Hackers have gotten smarter, and they’ve found ways around basic 2FA. If you’re still relying on text message codes and thinking you’re fully protected, you’re vulnerable.

Here’s the problem: Two-factor authentication (2FA) used to be the top recommendation for protecting your accounts. In 2025, it’s just the starting point. Hackers have found ways around basic 2FA.

The numbers are staggering. Nearly 94 billion stolen browser cookies are circulating on the dark web right now. Over 20% of them are still active, meaning they can be used to hijack accounts. In 2024 alone, cybercriminals stole 17.3 billion session cookies from infected devices.

The FBI issued a warning in late 2024 about criminals stealing “Remember Me” cookies to bypass MFA completely and take over email accounts. This attack method works because stolen session cookies let hackers access your accounts without needing your password or 2FA code. They just ride your existing login session.

Two-factor authentication adds a second layer of protection to your online accounts. Instead of logging in with just a password, 2FA requires something else: a code sent to your phone or a tap of approval in an app.

That sounds secure, but hackers adapted.

Text message codes are particularly vulnerable. Through SIM swapping, criminals trick phone companies into transferring your number to a new SIM card. Once they control your number, they receive your 2FA codes and can take over your accounts.

But SMS codes aren’t the only problem. Even app-based authenticators can be compromised through:

• Infostealer malware: Malicious programs that silently extract passwords and session cookies from your device. These often spread through phishing emails disguised as sponsorship offers or partnership opportunities.
• Password reset exploits: Many platforms don’t require 2FA after a password reset, creating a backdoor for attackers.
• Session cookie theft: This bypasses 2FA entirely. When you select “Remember Me” on a website, that cookie stores your authenticated session. If stolen, an attacker can access your account without triggering any security alerts.

The uncomfortable truth? Basic 2FA was designed for threats from 10 years ago. Today’s hackers have moved past it.

Modern account security requires layered defenses. Here’s what stops today’s threats:

A hardware security key is a physical device about the size of a thumb drive. You plug it into your computer or tap it on your phone when logging in. Without physical possession of this key, nobody can access your account remotely.

Popular options include YubiKey and Google Titan. This isn’t just “better” protection. It’s the only method that hackers can’t bypass remotely because it requires physical access.

For your business email, bank accounts, and any platform that holds customer data, hardware keys should be mandatory. Keep one for daily use and store a backup securely at your office or home.

Google is increasingly automating small business tools without warning. While some of these updates improve visibility or insights, others interfere with customer experience. The AI call assistant is one of the first features that can actively filter leads without your input. This hands-off approach doesn’t work in a service-based industry where live communication builds trust.

If AI becomes the default contact method and no one is monitoring the inbox, trust erodes and responsiveness scores drop.

Passkeys use cryptographic security stored on your device. Unlike passwords, passkeys can’t be phished, stolen, or guessed. They use your phone’s biometric authentication (fingerprint or face scan) to verify it’s really you.

Over 95% of iOS and Android devices are now passkey-ready. Google, Microsoft, and Apple all support passkeys, and major platforms are rapidly adopting them. If your critical accounts offer this option, switch immediately.

Enterprise adoption is exploding. 87% of businesses have either deployed or are actively deploying passkeys because they work. Organizations report 90% improvements in security and 82% improvements in user experience after switching.

If you’re still using SMS codes, switch to an authenticator app like Google Authenticator, Authy, or Microsoft Authenticator. These apps generate time-based codes that change every 30 seconds and never travel through text messages.

This blocks SIM swapping attacks. However, remember this is your baseline, not your finish line. Authenticator apps can still be compromised if malware infects your device.

Different accounts need different protection levels:

• High-Risk Accounts (email, banking, payment processors): Require hardware keys
• Business Accounts (social media, CRM, marketing platforms): Use authenticator apps minimum, hardware keys preferred
• Lower-Risk Accounts: Authenticator apps are acceptable

Essential Security Practices Beyond 2FA

Security keys and passkeys work best alongside these practices:

• Add a PIN to your phone account. Call your carrier today. This makes SIM swapping significantly harder.
• Use a password manager. Every account needs a unique password. Let software handle it.
• Enable login alerts. Most platforms can notify you when someone logs in from a new device.
• Log out when finished. Those “Remember Me” cookies are a prime target. Log out completely, especially on business accounts.

• Keep software updated. Security patches fix vulnerabilities hackers exploit. Enable automatic updates.
• Install quality antivirus software. Infostealer malware is one of the biggest threats to your accounts. Good endpoint protection catches it before it steals your session cookies.
• Review account access regularly. Check which devices and apps have access to your accounts. Remove anything you don’t recognize.

Why Cybersecurity Matters for Small Businesses

Small businesses are prime targets precisely because hackers know you’re likely using outdated security. Your accounts contain client contact information, payment details, project files, and business communications. A breach can cost you money and destroy trust between you and your clients.

