Cyber Security for Sole Traders and Freelancers: Protect Your Money, Clients and Devices

When you work for yourself, you are the IT department, the finance team and the data protection officer, and one hacked email account can cost you a client payment, your reputation and weeks of work. This guide is for sole traders, freelancers, contractors and other one person businesses: designers, tradespeople, consultants, bookkeepers, therapists, photographers and anyone who invoices clients and keeps their details on a phone or laptop. It focuses on the three things that go wrong most for one person businesses: fake or altered invoices, taken-over accounts, and lost or compromised devices holding client data. Everything here can be done without technical help, mostly in an afternoon. If you employ staff or run an office, the Small Business Cybersecurity Basics Guide covers the wider picture.

Key takeaways

• Your email is the master key. Whoever controls your email can reset your bank, accounting and social media passwords, and can send invoices that look like yours. Protect it first, with a unique password and 2-step verification.
• Bank details change by phone, never by email. Agree with every client and supplier that you will confirm any change of bank details on a number you already know.
• Client data makes you a data controller. Sole traders who use personal information generally need to pay the ICO data protection fee and must look after that data under UK GDPR.
• Two backups, one disconnected. Keep one copy in the cloud and one on an external drive you unplug, and test that you can get files back.
• Know who to call. Report lost money to your bank straight away, then to Report Fraud (or Police Scotland on 101), and forward scam emails to [email protected].

Why one person businesses are different

NCSC guidance for small organisations says small businesses are as likely to experience online crime as larger ones, and that about half suffer a cyber incident every year. A one person business has some specific weaknesses that larger firms avoid.

Invoice and payment fraud: the biggest money risk

Invoice fraud hits sole traders from both directions. Criminals pretend to be you to your clients, or pretend to be a supplier, a platform or HMRC to you. The detailed controls for organisations are in the Invoice Redirection and Supplier Bank Detail Fraud Guide; here is what matters for one person.

Criminals impersonating you

If someone gets into your email, they can read your conversations, wait for an invoice to be due, then send your client a message "from you" saying your bank details have changed. Sometimes they set up a lookalike address that differs by one letter instead. Your client pays the criminal, and you do not get paid.

• Put a warning on every invoice: "We will never change our bank details by email. If you receive a message saying our details have changed, call us on [number you have on file]."
• Tell clients at the start: include the same statement in your terms or welcome email so it is expected.
• Check your mail rules: attackers who get into an account often add a rule that forwards or hides messages. Look at your forwarding and filter settings every month.

Criminals targeting you

• Fake supplier or subcontractor invoices: a "new bank account" request from a regular supplier. Call them on a number from an old invoice or their website, not the number in the email.
• Fake tax messages: self-employed people receive texts and emails claiming a tax refund or penalty. Log in to your tax account directly rather than following a link. See the Tax Identity Theft and Tax Scams Guide.
• Fake clients and overpayments: a new client "accidentally" overpays and asks for a refund to a different account. Wait until the original payment has fully cleared and refund only to the account it came from.
• Platform and marketplace scams: messages asking you to move a job off a freelance platform, or to "verify" your account through a link.

When you pay someone new, your bank may show whether the name you entered matches the account holder. Treat a "no match" or "close match" as a reason to stop and call, not to tick through.

Lock down your accounts

NCSC advice for individuals and small businesses comes down to the same steps: a strong separate password for email, 2-step verification (2SV), a password manager and prompt updates. For a sole trader the order matters. Start with the accounts that can reset everything else or move money.

• 2SV choices: NCSC notes 2SV can use text codes, authenticator apps, biometrics, card readers or security keys. Text codes are better than nothing; an authenticator app or a passkey resists phishing and SIM swap better. See the SIM Swap Fraud Guide.
• Password manager: let it create and remember a different password for every site, so one leaked password does not open the rest. See the Password Manager Setup Guide.
• Recovery codes: when you turn on 2SV, save the backup codes somewhere that is not your phone, for example printed in a locked drawer. If the phone is lost, those codes are how you get back in. See the MFA backup codes and recovery codes guide.
• Separate business and personal: a dedicated business email address (ideally on your own domain) means a hacked personal account does not expose client conversations, and the reverse.

Client data and your legal duties

If you keep client names, addresses, phone numbers, photos, health details or financial information, you are handling personal data. The ICO says organisations, including sole traders, that use personal information need to pay a data protection fee unless they are exempt; its online self-assessment takes about five minutes to tell you whether you must pay.

• Keep only what you need: delete old client records you no longer need for work, tax or legal reasons. Data you do not hold cannot leak.
• Know where it is: email, accounting software, a notes app, a spreadsheet, WhatsApp, a paper diary. List them once so you know what to protect and what to tell clients if something is lost.
• Share safely: send sensitive documents through a shared folder with access limited to the client, not as email attachments that live forever in two inboxes.
• Breaches: the ICO describes a personal data breach as including a lost USB stick, data sent to the wrong address, a stolen laptop or hacking. Under UK GDPR, a breach likely to put people at risk must be reported to the ICO within 72 hours of you becoming aware of it, and you should keep a note of any breach even if you decide it does not need reporting. The ICO has a phone helpline and an online form.
• Special care work: therapists, coaches, tutors working with children and anyone holding health information carry higher risk. Use device encryption, strong screen locks and avoid personal messaging apps for sensitive detail. See the UK GDPR and Data Protection Act 2018 Guide.

