A quiet change has happened to the way small businesses log in to things. The bank, the payment system, the supplier portal, the email itself increasingly refuse to let anyone in on a password alone; they send a short code to a phone and ask for it back. This is a genuine improvement and worth having, because it means a stolen password is no longer enough on its own. But it introduces a new single point that most businesses have never written down: the phone number that receives those codes, and the person holding the phone it arrives on.
The trouble is that the number is usually chosen once, casually, and then forgotten. It is whichever mobile happened to be to hand when the account was set up. Very often that is a personal phone belonging to one particular person, and just as often that person is no longer the one who should have it, or is no longer with the business at all. Nobody notices, because the codes keep arriving and the logins keep working, in exactly the way that a problem waiting to happen always looks like no problem at all.
The day it matters is the day that person is unreachable and a code is needed. The phone is lost, the number was ported to a new provider, the member of staff left on bad terms, or is simply on holiday somewhere with no signal. Now the account cannot be entered by anyone, and recovering it means proving ownership to a company that is deliberately hard to convince, precisely because being hard to convince is the security feature. A business can find itself locked out of its own bank access over a weekend because of a number nobody thought about.
The fix is a short review that pays for itself the first time it saves a lockout. For each important account, find out which number or which app receives the second step, and ask whether the business — not an individual — controls it. Where the option exists, point it at a number or an app the business owns and more than one trusted person can reach, and record backup codes somewhere safe rather than leaving them unread in an email. The goal is not more security theatre; it is making sure the thing protecting the account cannot itself walk out of the door.