Cybersecurity for consultants who hold their clients’ keys

Protection for HR, management, and marketing consultants of 1 to 9 people who handle employee records, shared logins, and client ad accounts.

You’re trusted with the keys

Your clients give you access to their people, their systems, and their money. That trust is part of why you’re hired, and it’s also why you’re a target. Attackers don’t need to break into a small business if they can break into the consultant who already has the door code.

What’s happening right now

Impersonation is the most common approach. An attacker gets into a consultant’s email, then sends urgent requests to clients or staff: a new bank account for a vendor payment, a password reset, or a “quick” change to an ad budget. The message comes from a familiar address and references real work, so it rarely looks suspicious.

Marketing consultants face a different risk. A compromised Google Ads, Meta, or email marketing account can spend a client’s budget, send fake messages to their customer list, or lock the business out of its own accounts. Recovery can take days, and the damage often lands before anyone notices.

HR consultants hold the most sensitive data in the room: Social Security numbers, payroll records, and personnel files. A breach here is a serious problem for your client, and it can become a legal one for both of you.

The lesson: a request to change access, move money, or send employee records is a reason to verify by phone, not a reason to hurry.

Four habits that close the most common gaps

1. Verify every change to money or access by phone. Bank details, ad budgets, admin rights, and payroll changes get confirmed by calling a number you already have on file, never by replying to the email.

2. Stop sharing logins. Shared passwords for client tools make it impossible to know who did what, and one leaked password exposes everyone. Give each person their own login. A free, open-source password manager like Bitwarden makes this manageable on a small budget.

3. Turn on multifactor authentication everywhere that matters. That includes your email, your client accounts, ad platforms, social profiles, payroll and HR systems, and cloud storage. Many consultants protect email and forget the accounts that actually spend money.

4. Limit what you keep, and remove access when work ends. Hold employee records only as long as you need them and store them in one secure place. When a client engagement ends, remove your access to their systems, and ask them to confirm it.

Six Threats:
Learn how to spot them

Impersonation of You or Your Client

A client or vendor asks you to change a bank account, payment, or contact detail on an urgent basis.
A message that sounds like your client, but arrives from a slightly different address.
A request to skip your usual approval step because “the boss is in a meeting.”

Phishing / Account Takeover

Password reset emails for accounts you didn’t request.
Logins to your email, ad, or social accounts from places you’ve never been.
Messages sent from your account that you don’t remember writing.

Ad Account and Social Media Hijacking

Ad spend jumping without a campaign change you made.
New admins, payment methods, or pages added to a client’s account.
Sudden posts, emails, or messages sent to a client’s customer list.

Shared and Reused Logins

Several people using the same password to access a client’s tools.
Passwords reused across clients or across your personal and business accounts.
No record of who made a change inside a client’s system.

Employee Data Exposure

Payroll or personnel files stored in email attachments, shared drives, or personal devices.
Employee records sent to someone who doesn’t need them for the job.
Old client files kept long after the engagement ended.

Third-Party / Vendor Compromise

A payroll, HR, or software vendor reports unusual activity in their system.
A subcontractor asks for access to a client’s systems outside the agreed process.
A portal or login request arrives by email instead of through the official platform.