One compromised email account can give criminals access to your client database, financial information, the ability to impersonate you, and your other accounts through password resets.

The average small business data breach costs over $25,000 when you factor in recovery, lost business, and notification requirements. Spending 30 minutes upgrading your security now prevents months of cleanup later.

How to Upgrade Your Business Security This Week

Stop treating 2FA like it’s enough. Here’s what to do right now:

1. Order two hardware security keys (one primary, one backup) for $25 to $50 each. Popular options include:
   • YubiKey: Available at Yubico.com, Amazon, or Best Buy
   • Google Titan Security Key: Available at Google Store or Amazon
2. Add a PIN to your mobile phone account
3. Switch from SMS codes to an authenticator app on all accounts
4. Enable passkeys on platforms that support them
5. Install or update your antivirus software
6. Set up a password manager if you haven’t already

Start with your most critical accounts: email, banking, and any platform that stores customer information. Then work your way through everything else.

The Bottom Line on 2FA and Modern Security

With 94 billion stolen cookies circulating on the dark web and 17 billion more stolen last year alone, the threat is real and growing. The tools that actually protect you in 2025 are available, affordable, and easier to use than you think.

Don’t wait until you’re locked out of your own accounts to take this seriously.

Everbearing Services helps landscaping and green industry businesses grow through smarter marketing. Smart marketing starts with strong foundations, including cybersecurity that matches current threats. Protect your digital tools with modern security so you can focus on what you do best: growing your business and serving your clients.

Google quietly launched a new AI call assistant that answers phone calls made from Search and Maps. Instead of ringing your business line, it offers to take a message, transcribes it, and stores it in your Google Business dashboard. If you’re not checking that dashboard daily, you may never know a customer tried to reach you.

For landscaping companies that depend on quick phone responses, this feature adds friction that can result in missed opportunities. Worse, it may affect your visibility in local search if Google logs those unanswered messages as ignored leads.

When someone clicks the call button on your profile using a mobile device, the call may be routed through Google’s AI. The assistant tells the caller that you may be unavailable and asks them to leave a short message. That message is transcribed and sent to the “Messages” tab in your Business Profile, not your phone or voicemail.

Unless you are monitoring that inbox directly, you might never see the message. If a customer doesn’t get a live answer, they’ll usually call the next company on the list.

Imagine a homeowner with a broken sprinkler line looking for fast help. They search “landscaper near me,” tap your phone number, and expect to speak to someone. Instead, they hear a robotic prompt and hang up. The call never reaches your office. You only find out days later while reviewing your Google Business dashboard. By that time, the customer has already hired someone else.

• Landscaping leads often come from urgent requests. People are ready to book and want to speak with someone right away.
• AI screening slows down contact. If a customer is forced to leave a message with a bot, they may not trust the process and move on.
• AI messages are easy to miss. Google stores them in the dashboard, not your phone, CRM, or voicemail inbox.

Disabling Google’s AI call assistant helps protect your local ranking. Missed or unreturned AI-filtered messages can lower your responsiveness score, which affects your visibility in local search results. Keeping control of your call flow supports better SEO performance.

Google offers more than one call-related setting in your Business Profile. Some features help track responsiveness and improve your local ranking. Others, like the AI call assistant, may block live calls and delay lead intake.

• Keep Google’s core call tools enabled.Features like call history, caller ID, and missed call tracking support your responsiveness score and search visibility.
• Turn off only the AI call assistant.This setting, labeled “Let Google answer calls for you,” intercepts calls before they reach your phone and asks callers to leave a message with a robotic assistant.

To disable just the AI feature without affecting your ranking metrics:

1. Open your Google Business Profile
2. Go to the Callstab
3. Locate “Let Google answer calls for you”
   
4. Toggle it off

This lets you receive all live calls while preserving Google’s ability to track engagement and responsiveness. Customers reach you directly, and your local ranking performance stays protected.

Google is increasingly automating small business tools without warning. While some of these updates improve visibility or insights, others interfere with customer experience. The AI call assistant is one of the first features that can actively filter leads without your input. This hands-off approach doesn’t work in a service-based industry where live communication builds trust.

If AI becomes the default contact method and no one is monitoring the inbox, trust erodes and responsiveness scores drop.

• Monitor your Google Business dashboard weekly
• Check the Messages tab for any transcribed calls
• Track your missed calls manually
• Ask new customers how they reached you and whether they spoke to someone directly

AI filtering can create more harm than help when live contact is what wins landscaping jobs. The risk of letting automation block or delay leads is too high during busy months. Most customers will not wait for a reply, they will call the next company on the list.

Everbearing Services helps landscaping companies stay ahead of the digital changes that affect local visibility and lead flow. If your business relies on phone calls to book jobs, now is the time to review your profile settings and protect your intake process.

Search Engine Optimization, or SEO, has been a familiar tool for years. It focuses on helping websites rank well in Google’s search results. But a new approach is beginning to gain traction. Answer Engine Optimization, or AEO, is designed to help websites show up in AI-powered tools like Google’s AI Overviews, Siri, and ChatGPT.

This shift is important for landscaping companies that want to stay visible in search results as user behavior changes.

AEO, in contrast, focuses on providing direct, helpful answers to common questions. Search tools powered by AI extract responses from web pages and present them as summaries or spoken replies. The content that gets chosen is typically clear, concise, and easy to understand.

• Who does weekly lawn mowing near me
• When should I aerate my yard in Portland
• What is the difference between dethatching and power raking

Websites that include straightforward answers to these types of questions are more likely to be highlighted by AI tools. Landscaping companies that provide clear explanations and use natural language tend to perform better in this environment.

This means that even small adjustments to a service page can influence whether a potential client sees your company first or scrolls past it.

The most effective strategy today involves combining SEO fundamentals with AEO enhancements. This balanced approach gives your website more opportunities to be found, no matter how people choose to search.

To schedule a website checkup or get help updating your content for AEO, call or text (503) 212-6222. Everbearing Services can help you strengthen your online presence for both human readers and AI search tools.

Everbearing Services uses A/B testing as part of your digital marketing strategy. We compare the results and use our findings to optimize your content and increase your revenue.

Does A/B Testing Really Help Your Marketing Strategy?

What is A/B Split Testing?

A/B testing is a way to measure two versions of the same marketing efforts to see which one your audience responds to the most. You may have two different versions of an ad, email subject or even website copy line to test with your audience.

The concept of A/B testing didn’t start with digital marketing, but it has become a useful tool in measuring the performance of various marketing efforts.

Does A/B Testing Really Help Your Marketing Strategy?

Audiences respond to content in ways they may not realize. If they find something unappealing on a subconscious level, they are more likely to abandon the buying process or move on to a competitor. This unconscious bias is exactly why A/B testing is a necessary part of digital marketing strategy.

A/B testing works for all types of businesses. The results show you what works and what doesn’t work so you know how to move forward and see the results you want.

Ways to Use A/B Split Testing

There are a few different ways you can test segments of your audience to see how they respond best.

• Email subject lines: find out which subject lines get the best reader response.
• Landing page copy: determine if altering your landing page improves click-through rates.
• Ad creative and imagery: ensure your audience responds positively to your chosen design elements.
• Calls-to-action: test which types of CTA buttons motivate your audience to click.

Incorporate A/B Testing Into Your Digital Marketing Strategy

Measuring the metrics of your digital marketing efforts helps you tailor your content and pinpoint your target audience. A/B testing is a great way to get a closer look at what your audience prefers.
To learn more, reach out to Everbearing Services by calling 503-875-8364 or by filling out our online contact form.

This means that your mobile website is just as important as your desktop site. If your mobile website experience isn’t up to customers’ expectations, you stand to lose nearly half of your potential clientele.

What exactly is a mobile web experience? Simply put, it is the customer’s overall experience when using your mobile site.

This means both their first impression, as well as the thoughts they come away with after they are finished looking at your site.

So, what is it that makes a good mobile experience? When customers search online, they have three important needs that must be fulfilled:

A Mobile-Friendly Website  

Navigating mobile websites, unlike desktop, is not a universal experience. People scroll, swipe, and use the phone with their hands in many different ways. This means there are several things to consider when trying to create the perfect mobile version of your website, including:

• The differences in screen sizes between mobile devices such as smartphones and tablets
• If the website is ergonomic and easy to scroll through
• Does your website load quickly?
• Adapting pictures and other graphic elements to a mobile platform
• Does the website partner well or match your desktop website?

A Mobile-First Website

Having a responsive desktop website that people can use comfortably is no longer enough to stay relevant in search results. Over the past 5 years, search engines have changed to mobile-first indexing.

This means that search engines look at the mobile version of websites when they evaluate whether a page should be ranked highly on users’ search results. Why the change? Because the majority of people who used search engines are now searching from their mobile devices.

In March of 2021, Google took this philosophy even further when they removed desktop-only websites from indexing entirely. This means that if you don’t have a mobile-compatible site, you won’t be shown on search results.

Furthermore, creating a mobile-first website means that your site needs to be intuitive. If it is not designed with mobile users in mind, you run the risk of frustrating customers with unresponsive, hard-to-use sections of your site.

A Content-Filled Website

Many people make the common mistake of assuming that mobile sites ought to have different content than their desktop versions.

Many opt to keep their mobile website simple, thinking that they exist simply to complement their desktop platform. This couldn’t be further from the truth. Since search engines have moved to index mobile websites only, your mobile platform should be your highest priority.

If you want your website to rank in search results, your mobile website should have the exact same content as your desktop site. This means the same headings, same basic navigation, and ideally the same overall browsing experience.

Have questions about how to make your website mobile-first? At Trade Alliance Digital, our web design experts are happy to help. Contact us today for a free consultation about how you can improve your mobile site experience and grow your business.