workspace.
When comparing an email platform or managed IT provider, evaluate the controls rather than the product name:
| Capability | Questions to ask |
|---|---|
| Identity and MFA | Can every user, contractor and administrator be required to use MFA? Are FIDO2/WebAuthn keys supported? How are lost devices and recovery requests verified? |
| Domain authentication | Who maintains SPF, DKIM and DMARC when a new invoicing, payroll or project service is added? |
| Visibility | Can administrators review sign-ins, mailbox audits, forwarding, inbox rules, OAuth grants and message traces? |
| Control of external access | Can unknown forwarding destinations, app passwords, delegated access and third-party applications be removed quickly? |
| Incident response | Who is available during an incident, what can they disable or revoke, how is evidence preserved, and how are affected recipients notified? |
| Operational fit | Does the support model cover jobsite connectivity, mobile devices, project workflows and finance approvals? |
Ask any managed provider to document its service scope, response availability, recovery practice and responsibilities. “We host the mailbox” is not the same as “we monitor and respond to account compromise.”
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
5. Recognize signs that a mailbox may be compromised
One symptom is not proof, but several together justify immediate investigation. Microsoft’s and Google’s compromise guidance highlights these signals:
- Sign-ins from an unfamiliar location, device or time, especially when the employee was not traveling.
- Unexpected lockouts, password-reset notices or MFA prompts.
- Messages in Sent or Deleted Items that the user did not create.
- Missing incoming mail, especially replies from vendors or finance contacts.
- New inbox rules that move, delete or mark messages as read.
- External forwarding destinations that no administrator approved.
- Changed profile details, recovery options or alternate addresses.
- Unrecognized app passwords, OAuth grants, delegated mailbox access or connected applications.
- Vendors or project partners reporting unusual requests from the employee’s address.
Review administrator audit logs, email logs, recent sign-ins, filters, forwarding settings, recovery methods and suspicious messages. These are investigation signals, not conclusive evidence on their own.
6. Respond quickly when takeover is suspected
Use the current incident process for your email provider; exact screens, labels and log-retention periods vary by platform and subscription. The following order preserves visibility while containing the account.
- Open an incident record. Note when the report arrived, who observed it and which mailbox or message is involved. Preserve suspicious messages, headers, screenshots and relevant audit records.
- Contain the identity. Disable or temporarily suspend the affected account when appropriate. Stop active sessions and revoke access or tokens where the platform supports it.
- Secure credentials and recovery. Reset the password, require fresh MFA enrollment if needed, review recovery email addresses and phone numbers, and remove unknown app passwords or authenticator registrations.
- Remove persistence. Delete unauthorized forwarding, inbox rules, filters, delegates, OAuth grants and other external access. Check whether an attacker created a second administrative account.
- Determine the exposure. Inspect recent sign-ins, Sent and Deleted Items, message traces, audit logs and mailbox searches. Identify fraudulent messages, their recipients and any attachments or links that were opened.
- Warn affected people through trusted channels. Contact employees, vendors, project partners and finance staff using known phone numbers or established channels. Tell recipients which messages to ignore and which payment instructions must be revalidated.
- Recover and monitor. Restore the user’s access only after controls are reset, then watch sign-ins, forwarding, rules, sent mail and authentication events for renewed activity.
- Improve the process. Record the entry point, failed control and corrective action. Update training, approval rules, domain authentication or provider settings before closing the incident.
Do not rely on deleting the attacker’s sent messages as proof that the incident is over. A token, forwarding rule or third-party grant can survive a password change unless it is separately revoked.
7. Build a repeatable email-security program
At onboarding and role change
- Assign only the access required for the employee’s role.
- Enroll MFA before the first sign-in and record the recovery path.
- Explain payment verification, suspicious-link handling and the reporting button.
- When duties change, remove old mailbox delegates, finance access and administrative privileges.
At departure
- Disable the account and revoke active sessions promptly.
- Transfer business records through an approved process rather than sharing the departing user’s password.
- Remove forwarding, delegates, application access, recovery methods and security keys that should no longer work.
- Review recent sign-ins and sent mail if the departure was contentious or unexpected.
Every month or quarter
- Review MFA coverage and privileged accounts.
- Inspect sign-in and mailbox audit alerts.
- Check SPF, DKIM and DMARC reports for new legitimate senders and alignment failures.
- Test the phishing-report route and a payment-change verification call.
- Confirm that backup security keys and incident contacts are still available.
Use a short, written checklist that an office manager can follow when the usual IT contact is unavailable. The checklist should name the identity administrator, finance approver, provider support path and trusted contacts for major vendors.
What these controls can—and cannot—promise
Phishing-resistant MFA makes stolen passwords less useful, domain authentication makes many forged messages easier for receiving systems to reject, and independent verification blocks a large class of payment fraud. None of these controls guarantees that a user will never click a malicious link or that a compromised supplier will never send a credible request. The objective is layered resistance: prevent takeover, make impersonation harder, detect abnormal mailbox behavior and limit the time and money available to an attacker.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →
