Short answer: Secure four things, in this order: the email address clients pay to, your payment platforms, your marketplace profiles, and any client accounts you have been given access to. Use an authenticator app everywhere, a passkey where offered, and never accept a client’s password over chat — ask for proper delegated access instead. Your reputation is the asset; a compromised account damages it faster than a bad review ever could.
Why freelancers are targeted more than they realise
A freelancer sits in an unusual position: small enough to have no IT department, connected enough to hold keys to other people’s businesses.
If you manage a client’s social accounts, ad accounts, website or store, your laptop is the softest route into an organisation that may spend serious money on its own security. Attackers know this. Agencies and contractors have been the entry point for a long list of business compromises.
Then there is the direct financial angle. Your email address is public on your portfolio. Your payment platform is guessable. Your invoices are predictable. That is enough for invoice fraud, where a client receives a convincing message from “you” with new bank details — and you find out weeks later when you chase a payment that was already made to someone else.
Priority 1: The email address on your invoices
Everything routes through here. Password resets, client communication, marketplace notifications, payment confirmations.
- Add a passkey or security key if your provider supports it — the strongest option, and immune to phishing. See phishing-resistant MFA.
- Otherwise use an authenticator app: Google, Microsoft.
- Remove SMS once the app works.
- Check forwarding rules and filters now, and again quarterly. A hidden rule quietly copying your client correspondence is the setup for invoice fraud, and it is invisible unless you look.
- Use a professional domain rather than a free address if you can — and then protect the domain too: securing your domain name with 2FA.
Priority 2: Where the money lands
Payment platforms, banking, and anything holding a balance.
- Strongest available second factor on each — Payoneer, PayPal, and your bank.
- Verify linked bank details periodically. Changing the payout destination is the highest-value move an attacker can make, and it does not look like theft until payday.
- Turn on every notification the platform offers. Alerts about changed details are your fastest warning.
- Put invoice bank details in a PDF and tell clients you never change them by email. One sentence in your onboarding, and it defeats invoice fraud almost entirely — because the client will call you before paying a changed account.
Priority 3: Marketplace profiles
Upwork, Fiverr, Freelancer, Toptal, 99designs — your reviews and job history live here, and they are not portable. Losing the account means starting over.
Enable 2FA on each, and check the email address on file is the protected one from priority 1. Also watch for the standard marketplace scam: a “client” who wants to move the conversation off-platform immediately. That is not just a payment-protection issue — off-platform is where the malicious file and the fake login page arrive.
Priority 4: Client accounts you have access to
This is where professional practice matters more than personal security hygiene.
Never accept a client’s password. It is bad for both of you: you inherit liability for anything that happens, and they lose any audit trail. When a client offers, redirect them:
- Meta — Business Suite partner or user access, not the personal login.
- Google Ads / Analytics — user access by email, or an agency link.
- WordPress — your own user account with the minimum role you need. See 2FA on WordPress.
- Shopify — a staff account with scoped permissions.
- Google Workspace, Slack, Notion, Figma — all support proper guest or member access.
Where a client genuinely has a single shared login with no delegation — some older tools, some suppliers — use a shared password manager vault holding both the password and the TOTP secret, so nobody is forwarding codes over WhatsApp. The pattern is in 2FA for small teams.
And write the offboarding into your contract. When a project ends, access is removed, shared passwords are changed, and any shared 2FA is re-enrolled — because a TOTP secret you scanned still generates valid codes long after the password changes.
Your laptop is part of the security perimeter
Freelancers receive files from strangers for a living, which is a genuinely difficult position.
- Be paranoid about “brief” attachments and design assets from unvetted clients. Malicious files disguised as project material are the leading way freelancer machines get infected, and infostealers take session cookies that bypass 2FA entirely — see session hijacking.
- Never install cracked software. The cost saving is not worth the malware.
- Keep separate browser profiles for each client, so a compromise is compartmentalised.
- Full-disk encryption and a short auto-lock, particularly if you work in cafés or coworking spaces.
- Back up your work somewhere ransomware cannot reach — an offline or versioned copy.
A 45-minute setup you only do once
- Password manager installed, with its own strong master password and 2FA.
- Passkey or authenticator app on your primary email; SMS removed.
- 2FA on every payment platform, with backup codes saved offline.
- 2FA on every marketplace profile.
- Authenticator app backed up on a second device — how to back it up.
- Client access converted from shared passwords to delegated accounts, one client at a time.
- A line in your onboarding email stating your bank details never change by email.
Frequently asked questions
A client insists on giving me their password. What do I say?
“I’d rather you add me as a user — it means you can remove my access instantly when we’re done, and you keep a record of who changed what.” Framing it as their protection works better than framing it as yours.
How do I handle 2FA on a client account I manage?
Ideally you never touch it — they hold it, you have your own delegated login. Where you must share, use a shared password manager vault, never chat messages.
What if a client’s account gets compromised while I have access?
Tell them immediately, document what access you had and when, and help with recovery. Silence turns a security incident into a professional one.
Is a VPN necessary for freelancing?
Not for security in the way people imagine. HTTPS already protects your traffic. Your real risks are phishing, malicious files and account takeover — none of which a VPN addresses.
Should I use one email for everything?
Use one professional address for clients and money, well protected, and separate personal accounts. Consider a dedicated recovery address that you never publish anywhere.
What is the single highest-impact change?
A passkey or authenticator app on your primary email, plus checking it for forwarding rules. Everything else in your professional life resets through that inbox.
The bottom line
Freelancers carry business-grade risk with consumer-grade tooling. The fix is not complicated: protect the email, protect the payouts, refuse shared passwords, and be careful what you open. Forty-five minutes once, then a quarterly check — and the thing you are really protecting, your reputation with clients, stays intact.
New to any of this? Start with what an authenticator app is, then work down the priority list above.