Today, I had the wonderful displeasure of spending an hour and a half frantically trying to get my Square account back under my control and protecting my other accounts. If you've ever been hacked in any fashion, and I'm sure you have, I know you can relate.
As soon as I realized I'd been hacked, I immediately began changing passwords on all accounts that were connected to our bank accounts.
Of course, I attempted to recover my account myself, but the hacker didn't change the password on our Square account, they changed THE EMAIL. I had no way to get in and recover my account myself because the password reset button was automatically going to the new email they created for our account. I had to get Square on the phone. It took a bit of work and more than one call to get to a person who could actually identify my account, get in there and fix it and then allow me to regain control. I'm sooooooooooooooooooo thankful that I was able to recover it and not permanently lose my access.
Now, I'm no hacker but I'm pretty smart for the average Joe when it comes to technology and I know what to look for and what looks suspicious. But in case you may not feel you're as smart as you could be against online threats, I want to pass along a couple of tips to look for in regards to a Square accounts specifically. Please keep in mind, we don't have a POS system, I sign in online and we use our phones because we're a mobile company, so I don't know how different it might be for those with brick and mortar or restaurants. I make no assumption that everyone in the community already knows these things or practices them, which is why I wanted to bring it up.
1. If you primarily use a POS in your business and you're not using the app, get the app, even if you don't use it for transactions. Why? Because although you cannot make account changes through the app, you can see your account email address and location. After I found out I was hacked, I opened the app to see what I could control. My original email was still in place. A short time later that changed. I could visibly see the email address the hacker changed it to and give it to Square in my report. Not long after that, the hacker signed me out of the account in the app but by then, the team was already on it and had my account frozen so that they couldn't do any more damage.
2. If you have the ability, use a private line, not associated with your business, for your verification codes. It will be much harder for the hacker to get access to your account when they cannot get that code. I was alerted to the fact that I was hacked when I received two text messages back to back from Square saying they were ready to help, just click the link and then almost immediately received the email confirming that my email address had changed. I'm the only person in our business who accesses the account, so I knew instantly that something was wrong. We have our account registered with our business phone of course, but our recovery number is personal.
3. As I said, and as we all obviously know, when you get hacked, change your passwords. Start with your back account because the first thing that the hacker takes is that information. It would be awful to lose your Square account and have to start over but dealing with the repercussions of losing a business bank account would be far worse.
4. When changing passwords, don't just think of things that are connected to your bank account, debit cards or credit cards. Don't forget any government accounts you have for payroll, Quickbooks, insurance or loan payments not associated with your bank. They all contain vital information that you don't want hackers to have. Also, don't forget your social media accounts. A lot of people think it's no big deal when your FB or IG account gets hacked. Most people fail to realize what hackers can get from those accounts and what false information they can put out online about you by getting control of them. If they can place you as the owner of the business they've just hacked, they've gained more than just access to your bank account.
Anymore it's not if you're going to get hacked, but rather when. Be vigilant and set up protocols ahead of time, have information in a safe place and know what to do in an emergency to protect your vital information.
I hope this information helps someone! Stay safe out there!
Co-Owner/Business Manager
Arctic Heat
R&C Property Management
Event Planner/Business Trainer
Member - Women in HVACR
Member - NAWIC; Mentorship Chair for MT Chapter
Square Champions Expert