Protect your phone and laptop

For most freelancers the laptop and phone are the whole business. If either is stolen, broken or infected, you lose access to email, files, 2SV codes and banking at once.

• Old devices: phones and laptops that no longer receive updates should not be used for banking or client data. Before selling or recycling, sign out of accounts and reset the device to factory settings.
• Working away from home: on café, train or hotel Wi-Fi, use your phone's hotspot for banking and client systems if you are unsure about the network. See the Public Wi-Fi Safety Guide.
• Home router: change the default admin password and keep its software up to date. See the Securing Your Home Router Guide.

Backups you can actually restore

NCSC advice for small organisations is to back up everything the business needs to run: website, emails, invoices, documents, contacts and customer information. It recommends two copies for extra safety, one in the cloud and one on an external drive or USB stick that you keep somewhere secure and disconnect when not backing up, because some malware spreads to connected devices. Protect the cloud backup with 2SV and practise restoring a file so you know the backup works.

• Accounting records: export a copy of invoices and accounts from your software every quarter, so you are not stuck if you lose access to the service.
• Phone: turn on the phone's own cloud backup so photos, contacts and messages survive a lost handset.
• Test: twice a year, restore one folder from each backup to a different place and open the files.

A one afternoon setup plan

1. Email (30 minutes): new strong password, turn on 2SV, save recovery codes offline, check forwarding rules and recovery details.
2. Bank (15 minutes): payment alerts on, daily limit set, banking app updated.
3. Password manager (45 minutes): install it, then change the passwords for the six priority accounts above, turning on 2SV as you go.
4. Devices (30 minutes): check screen lock, encryption, automatic updates and find-my-device on phone and laptop.
5. Backups (30 minutes): set up cloud backup, do a first copy to an external drive, unplug it.
6. Invoices and terms (15 minutes): add the bank details warning to your invoice template and client terms.
7. ICO (10 minutes): complete the data protection fee self-assessment and pay if required.

Then keep a short monthly routine: install pending updates, check mail forwarding rules, look at recent bank payments and confirm last month's backup ran. NCSC also offers the free Cyber Action Toolkit with bite-sized actions for sole traders, the free Check your cyber security service that looks for common weaknesses in public-facing IT such as a website, and Exercise in a Box for practising what you would do. Clients who require it may ask for Cyber Essentials certification; see the Cyber Essentials Guide.

How to tell it is working

• Accounts: all six priority accounts have 2SV turned on and a unique password.
• Payments: every bank detail change in the last year was confirmed by phone, and no payment went out on an email request alone.
• Devices: no pending updates older than two weeks on phone or laptop.
• Backups: last successful restore test within six months.
• Alerts: you receive and read login alerts from your email provider and payment alerts from your bank.

If something goes wrong

• Money sent to a fraudster: call your bank immediately using the number on your card; speed improves the chance of recovery. Then report to Report Fraud (reportfraud.police.uk or 0300 123 2040) in England, Wales and Northern Ireland, or Police Scotland on 101.
• Email or account hacked: use the provider's recovery process, change the password, sign out all sessions, remove unknown forwarding rules and 2SV devices, then warn clients not to act on recent payment requests. See the Hacked Social Media or Email Account Recovery Guide.
• Scam emails and websites: forward suspicious emails to [email protected] and report scam websites using the NCSC online form.
• Client data exposed: decide quickly whether the breach is likely to put people at risk, and if so report to the ICO within 72 hours.

Common failure patterns

• Paying or changing bank details on an email alone, even one that appears to come from a known address.
• Reusing one password for email, accounting software and shopping sites, so one leak opens them all.
• 2SV codes only on the phone with no backup codes, so a lost phone locks you out of your own business.
• The external backup drive left plugged in and encrypted along with everything else.
• A former web designer or bookkeeper still controls the domain, website admin or accounting login.
• Client data spread across personal apps, so nobody can say what was exposed when the phone was stolen.

Framework mapping

Practitioner checklist

• Business email has a unique password, 2SV and offline recovery codes.
• Bank payment alerts and a sensible daily limit are set.
• A password manager holds a unique password for every business account.
• Invoices and terms say bank details are never changed by email.
• Any change of payee details is confirmed by phone on a known number.
• Phone and laptop have screen lock, encryption, automatic updates and find-my-device.
• Cloud and disconnected external backups exist and a restore has been tested.
• ICO fee self-assessment completed and client data kept only as long as needed.
• Domain, website and accounting logins are in your own name.
• Reporting contacts (bank, Report Fraud, [email protected], ICO) are written down offline.

Standards and references

• NCSC: Cyber security advice for self employed and sole traders
• NCSC: Small Business Guide
• NCSC: Backing up your data
• NCSC: Top tips for staying secure online
• NCSC: Turn on 2-step verification
• NCSC: Report a scam email
• ICO: Data protection fee
• ICO: Report a personal data breach

Related NHI Mgmt Group resources: Small Business Cybersecurity Basics Guide · Invoice Redirection and Supplier Bank Detail Fraud Guide · Small Business Cyber Security Checklist · Free Cyber Security Services and Tools for Small Organisations Guide